Pull networking fixes from David Miller: 1) ICE, E1000, IGB, IXGBE, and I40E bug fixes from the Intel folks. 2) Better fix for AB-BA deadlock in packet scheduler code, from Cong Wang. 3) bpf sockmap fixes (zero sized key handling, etc.) from Daniel Borkmann. 4) Send zero IPID in TCP resets and SYN-RECV state ACKs, to prevent attackers using it as a side-channel. From Eric Dumazet. 5) Memory leak in mediatek bluetooth driver, from Gustavo A. R. Silva. 6) Hook up rt->dst.input of ipv6 anycast routes properly, from Hangbin Liu. 7) hns and hns3 bug fixes from Huazhong Tan. 8) Fix RIF leak in mlxsw driver, from Ido Schimmel. 9) iova range check fix in vhost, from Jason Wang. 10) Fix hang in do_tcp_sendpages() with tls, from John Fastabend. 11) More r8152 chips need to disable RX aggregation, from Kai-Heng Feng. 12) Memory exposure in TCA_U32_SEL handling, from Kees Cook. 13) TCP BBR congestion control fixes from Kevin Yang. 14) hv_netvsc, ignore non-PCI devices, from Stephen Hemminger. 15) qed driver fixes from Tomer Tayar. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (77 commits) net: sched: Fix memory exposure from short TCA_U32_SEL qed: fix spelling mistake "comparsion" -> "comparison" vhost: correctly check the iova range when waking virtqueue qlge: Fix netdev features configuration. net: macb: do not disable MDIO bus at open/close time Revert "net: stmmac: fix build failure due to missing COMMON_CLK dependency" net: macb: Fix regression breaking non-MDIO fixed-link PHYs mlxsw: spectrum_switchdev: Do not leak RIFs when removing bridge i40e: fix condition of WARN_ONCE for stat strings i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled ixgbe: fix driver behaviour after issuing VFLR ixgbe: Prevent unsupported configurations with XDP ixgbe: Replace GFP_ATOMIC with GFP_KERNEL igb: Replace mdelay() with msleep() in igb_integrated_phy_loopback() igb: Replace GFP_ATOMIC with GFP_KERNEL in igb_sw_init() igb: Use an advanced ctx descriptor for launchtime e1000: ensure to free old tx/rx rings in set_ringparam() e1000: check on netif_running() before calling e1000_up() ixgb: use dma_zalloc_coherent instead of allocator/memset ice: Trivial formatting fixes ...
Showing the changes to kernel (2 of 92 files). Show all
Unified · Split
| @@ -15,6 +15,7 @@ · 14 unmodified lines | ||
| 15 | 15 | #include <linux/jhash.h> |
| 16 | 16 | #include <linux/filter.h> |
| 17 | 17 | #include <linux/rculist_nulls.h> |
| 18 | +#include <linux/random.h> | |
| 18 | 19 | #include <uapi/linux/btf.h> |
| 19 | 20 | #include "percpu_freelist.h" |
| 20 | 21 | #include "bpf_lru_list.h" |
| @@ -41,6 +42,7 @@ struct bpf_htab { · 20 unmodified lines | ||
| 41 | 42 | atomic_t count; /* number of elements in this hashtable */ |
| 42 | 43 | u32 n_buckets; /* number of hash buckets */ |
| 43 | 44 | u32 elem_size; /* size of each element in bytes */ |
| 45 | + u32 hashrnd; | |
| 44 | 46 | }; |
| 45 | 47 | |
| 46 | 48 | /* each htab element is struct htab_elem + key + value */ |
| @@ -371,6 +373,7 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) · 324 unmodified lines | ||
| 371 | 373 | if (!htab->buckets) |
| 372 | 374 | goto free_htab; |
| 373 | 375 | |
| 376 | + htab->hashrnd = get_random_int(); | |
| 374 | 377 | for (i = 0; i < htab->n_buckets; i++) { |
| 375 | 378 | INIT_HLIST_NULLS_HEAD(&htab->buckets[i].head, i); |
| 376 | 379 | raw_spin_lock_init(&htab->buckets[i].lock); |
| @@ -402,9 +405,9 @@ free_htab: · 25 unmodified lines | ||
| 402 | 405 | return ERR_PTR(err); |
| 403 | 406 | } |
| 404 | 407 | |
| 405 | −static inline u32 htab_map_hash(const void *key, u32 key_len) | |
| 408 | +static inline u32 htab_map_hash(const void *key, u32 key_len, u32 hashrnd) | |
| 406 | 409 | { |
| 407 | − return jhash(key, key_len, 0); | |
| 410 | + return jhash(key, key_len, hashrnd); | |
| 408 | 411 | } |
| 409 | 412 | |
| 410 | 413 | static inline struct bucket *__select_bucket(struct bpf_htab *htab, u32 hash) |
| @@ -470,7 +473,7 @@ static void *__htab_map_lookup_elem(struct bpf_map *map, void *key) · 59 unmodified lines | ||
| 470 | 473 | |
| 471 | 474 | key_size = map->key_size; |
| 472 | 475 | |
| 473 | − hash = htab_map_hash(key, key_size); | |
| 476 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 474 | 477 | |
| 475 | 478 | head = select_bucket(htab, hash); |
| 476 | 479 | |
| @@ -597,7 +600,7 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key) · 120 unmodified lines | ||
| 597 | 600 | if (!key) |
| 598 | 601 | goto find_first_elem; |
| 599 | 602 | |
| 600 | − hash = htab_map_hash(key, key_size); | |
| 603 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 601 | 604 | |
| 602 | 605 | head = select_bucket(htab, hash); |
| 603 | 606 | |
| @@ -824,7 +827,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value, · 220 unmodified lines | ||
| 824 | 827 | |
| 825 | 828 | key_size = map->key_size; |
| 826 | 829 | |
| 827 | − hash = htab_map_hash(key, key_size); | |
| 830 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 828 | 831 | |
| 829 | 832 | b = __select_bucket(htab, hash); |
| 830 | 833 | head = &b->head; |
| @@ -880,7 +883,7 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value, · 49 unmodified lines | ||
| 880 | 883 | |
| 881 | 884 | key_size = map->key_size; |
| 882 | 885 | |
| 883 | − hash = htab_map_hash(key, key_size); | |
| 886 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 884 | 887 | |
| 885 | 888 | b = __select_bucket(htab, hash); |
| 886 | 889 | head = &b->head; |
| @@ -945,7 +948,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key, · 58 unmodified lines | ||
| 945 | 948 | |
| 946 | 949 | key_size = map->key_size; |
| 947 | 950 | |
| 948 | − hash = htab_map_hash(key, key_size); | |
| 951 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 949 | 952 | |
| 950 | 953 | b = __select_bucket(htab, hash); |
| 951 | 954 | head = &b->head; |
| @@ -998,7 +1001,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, · 46 unmodified lines | ||
| 998 | 1001 | |
| 999 | 1002 | key_size = map->key_size; |
| 1000 | 1003 | |
| 1001 | − hash = htab_map_hash(key, key_size); | |
| 1004 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 1002 | 1005 | |
| 1003 | 1006 | b = __select_bucket(htab, hash); |
| 1004 | 1007 | head = &b->head; |
| @@ -1071,7 +1074,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key) · 66 unmodified lines | ||
| 1071 | 1074 | |
| 1072 | 1075 | key_size = map->key_size; |
| 1073 | 1076 | |
| 1074 | − hash = htab_map_hash(key, key_size); | |
| 1077 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 1075 | 1078 | b = __select_bucket(htab, hash); |
| 1076 | 1079 | head = &b->head; |
| 1077 | 1080 | |
| @@ -1103,7 +1106,7 @@ static int htab_lru_map_delete_elem(struct bpf_map *map, void *key) · 25 unmodified lines | ||
| 1103 | 1106 | |
| 1104 | 1107 | key_size = map->key_size; |
| 1105 | 1108 | |
| 1106 | − hash = htab_map_hash(key, key_size); | |
| 1109 | + hash = htab_map_hash(key, key_size, htab->hashrnd); | |
| 1107 | 1110 | b = __select_bucket(htab, hash); |
| 1108 | 1111 | head = &b->head; |
| 1109 | 1112 | |
| @@ -1427,12 +1427,15 @@ out: · 1426 unmodified lines | ||
| 1427 | 1427 | static void smap_write_space(struct sock *sk) |
| 1428 | 1428 | { |
| 1429 | 1429 | struct smap_psock *psock; |
| 1430 | + void (*write_space)(struct sock *sk); | |
| 1430 | 1431 | |
| 1431 | 1432 | rcu_read_lock(); |
| 1432 | 1433 | psock = smap_psock_sk(sk); |
| 1433 | 1434 | if (likely(psock && test_bit(SMAP_TX_RUNNING, &psock->state))) |
| 1434 | 1435 | schedule_work(&psock->tx_work); |
| 1436 | + write_space = psock->save_write_space; | |
| 1435 | 1437 | rcu_read_unlock(); |
| 1438 | + write_space(sk); | |
| 1436 | 1439 | } |
| 1437 | 1440 | |
| 1438 | 1441 | static void smap_stop_sock(struct smap_psock *psock, struct sock *sk) |
| @@ -2140,7 +2143,9 @@ static struct bpf_map *sock_hash_alloc(union bpf_attr *attr) · 701 unmodified lines | ||
| 2140 | 2143 | return ERR_PTR(-EPERM); |
| 2141 | 2144 | |
| 2142 | 2145 | /* check sanity of attributes */ |
| 2143 | − if (attr->max_entries == 0 || attr->value_size != 4 || | |
| 2146 | + if (attr->max_entries == 0 || | |
| 2147 | + attr->key_size == 0 || | |
| 2148 | + attr->value_size != 4 || | |
| 2144 | 2149 | attr->map_flags & ~SOCK_CREATE_FLAG_MASK) |
| 2145 | 2150 | return ERR_PTR(-EINVAL); |
| 2146 | 2151 | |
| @@ -2267,8 +2272,10 @@ static struct htab_elem *alloc_sock_hash_elem(struct bpf_htab *htab, · 120 unmodified lines | ||
| 2267 | 2272 | } |
| 2268 | 2273 | l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN, |
| 2269 | 2274 | htab->map.numa_node); |
| 2270 | − if (!l_new) | |
| 2275 | + if (!l_new) { | |
| 2276 | + atomic_dec(&htab->count); | |
| 2271 | 2277 | return ERR_PTR(-ENOMEM); |
| 2278 | + } | |
| 2272 | 2279 | |
| 2273 | 2280 | memcpy(l_new->key, key, key_size); |
| 2274 | 2281 | l_new->sk = sk; |