BMC/Intel-BMC/linux.git/net, branch dev-4.3

net/ncsi: Fix possible deadlock caught with lockdep

2016-02-29T01:22:41+00:00

Bringing the interfaces down with ifdown -a directly after boot causes a lockdep warning. It appears that a network interrupt would result in an attempt to acquire that lock again. The solution is to soft disable interrupts. ================================= [ INFO: inconsistent lock state ] 4.3.6 #1 Not tainted --------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. ip/934 [HC0[0]:SC0[0]:HE1:SE1] takes: (&(&ndp->ndp_package_lock)->rlock){+.?...}, at: [] ncsi_stop_dev+0x14/0x50 {IN-SOFTIRQ-W} state was registered at: [] _raw_spin_lock+0x28/0x38 [] ncsi_add_package+0x64/0xf0 [] ncsi_rsp_handler_sp+0x80/0xe0 [] ncsi_rcv_rsp+0xd4/0x104 [] __netif_receive_skb_core+0x6c4/0x808 [] netif_receive_skb_internal+0xb4/0x138 [] napi_gro_receive+0x48/0x9c [] ftgmac100_poll+0x360/0x59c [] net_rx_action+0xe8/0x2a0 [] __do_softirq+0x108/0x26c [] do_softirq+0x48/0x70 [] __local_bh_enable_ip+0xc8/0x104 [] __dev_queue_xmit+0x654/0x6c4 [] ncsi_xmit_cmd+0x1d4/0x208 [] ncsi_dev_start+0xd0/0x3c0 [] ncsi_dev_work+0x1b8/0x1fc [] process_one_work+0x228/0x3cc [] worker_thread+0x2a4/0x3d8 [] kthread+0xc4/0xd8 [] ret_from_fork+0x14/0x28 irq event stamp: 2009 hardirqs last enabled at (2009): [] __local_bh_enable_ip+0xe4/0x104 hardirqs last disabled at (2007): [] __local_bh_enable_ip+0x64/0x104 softirqs last enabled at (2008): [] dev_deactivate_many+0x270/0x2ac softirqs last disabled at (2006): [] dev_deactivate_many+0x254/0x2ac other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&ndp->ndp_package_lock)->rlock); lock(&(&ndp->ndp_package_lock)->rlock); *** DEADLOCK *** 1 lock held by ip/934: #0: (rtnl_mutex){+.+.+.}, at: [] devinet_ioctl+0x15c/0x6c8 stack backtrace: CPU: 0 PID: 934 Comm: ip Not tainted 4.3.6 #1 Hardware name: ASpeed SoC [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (print_usage_bug.part.11+0x220/0x288) [] (print_usage_bug.part.11) from [] (mark_lock+0x400/0x678) [] (mark_lock) from [] (__lock_acquire+0xa0c/0x1a9c) [] (__lock_acquire) from [] (lock_acquire+0x9c/0xbc) [] (lock_acquire) from [] (_raw_spin_lock+0x28/0x38) [] (_raw_spin_lock) from [] (ncsi_stop_dev+0x14/0x50) [] (ncsi_stop_dev) from [] (ftgmac100_stop+0x1c/0x28) [] (ftgmac100_stop) from [] (__dev_close_many+0xa0/0xc8) [] (__dev_close_many) from [] (__dev_close+0x20/0x34) [] (__dev_close) from [] (__dev_change_flags+0x8c/0x138) [] (__dev_change_flags) from [] (dev_change_flags+0x18/0x48) [] (dev_change_flags) from [] (devinet_ioctl+0x32c/0x6c8) [] (devinet_ioctl) from [] (sock_ioctl+0x26c/0x2d0) [] (sock_ioctl) from [] (do_vfs_ioctl+0x588/0x67c) [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x1c) Signed-off-by: Cyril Bur Signed-off-by: Joel Stanley

ncsi: Fix not releasing lock in ncsi_rcv_rsp()

2016-02-02T02:57:40+00:00

Signed-off-by: Joel Stanley

Merge tag 'v4.3.5' into dev-4.3

2016-02-02T02:23:42+00:00

This is the 4.3.5 stable release Signed-off-by: Joel Stanley

xfrm: dst_entries_init() per-net dst_ops

2016-01-31T19:25:52+00:00

[ Upstream commit a8a572a6b5f2a79280d6e302cb3c1cb1fbaeb3e8 ] Remove the dst_entries_init/destroy calls for xfrm4 and xfrm6 dst_ops templates; their dst_entries counters will never be used. Move the xfrm dst_ops initialization from the common xfrm/xfrm_policy.c to xfrm4/xfrm4_policy.c and xfrm6/xfrm6_policy.c, and call dst_entries_init and dst_entries_destroy for each net namespace. The ipv4 and ipv6 xfrms each create dst_ops template, and perform dst_entries_init on the templates. The template values are copied to each net namespace's xfrm.xfrm*_dst_ops. The problem there is the dst_ops pcpuc_entries field is a percpu counter and cannot be used correctly by simply copying it to another object. The result of this is a very subtle bug; changes to the dst entries counter from one net namespace may sometimes get applied to a different net namespace dst entries counter. This is because of how the percpu counter works; it has a main count field as well as a pointer to the percpu variables. Each net namespace maintains its own main count variable, but all point to one set of percpu variables. When any net namespace happens to change one of the percpu variables to outside its small batch range, its count is moved to the net namespace's main count variable. So with multiple net namespaces operating concurrently, the dst_ops entries counter can stray from the actual value that it should be; if counts are consistently moved from one net namespace to another (which my testing showed is likely), then one net namespace winds up with a negative dst_ops count while another winds up with a continually increasing count, eventually reaching its gc_thresh limit, which causes all new traffic on the net namespace to fail with -ENOBUFS. Signed-off-by: Dan Streetman Signed-off-by: Dan Streetman Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman

batman-adv: Drop immediate orig_node free function

2016-01-31T19:25:52+00:00

[ Upstream commit 42eff6a617e23b691f8e4467f4687ed7245a92db ] It is not allowed to free the memory of an object which is part of a list which is protected by rcu-read-side-critical sections without making sure that no other context is accessing the object anymore. This usually happens by removing the references to this object and then waiting until the rcu grace period is over and no one (allowedly) accesses it anymore. But the _now functions ignore this completely. They free the object directly even when a different context still tries to access it. This has to be avoided and thus these functions must be removed and all functions have to use batadv_orig_node_free_ref. Fixes: 72822225bd41 ("batman-adv: Fix rcu_barrier() miss due to double call_rcu() in TT code") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman

batman-adv: Drop immediate batadv_hard_iface free function

2016-01-31T19:25:52+00:00

[ Upstream commit b4d922cfc9c08318eeb77d53b7633740e6b0efb0 ] It is not allowed to free the memory of an object which is part of a list which is protected by rcu-read-side-critical sections without making sure that no other context is accessing the object anymore. This usually happens by removing the references to this object and then waiting until the rcu grace period is over and no one (allowedly) accesses it anymore. But the _now functions ignore this completely. They free the object directly even when a different context still tries to access it. This has to be avoided and thus these functions must be removed and all functions have to use batadv_hardif_free_ref. Fixes: 89652331c00f ("batman-adv: split tq information in neigh_node struct") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman

batman-adv: Drop immediate neigh_ifinfo free function

2016-01-31T19:25:52+00:00

[ Upstream commit ae3e1e36e3cb6c686a7a2725af20ca86aa46d62a ] It is not allowed to free the memory of an object which is part of a list which is protected by rcu-read-side-critical sections without making sure that no other context is accessing the object anymore. This usually happens by removing the references to this object and then waiting until the rcu grace period is over and no one (allowedly) accesses it anymore. But the _now functions ignore this completely. They free the object directly even when a different context still tries to access it. This has to be avoided and thus these functions must be removed and all functions have to use batadv_neigh_ifinfo_free_ref. Fixes: 89652331c00f ("batman-adv: split tq information in neigh_node struct") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman

batman-adv: Drop immediate batadv_neigh_node free function

2016-01-31T19:25:52+00:00

[ Upstream commit 2baa753c276f27f8e844637561ad597867aa6fb6 ] It is not allowed to free the memory of an object which is part of a list which is protected by rcu-read-side-critical sections without making sure that no other context is accessing the object anymore. This usually happens by removing the references to this object and then waiting until the rcu grace period is over and no one (allowedly) accesses it anymore. But the _now functions ignore this completely. They free the object directly even when a different context still tries to access it. This has to be avoided and thus these functions must be removed and all functions have to use batadv_neigh_node_free_ref. Fixes: 89652331c00f ("batman-adv: split tq information in neigh_node struct") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman

batman-adv: Drop immediate batadv_orig_ifinfo free function

2016-01-31T19:25:52+00:00

[ Upstream commit deed96605f5695cb945e0b3d79429581857a2b9d ] It is not allowed to free the memory of an object which is part of a list which is protected by rcu-read-side-critical sections without making sure that no other context is accessing the object anymore. This usually happens by removing the references to this object and then waiting until the rcu grace period is over and no one (allowedly) accesses it anymore. But the _now functions ignore this completely. They free the object directly even when a different context still tries to access it. This has to be avoided and thus these functions must be removed and all functions have to use batadv_orig_ifinfo_free_ref. Fixes: 7351a4822d42 ("batman-adv: split out router from orig_node") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman

batman-adv: Avoid recursive call_rcu for batadv_nc_node

2016-01-31T19:25:52+00:00

[ Upstream commit 44e8e7e91d6c7c7ab19688750f7257292640d1a0 ] The batadv_nc_node_free_ref function uses call_rcu to delay the free of the batadv_nc_node object until no (already started) rcu_read_lock is enabled anymore. This makes sure that no context is still trying to access the object which should be removed. But batadv_nc_node also contains a reference to orig_node which must be removed. The reference drop of orig_node was done in the call_rcu function batadv_nc_node_free_rcu but should actually be done in the batadv_nc_node_release function to avoid nested call_rcus. This is important because rcu_barrier (e.g. batadv_softif_free or batadv_exit) will not detect the inner call_rcu as relevant for its execution. Otherwise this barrier will most likely be inserted in the queue before the callback of the first call_rcu was executed. The caller of rcu_barrier will therefore continue to run before the inner call_rcu callback finished. Fixes: d56b1705e28c ("batman-adv: network coding - detect coding nodes and remove these after timeout") Signed-off-by: Sven Eckelmann Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman