[PATCH bpf-next] bpf: comment why dots in filenames under BPF virtual FS are not allowed

2018-03-08 Thread Jakub Kicinski
From: Quentin Monnet When pinning a file under the BPF virtual file system (traditionally /sys/fs/bpf), using a dot in the name of the location to pin at is not allowed. For example, trying to pin at "/sys/fs/bpf/foo.bar" will be rejected with -EPERM. This check was introduced at the same time a

Re: [PATCH bpf-next 1/7] tools: bpftool: silence 'missing initializer' warnings

2018-03-08 Thread Jakub Kicinski
On Thu, 8 Mar 2018 23:00:35 +0100, Jiri Benc wrote: > When building bpf tool, gcc emits piles of warnings: > > prog.c: In function ‘prog_fd_by_tag’: > prog.c:101:9: warning: missing initializer for field ‘type’ of ‘struct > bpf_prog_info’ [-Wmissing-field-initializers] > struct bpf_prog_info i

Re: [PATCH bpf-next 0/7] tools: bpf: standardize make

2018-03-08 Thread Jakub Kicinski
On Thu, 8 Mar 2018 21:10:59 -0800, Alexei Starovoitov wrote: > On Thu, Mar 8, 2018 at 2:00 PM, Jiri Benc wrote: > > Currently, 'make bpf' in the tools/ directory does not provide the standard > > quiet output except for bpftool (which is however listed with a wrong > > directory). Worse, it does n

[PATCH net-next] cxgb4: increase max tx rate limit to 100 Gbps

2018-03-08 Thread Ganesh Goudar
T6 cards can support up to 100 G speeds. So, increase max programmable tx rate limit to 100 Gbps. Signed-off-by: Ganesh Goudar --- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 6 +++--- drivers/net/ethernet/chelsio/cxgb4/sched.h | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-

Re: [bpf-next V2 PATCH 02/15] xdp: introduce xdp_return_frame API and use in cpumap

2018-03-08 Thread Jason Wang
On 2018年03月08日 21:07, Jesper Dangaard Brouer wrote: Introduce an xdp_return_frame API, and convert over cpumap as the first user, given it have queued XDP frame structure to leverage. Signed-off-by: Jesper Dangaard Brouer --- include/net/xdp.h | 32 +++ kernel/b

Re: [bpf-next V2 PATCH 06/15] tun: convert to use generic xdp_frame and xdp_return_frame API

2018-03-08 Thread Jason Wang
On 2018年03月08日 23:16, Jesper Dangaard Brouer wrote: Hi Jason, Please see below FIXME, which is actually a question to you. On Thu, 08 Mar 2018 14:08:11 +0100 Jesper Dangaard Brouer wrote: diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 475088f947bb..cd046cf31b77 100644 --- a/driv

[PATCH net 1/3] vhost_net: initialize rx_ring in vhost_net_open()

2018-03-08 Thread Jason Wang
From: Alexander Potapenko KMSAN reported a use of uninit memory in vhost_net_buf_unproduce() while trying to access n->vqs[VHOST_NET_VQ_TX].rx_ring: == BUG: KMSAN: use of uninitialized memory in vhost_net_buf_unproduce+0x7bb/0x9a0

[PATCH net 0/3] Several fixes for vhost_net ptr_ring usage

2018-03-08 Thread Jason Wang
Hi: This small series try to fix several bugs of ptr_ring usage in vhost_net. Please review. Thanks Alexander Potapenko (1): vhost_net: initialize rx_ring in vhost_net_open() Jason Wang (2): vhost_net: keep private_data and rx_ring synced vhost_net: examine pointer types during un-produci

[PATCH net 3/3] vhost_net: examine pointer types during un-producing

2018-03-08 Thread Jason Wang
After commit fc72d1d54dd9 ("tuntap: XDP transmission"), we can actually queueing XDP pointers in the pointer ring, so we should examine the pointer type before freeing the pointer. Fixes: fc72d1d54dd9 ("tuntap: XDP transmission") Reported-by: Michael S. Tsirkin Acked-by: Michael S. Tsirkin Signe

[PATCH net 2/3] vhost_net: keep private_data and rx_ring synced

2018-03-08 Thread Jason Wang
We get pointer ring from the exported sock, this means we should keep rx_ring and vq->private synced during both vq stop and backend set, otherwise we may see stale rx_ring. Fixes: c67df11f6e480 ("vhost_net: try batch dequing from skb array") Signed-off-by: Michael S. Tsirkin Signed-off-by: Jason

[PATCH] rsi: Remove stack VLA usage

2018-03-08 Thread Tobin C. Harding
The kernel would like to have all stack VLA usage removed[1]. rsi uses a VLA based on 'blksize'. Elsewhere in the SDIO code maximum block size is defined using a magic number. We can use a pre-processor defined constant and declare the array to maximum size. We add a check before accessing the

Re: [PATCH] vhost_net: initialize rx_ring in vhost_net_open()

2018-03-08 Thread Jason Wang
On 2018年03月08日 23:50, Alexander Potapenko wrote: On Thu, Mar 8, 2018 at 4:45 PM, Eric Dumazet wrote: On 03/08/2018 07:20 AM, Alexander Potapenko wrote: On Thu, Mar 8, 2018 at 4:15 PM, Eric Dumazet wrote: On 03/08/2018 05:37 AM, Alexander Potapenko wrote: KMSAN reported a use of uninit mem

[PATCH] net: ethernet: ave: enable Rx drop interrupt

2018-03-08 Thread Kunihiko Hayashi
This enables AVE_GI_RXDROP interrupt factor. This factor indicates depletion of Rx descriptors and the handler counts the number of dropped packets. Signed-off-by: Kunihiko Hayashi --- drivers/net/ethernet/socionext/sni_ave.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dr

Re: [PATCH net] vhost_net: examine pointer types during un-producing

2018-03-08 Thread Jason Wang
On 2018年03月09日 11:16, Jason Wang wrote: After commit 761876c857cb ("tap: XDP support"), we can actually queueing XDP pointers in the pointer ring, so we should examine the pointer type before freeing the pointer. Fixes: 761876c857cb ("tap: XDP support") Oops, the commit is wrong, let me repo

[PATCH] pktgen: Remove VLA usage

2018-03-08 Thread Gustavo A. R. Silva
In preparation to enabling -Wvla, remove VLA usage and replace it with a fixed-length array instead. Signed-off-by: Gustavo A. R. Silva --- David, I'm not sure how often this function is being called and, depending on the frequency it may be worth to use dynamic memory allocation instead? Thank

Re: [PATCH bpf-next 0/7] tools: bpf: standardize make

2018-03-08 Thread Alexei Starovoitov
On Thu, Mar 8, 2018 at 2:00 PM, Jiri Benc wrote: > Currently, 'make bpf' in the tools/ directory does not provide the standard > quiet output except for bpftool (which is however listed with a wrong > directory). Worse, it does not respect the build output directory. > > The 'make bpf_install' doe

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Alexei Starovoitov
On 3/8/18 7:54 PM, Andy Lutomirski wrote: On Mar 8, 2018, at 7:06 PM, Linus Torvalds wrote: Honestly, that "read twice" thing may be what scuttles this. Initially, I thought it was a non-issue, because anybody who controls the module subdirectory enough to rewrite files would be in a posi

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Andy Lutomirski
> On Mar 8, 2018, at 7:06 PM, Linus Torvalds > wrote: > > > Honestly, that "read twice" thing may be what scuttles this. > Initially, I thought it was a non-issue, because anybody who controls > the module subdirectory enough to rewrite files would be in a position > to just execute the file

Re: [PATCH net] vhost_net: examine pointer types during un-producing

2018-03-08 Thread Michael S. Tsirkin
On Fri, Mar 09, 2018 at 11:16:22AM +0800, Jason Wang wrote: > After commit 761876c857cb ("tap: XDP support"), we can actually > queueing XDP pointers in the pointer ring, so we should examine the > pointer type before freeing the pointer. > > Fixes: 761876c857cb ("tap: XDP support") > Reported-by:

Re: [PATCH] vhost_net: initialize rx_ring in vhost_net_open()

2018-03-08 Thread Jason Wang
On 2018年03月09日 11:29, Michael S. Tsirkin wrote: On Fri, Mar 09, 2018 at 10:30:17AM +0800, Jason Wang wrote: On 2018年03月09日 00:00, Michael S. Tsirkin wrote: On Thu, Mar 08, 2018 at 04:55:39PM +0100, Alexander Potapenko wrote: On Thu, Mar 8, 2018 at 4:33 PM, Michael S. Tsirkin wrote: On Thu

Re: [PATCH] vhost_net: initialize rx_ring in vhost_net_open()

2018-03-08 Thread Michael S. Tsirkin
On Fri, Mar 09, 2018 at 10:30:17AM +0800, Jason Wang wrote: > > > On 2018年03月09日 00:00, Michael S. Tsirkin wrote: > > On Thu, Mar 08, 2018 at 04:55:39PM +0100, Alexander Potapenko wrote: > > > On Thu, Mar 8, 2018 at 4:33 PM, Michael S. Tsirkin > > > wrote: > > > > On Thu, Mar 08, 2018 at 02:37:

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Alexei Starovoitov
On Fri, Mar 09, 2018 at 02:12:24AM +, Andy Lutomirski wrote: > On Fri, Mar 9, 2018 at 1:20 AM, Alexei Starovoitov > wrote: > > On Fri, Mar 09, 2018 at 12:59:36AM +, Andy Lutomirski wrote: > >> > >> Alexei, can you give an example use case? I'm sure it's upthread > >> somewhere, but I'm ha

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Linus Torvalds
On Thu, Mar 8, 2018 at 7:06 PM, Linus Torvalds wrote: > > So I don't like Andy's "let's make it a kernel module and then that > kernel module can execve() a blob". THAT seems like just stupid > indirection. > > But I do like Andy's "execve a blob" part, because it is the *blob* > that has had its

[PATCH net] vhost_net: examine pointer types during un-producing

2018-03-08 Thread Jason Wang
After commit 761876c857cb ("tap: XDP support"), we can actually queueing XDP pointers in the pointer ring, so we should examine the pointer type before freeing the pointer. Fixes: 761876c857cb ("tap: XDP support") Reported-by: Michael S. Tsirkin Signed-off-by: Jason Wang --- drivers/net/tun.c

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Andy Lutomirski
> On Mar 8, 2018, at 6:31 PM, David Miller wrote: > > From: Andy Lutomirski > Date: Fri, 9 Mar 2018 02:12:24 + > >> First, compile your user code and emit a staitc binary. Use objdump >> fiddling or a trivial .S file to make that static binary into a >> variable. Then write a tiny shim

[PATCH] net: use skb_is_gso_sctp() instead of open-coding

2018-03-08 Thread Daniel Axtens
As well as the basic conversion, I noticed that a lot of the SCTP code checks gso_type without first checking skb_is_gso() so I have added that where appropriate. Also, document the helper. Cc: Daniel Borkmann Cc: Marcelo Ricardo Leitner Signed-off-by: Daniel Axtens --- This depends on d02f5

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Linus Torvalds
On Thu, Mar 8, 2018 at 5:44 PM, Kees Cook wrote: > > My concerns are mostly about crossing namespaces. If a container > triggers an autoload, the result runs in the init_ns. Heh. I saw that as an advantage. It's basically the same semantics as a normal module load does - in that the "kernel names

[PATCH] drivers: vhost: vsock: fixed a brace coding style issue

2018-03-08 Thread Vaibhav Murkute
Fixed a coding style issue. Signed-off-by: Vaibhav Murkute --- drivers/vhost/vsock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 0d14e2ff19f1..0898dbdbf955 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock

Re: [PATCH v2 net-next 0/2] ntuple filters with RSS

2018-03-08 Thread David Miller
From: Edward Cree Date: Thu, 8 Mar 2018 15:43:50 + > This series introduces the ability to mark an ethtool steering filter to use > RSS spreading, and the ability to create and configure multiple RSS contexts > with different indirection tables, hash keys, and hash fields. > An implementati

Re: [RFC PATCH linux-next] rds: rds_info_from_znotifier() can be static

2018-03-08 Thread David Miller
From: kbuild test robot Date: Thu, 8 Mar 2018 19:37:30 +0800 > Fixes: 9426bbc6de99 ("rds: use list structure to track information for > zerocopy completion notification") > Signed-off-by: Fengguang Wu Applied.

Re: [RFC PATCH linux-next] rds: rds_message_zcopy_from_user() can be static

2018-03-08 Thread David Miller
From: Sowmini Varadhan Date: Thu, 8 Mar 2018 06:25:52 -0500 > On (03/08/18 18:56), kbuild test robot wrote: >> >> Fixes: d40a126b16ea ("rds: refactor zcopy code into >> rds_message_zcopy_from_user") >> Signed-off-by: Fengguang Wu > > Acked-by: Sowmini Varadhan > > (do I need to separately s

Re: [PATCH net-next] net: stmmac: remove superfluous wmb() memory barriers

2018-03-08 Thread David Miller
From: Niklas Cassel Date: Thu, 8 Mar 2018 11:30:05 +0100 > These wmb() memory barriers are performed after the last descriptor write, > and they are followed by enable_dma_transmission()/set_tx_tail_ptr(), > i.e. a writel() to MMIO register space. > Since writel() itself performs the equivalent

Re: [PATCH 1/2 net-next] net/ncsi: use kfree_skb() instead of kfree()

2018-03-08 Thread David Miller
From: Dan Carpenter Date: Thu, 8 Mar 2018 12:36:04 +0300 > We're supposed to use kfree_skb() to free these sk_buffs. > > Fixes: 955dc68cb9b2 ("net/ncsi: Add generic netlink family") > Signed-off-by: Dan Carpenter Applied.

Re: [PATCH 2/2 net-next] net/ncsi: unlock on error in ncsi_set_interface_nl()

2018-03-08 Thread David Miller
From: Dan Carpenter Date: Thu, 8 Mar 2018 12:36:28 +0300 > There are two error paths which are missing unlocks in this function. > > Fixes: 955dc68cb9b2 ("net/ncsi: Add generic netlink family") > Signed-off-by: Dan Carpenter Also applied, thanks Dan.

Re: [PATCH net-next] liquidio: fix ndo_change_mtu to always return correct status to the caller

2018-03-08 Thread David Miller
From: Felix Manlunas Date: Wed, 7 Mar 2018 22:36:46 -0800 > + /* command is successful, change the MTU. */ > + netif_info(lio, probe, lio->netdev, "MTU changed from %d to %d\n", > +netdev->mtu, new_mtu); Please do not do this, this log message is excessive. The success r

Re: [PATCH net-next] liquidio: avoid doing useless work

2018-03-08 Thread David Miller
From: Felix Manlunas Date: Wed, 7 Mar 2018 22:23:32 -0800 > From: Prasad Kanneganti > > Avoid doing useless work by making sure that the response_list is not empty > before scheduling work to process it. > > Signed-off-by: Prasad Kanneganti > Signed-off-by: Felix Manlunas Applied.

Re: [PATCH net-next] liquidio: Resolved mbox read issue while reading more than one 64bit data

2018-03-08 Thread David Miller
From: Felix Manlunas Date: Wed, 7 Mar 2018 22:12:24 -0800 > From: Intiyaz Basha > > Corrected length check when data received in the mbox is more than one > 64 bit data value > > Signed-off-by: Intiyaz Basha > Signed-off-by: Felix Manlunas Applied.

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread David Miller
From: Andy Lutomirski Date: Fri, 9 Mar 2018 02:12:24 + > First, compile your user code and emit a staitc binary. Use objdump > fiddling or a trivial .S file to make that static binary into a > variable. Then write a tiny shim module like this: > > extern unsigned char __begin_user_code[],

Re: [PATCH] vhost_net: initialize rx_ring in vhost_net_open()

2018-03-08 Thread Jason Wang
On 2018年03月09日 00:00, Michael S. Tsirkin wrote: On Thu, Mar 08, 2018 at 04:55:39PM +0100, Alexander Potapenko wrote: On Thu, Mar 8, 2018 at 4:33 PM, Michael S. Tsirkin wrote: On Thu, Mar 08, 2018 at 02:37:17PM +0100, Alexander Potapenko wrote: KMSAN reported a use of uninit memory in vhost_

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Andy Lutomirski
On Fri, Mar 9, 2018 at 1:20 AM, Alexei Starovoitov wrote: > On Fri, Mar 09, 2018 at 12:59:36AM +, Andy Lutomirski wrote: >> >> Alexei, can you give an example use case? I'm sure it's upthread >> somewhere, but I'm having trouble finding it. > > at the time of iptable's setsockopt() the kernel

[PATCH net v2] openvswitch: meter: fix the incorrect calculation of max delta_t

2018-03-08 Thread zhangliping
From: zhangliping Max delat_t should be the full_bucket/rate instead of the full_bucket. Also report EINVAL if the rate is zero. Fixes: 96fbc13d7e77 ("openvswitch: Add meter infrastructure") Cc: Andy Zhou Signed-off-by: zhangliping --- V2: report EINVAL if the rate is 0 to avoid divide by zer

[PATCH net-next 1/9] net: hns3: refactor the hclge_get/set_rss function

2018-03-08 Thread Peng Li
From: Yunsheng Lin This patch refactors the hclge_get/set_rss function in order to fix the rss configuration loss problem during reset process. Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li --- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c| 39 -- .../ethernet/h

[PATCH net-next 4/9] net: hns3: fix for pause configuration lost during reset

2018-03-08 Thread Peng Li
From: Yunsheng Lin Pause configuration will be set to default value by hclge_tm_schd_init during reset, which causes the RSS configuration loss problem. This patch fixes it by calling hclge_tm_init_hw during reset process , which will set the pause configuration to default value. Signed-off-by:

[PATCH net-next 5/9] net: hns3: fix for use-after-free when setting ring parameter

2018-03-08 Thread Peng Li
From: Yunsheng Lin In hns3_set_ringparam, hns3_uninit_all_ring frees the memory pointed by priv->ring_data[i].ring, and hns3_change_all_ring_bd_num use that pointer without mallocing, which will cause a use-after-free problem. The patch fixes it by not freeing the memory in hns3_uninit_all_ring,

[PATCH net-next 8/9] net: hns3: refactor the coalesce related struct

2018-03-08 Thread Peng Li
From: Yunsheng Lin This patch refoctors the coalesce related struct by introducing the hns3_enet_coalesce struct, in order to fix the coalesce configuation lost problem when changing the channel number. Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li --- drivers/net/ethernet/hisilicon/hns3

[PATCH net-next 7/9] net: hns3: fix for coalesce configuration lost during reset

2018-03-08 Thread Peng Li
From: Yunsheng Lin Coalesce configuration will be set to default value by hns3_nic_init_vector_data during reset, which causes the coalesce configuration loss problem. This patch fixes it by setting the default value in hns3_nic_alloc_vector_data, which will not be called in the reset process.

[PATCH net-next 0/9] fixes for configuration lost problems

2018-03-08 Thread Peng Li
This patchset refactors some functions and some bugs in order to fix the configuration loss problem when resetting and setting channel number. Yunsheng Lin (9): net: hns3: refactor the hclge_get/set_rss function net: hns3: refactor the hclge_get/set_rss_tuple function net: hns3: fix for RSS

[PATCH net-next 2/9] net: hns3: refactor the hclge_get/set_rss_tuple function

2018-03-08 Thread Peng Li
From: Yunsheng Lin This patch refactors the hclge_get/set_rss_tuple function in order to fix the rss configuration loss problem during reset process. Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li --- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c| 91 +- .../ethe

[PATCH net-next 9/9] net: hns3: fix for coal configuation lost when setting the channel

2018-03-08 Thread Peng Li
From: Yunsheng Lin This patch fixes the coalesce configuation lost problem when setting the channel number by restoring all vectors's coalesce configuation to vector 0's, because all vectors belonging to the same netdev have the same coalesce configuation for now. Signed-off-by: Yunsheng Lin Si

[PATCH net-next 6/9] net: hns3: refactor the get/put_vector function

2018-03-08 Thread Peng Li
From: Yunsheng Lin There is a get_vector function, which allocate the vectors for a client, but there is not a put_vector to free the vector. This patch introduces the put_vector function in order to fix the coalesce configuration lost problem during reset process. Signed-off-by: Yunsheng Lin

[PATCH net-next 3/9] net: hns3: fix for RSS configuration loss problem during reset

2018-03-08 Thread Peng Li
From: Yunsheng Lin RSS configuration will be set to default value by hclge_rss_init_hw during reset, which causes the RSS configuration loss problem. This patch fixes it by setting the default value in hclge_rss_init_cfg function, which will not be called in the reset process. Signed-off-by: Yu

[PATCH iproute2-next 2/3] ipmroute: convert to output JSON

2018-03-08 Thread Stephen Hemminger
From: Stephen Hemminger Should be no change for non-json case except putting color on address if desired. Signed-off-by: Stephen Hemminger --- ip/ipmroute.c | 99 --- 1 file changed, 67 insertions(+), 32 deletions(-) diff --git a/ip/ipmr

[PATCH iproute2-next 1/3] ipmaddr: json and color support

2018-03-08 Thread Stephen Hemminger
From: Stephen Hemminger Support printing mulitcast addresses in json and color mode. Output format is unchanged for normal use. Signed-off-by: Stephen Hemminger --- ip/ipmaddr.c | 69 +--- 1 file changed, 43 insertions(+), 26 deletions(-)

[PATCH iproute2-next 3/3] ipmroute: better error message if no kernel mroute

2018-03-08 Thread Stephen Hemminger
From: Stephen Hemminger If kernel does not support the IP multicast address family, then it will report all routes (PF_UNSPEC). Give the user a better error message and abort the command. Signed-off-by: Stephen Hemminger --- ip/ipmroute.c | 7 --- 1 file changed, 4 insertions(+), 3 deletio

[PATCH iproute2-next 0/3] ip: multicast commands JSON

2018-03-08 Thread Stephen Hemminger
From: Stephen Hemminger Some more JSON support and report better error if kernel is configured without multicast. Stephen Hemminger (3): ipmaddr: json and color support ipmroute: convert to output JSON ipmroute: better error message if no kernel mroute ip/ipmaddr.c | 69 +++

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Luis R. Rodriguez
On Thu, Mar 08, 2018 at 03:07:01PM -0800, Alexei Starovoitov wrote: > On 3/7/18 5:23 PM, Luis R. Rodriguez wrote: > > > > request_module() has its own world though too. How often in your proof of > > concept is request_module() called? How many times do you envision it being > > called? > > once.

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Kees Cook
On Thu, Mar 8, 2018 at 5:35 PM, Linus Torvalds wrote: > I don't want to weaken the type enforcement, and I _thought_ you had > done that __builtin_types_compatible_p() to keep it in place. I thought so too (that originally came from Josh), but on removal, I was surprised that the checking was ret

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Kees Cook
On Thu, Mar 8, 2018 at 5:38 PM, Linus Torvalds wrote: > On Thu, Mar 8, 2018 at 4:59 PM, Andy Lutomirski wrote: >> >> Also, I don't see how this is any more exploitable than any other >> init_module(). > > Absolutely. If Kees doesn't trust the files to be loaded, an > executable - even if it's run

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Linus Torvalds
On Thu, Mar 8, 2018 at 4:59 PM, Andy Lutomirski wrote: > > Also, I don't see how this is any more exploitable than any other > init_module(). Absolutely. If Kees doesn't trust the files to be loaded, an executable - even if it's running with root privileges and in the initns - is still fundamenta

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Linus Torvalds
On Thu, Mar 8, 2018 at 4:45 PM, Kees Cook wrote: > > Rasmus mentioned this too. What I said there was that I was shy to > make that change, since we already can't mix that kind of thing with > the existing min()/max() implementation. The existing min()/max() is > already extremely strict, so there

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Alexei Starovoitov
On Fri, Mar 09, 2018 at 01:04:39AM +, Andy Lutomirski wrote: > On Fri, Mar 9, 2018 at 12:57 AM, Alexei Starovoitov wrote: > > On 3/8/18 4:24 PM, Kees Cook wrote: > >> > >> As Andy asked earlier, why not DYN too to catch PIE executables? Seems > >> like forcing the userspace helper to be non-PI

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Kees Cook
On Thu, Mar 8, 2018 at 4:57 PM, Alexei Starovoitov wrote: > The above are three paragraphs of security paranoia without single > concrete example of a security issue. How is running an arbitrary ELF as full init_ns root from a container not a concrete example? I'm not saying this approach can ne

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Alexei Starovoitov
On Fri, Mar 09, 2018 at 12:59:36AM +, Andy Lutomirski wrote: > > Alexei, can you give an example use case? I'm sure it's upthread > somewhere, but I'm having trouble finding it. at the time of iptable's setsockopt() the kernel will do err = request_module("bpfilter"); once. The rough POC cod

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Andy Lutomirski
On Fri, Mar 9, 2018 at 12:57 AM, Alexei Starovoitov wrote: > On 3/8/18 4:24 PM, Kees Cook wrote: >> >> As Andy asked earlier, why not DYN too to catch PIE executables? Seems >> like forcing the userspace helper to be non-PIE would defeat some of >> the userspace defenses in use in most distros. >

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Andy Lutomirski
On Fri, Mar 9, 2018 at 12:24 AM, Kees Cook wrote: > How is this not marked [RFC]? :) > > On Mon, Mar 5, 2018 at 5:34 PM, Alexei Starovoitov wrote: >> As the first step in development of bpfilter project [1] the request_module() >> code is extended to allow user mode helpers to be invoked. Idea is

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Alexei Starovoitov
On 3/8/18 4:24 PM, Kees Cook wrote: How is this not marked [RFC]? :) On Mon, Mar 5, 2018 at 5:34 PM, Alexei Starovoitov wrote: As the first step in development of bpfilter project [1] the request_module() code is extended to allow user mode helpers to be invoked. Idea is that user mode helpers

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Kees Cook
On Thu, Mar 8, 2018 at 3:48 PM, Linus Torvalds wrote: > On Thu, Mar 8, 2018 at 1:40 PM, Kees Cook wrote: >> +#define __min(t1, t2, x, y)\ >> + __builtin_choose_expr(__builtin_constant_p(x) &&\ >> + __bui

[PATCH net] macvlan: filter out unsupported feature flags

2018-03-08 Thread Shannon Nelson
Adding a macvlan device on top of a lowerdev that supports the xfrm offloads fails with a new regression: # ip link add link ens1f0 mv0 type macvlan RTNETLINK answers: Operation not permitted Tracing down the failure shows that the macvlan device inherits the NETIF_F_HW_ESP and NETIF_F_HW_ESP_

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Kees Cook
How is this not marked [RFC]? :) On Mon, Mar 5, 2018 at 5:34 PM, Alexei Starovoitov wrote: > As the first step in development of bpfilter project [1] the request_module() > code is extended to allow user mode helpers to be invoked. Idea is that > user mode helpers are built as part of the kernel

Re: [RFC v3 net-next 00/18] Time based packet transmission

2018-03-08 Thread Jesus Sanchez-Palencia
Hi, On 03/08/2018 02:54 PM, Henrik Austad wrote: > Just looking at the timestamp when the frames were received. They should be > sent at regular intervals if I read udp_tai.c correctly, so the assumption > was that the timestamp from tcpdump should give an inkling to how well it > worked. > >

[PULL resend] virtio: bugfix

2018-03-08 Thread Michael S. Tsirkin
Looks like my pull had corrupted headers. Resending with fixed up ones. The following changes since commit 4a3928c6f8a53fa1aed28ccba227742486e8ddcb: Linux 4.16-rc3 (2018-02-25 18:50:41 -0800) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git

Re: [PATCH bpf-next v8 00/11] Landlock LSM: Toward unprivileged sandboxing

2018-03-08 Thread Andy Lutomirski
On Thu, Mar 8, 2018 at 11:51 PM, Mickaël Salaün wrote: > > On 07/03/2018 02:21, Andy Lutomirski wrote: >> On Tue, Mar 6, 2018 at 11:06 PM, Mickaël Salaün wrote: >>> >>> On 06/03/2018 23:46, Tycho Andersen wrote: On Tue, Mar 06, 2018 at 10:33:17PM +, Andy Lutomirski wrote: >>> Suppose

Re: [PATCH bpf-next v8 00/11] Landlock LSM: Toward unprivileged sandboxing

2018-03-08 Thread Mickaël Salaün
On 07/03/2018 02:21, Andy Lutomirski wrote: > On Tue, Mar 6, 2018 at 11:06 PM, Mickaël Salaün wrote: >> >> On 06/03/2018 23:46, Tycho Andersen wrote: >>> On Tue, Mar 06, 2018 at 10:33:17PM +, Andy Lutomirski wrote: >> Suppose I'm writing a container manager. I want to run "mount" in the

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Linus Torvalds
On Thu, Mar 8, 2018 at 1:40 PM, Kees Cook wrote: > +#define __min(t1, t2, x, y)\ > + __builtin_choose_expr(__builtin_constant_p(x) &&\ > + __builtin_constant_p(y) &&\ > +

[PATCH v2] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Kees Cook
When max() is used in stack array size calculations from literal values (e.g. "char foo[max(sizeof(struct1), sizeof(struct2))]", the compiler thinks this is a dynamic calculation due to the single-eval logic, which is not needed in the literal case. This change removes several accidental stack VLAs

Re: [PATCH net] macvlan: filter out xfrm feature flags

2018-03-08 Thread Shannon Nelson
On 3/8/2018 9:33 AM, David Miller wrote: From: Shannon Nelson Date: Tue, 6 Mar 2018 14:57:08 -0800 This isn't broken for vlans because they use a separate features connection (vlan_features) for inheriting features. This is fine, but I don't think trying to add something like this to every d

Re: [PATCH 0/3] Remove accidental VLA usage

2018-03-08 Thread Kees Cook
On Thu, Mar 8, 2018 at 2:12 PM, Rasmus Villemoes wrote: > On 8 March 2018 at 21:39, Kees Cook wrote: >> However, this works for me: >> >> #define __new_max(t1, t2, max1, max2, x, y)\ >>__builtin_choose_expr(__builtin_constant_p(x) && \ >> _

Re: WARNING: CPU: 3 PID: 0 at net/sched/sch_hfsc.c:1388 hfsc_dequeue+0x319/0x350 [sch_hfsc]

2018-03-08 Thread Cong Wang
On Thu, Mar 8, 2018 at 8:02 AM, Marco Berizzi wrote: >> Marco Berizzi wrote: >> >> >> Hello everyone, >> >> Yesterday I got this error on a slackware linux 4.16-rc4 system >> running as a traffic shaping gateway and netfilter nat. >> The error has been arisen after a partial ISP network outage, >>

Re: [PATCH net-next] modules: allow modprobe load regular elf binaries

2018-03-08 Thread Alexei Starovoitov
On 3/7/18 5:23 PM, Luis R. Rodriguez wrote: request_module() has its own world though too. How often in your proof of concept is request_module() called? How many times do you envision it being called? once. +static int run_umh(struct file *file) +{ + struct subprocess_info *sub_info =

Re: [RFC v3 net-next 00/18] Time based packet transmission

2018-03-08 Thread Henrik Austad
On Thu, Mar 08, 2018 at 10:06:46AM -0800, Jesus Sanchez-Palencia wrote: > Hi, > > > On 03/08/2018 06:09 AM, Henrik Austad wrote: > > (...) > > > > > A lot of new knobs, I see the need, I would've like to have fewer, but > > you've documented them pretty well. Perhaps we should add something t

[RFC] Removing VLA usage in l1oip_core

2018-03-08 Thread Gustavo A. R. Silva
Hi Karsten, I'm trying to figure out the best way to fix the following VLA warning: drivers/isdn/mISDN/l1oip_core.c:282:2: warning: ISO C90 forbids variable length array ‘frame’ [-Wvla] u8 frame[len + 32]; ^~ So while doing some research I've found the following. Based on this code at incl

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Kees Cook
On Thu, Mar 8, 2018 at 2:18 PM, Andrew Morton wrote: > On Thu, 8 Mar 2018 13:40:45 -0800 Kees Cook wrote: > >> When max() is used in stack array size calculations from literal values >> (e.g. "char foo[max(sizeof(struct1), sizeof(struct2))]", the compiler >> thinks this is a dynamic calculation d

[PATCH iproute2-next 1/2] tc: Add missing documentation for codel and fq_codel parameters

2018-03-08 Thread Toke Høiland-Jørgensen
Add missing documentation of the memory_limit fq_codel parameter and the ce_threshold codel and fq_codel parameters. Signed-off-by: Toke Høiland-Jørgensen --- man/man8/tc-codel.8| 10 +- man/man8/tc-fq_codel.8 | 18 +- tc/q_fq_codel.c| 1 + 3 files changed, 2

[PATCH iproute2-next 2/2] tc: Add JSON output of fq_codel stats

2018-03-08 Thread Toke Høiland-Jørgensen
Enable proper JSON output support for fq_codel in `tc -s qdisc` output. Signed-off-by: Toke Høiland-Jørgensen --- tc/q_fq_codel.c | 49 - 1 file changed, 32 insertions(+), 17 deletions(-) diff --git a/tc/q_fq_codel.c b/tc/q_fq_codel.c index 1b2931

[PATCH net v3] net: phy: Tell caller result of phy_change()

2018-03-08 Thread Brad Mouring
In 664fcf123a30e (net: phy: Threaded interrupts allow some simplification) the phy_interrupt system was changed to use a traditional threaded interrupt scheme instead of a workqueue approach. With this change, the phy status check moved into phy_change, which did not report back to the caller whet

Re: [PATCH RFC 4/5] tls: RX path for ktls

2018-03-08 Thread Dave Watson
On 03/08/18 09:48 PM, Boris Pismenny wrote: > Hi Dave, > > On 03/08/18 18:50, Dave Watson wrote: > > Add rx path for tls software implementation. > > > > recvmsg, splice_read, and poll implemented. > > > > An additional sockopt TLS_RX is added, with the same interface as > > TLS_TX. Either TLX_

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Andrew Morton
On Thu, 8 Mar 2018 13:40:45 -0800 Kees Cook wrote: > When max() is used in stack array size calculations from literal values > (e.g. "char foo[max(sizeof(struct1), sizeof(struct2))]", the compiler > thinks this is a dynamic calculation due to the single-eval logic, which > is not needed in the li

Re: [PATCH] kernel.h: Skip single-eval logic on literals in min()/max()

2018-03-08 Thread Ian Campbell
On Thu, 2018-03-08 at 13:40 -0800, Kees Cook wrote: > > +#define __min(t1, t2, x, y) \ > + __builtin_choose_expr(__builtin_constant_p(x) &&\ > + __builtin_constant_p(y) &&\ > +

Re: [PATCH 0/3] Remove accidental VLA usage

2018-03-08 Thread Rasmus Villemoes
On 8 March 2018 at 21:39, Kees Cook wrote: > On Thu, Mar 8, 2018 at 11:57 AM, Rasmus Villemoes > wrote: >> On 2018-03-08 16:02, Josh Poimboeuf wrote: >>> On Wed, Mar 07, 2018 at 07:30:44PM -0800, Kees Cook wrote: >>> +extern long __error_incompatible_types_in_min_macro; >>> +extern long __error_i

[PATCH bpf-next 2/7] tools: bpf: respect output directory during build

2018-03-08 Thread Jiri Benc
Currently, the programs under tools/bpf (with the notable exception of bpftool) do not respect the output directory (make O=dir). Fix that. Signed-off-by: Jiri Benc --- tools/bpf/Makefile | 38 ++ 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a

[PATCH bpf-next 4/7] tools: bpf: make install should build first

2018-03-08 Thread Jiri Benc
Make the 'install' target depend on the 'all' target to build the binaries first. Signed-off-by: Jiri Benc --- tools/bpf/Makefile | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile index c42ca24a072d..e8d9e4125bf3 100644 --- a/tools/

[PATCH bpf-next 0/7] tools: bpf: standardize make

2018-03-08 Thread Jiri Benc
Currently, 'make bpf' in the tools/ directory does not provide the standard quiet output except for bpftool (which is however listed with a wrong directory). Worse, it does not respect the build output directory. The 'make bpf_install' does not work as one would expect, either. It installs uncondi

[PATCH bpf-next 6/7] tools: bpf: respect quiet/verbose build

2018-03-08 Thread Jiri Benc
Default to quiet build, with V=1 enabling verbose build as is usual. Signed-off-by: Jiri Benc --- tools/bpf/Makefile | 38 +++--- 1 file changed, 27 insertions(+), 11 deletions(-) diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile index daca0a4277d1..757ea22c42

[PATCH bpf-next 7/7] tools: bpf: silence make by not deleting intermediate file

2018-03-08 Thread Jiri Benc
Even in quiet mode, make finishes with rm tools/bpf/bpf_exp.lex.c That's because it considers the file to be intermediate. Silence that by mentioning the lex.c file instead of the lex.o file; the dependency still stays. Signed-off-by: Jiri Benc --- tools/bpf/Makefile | 2 +- 1 file changed, 1

[PATCH bpf-next 3/7] tools: bpf: consistent make bpf_install

2018-03-08 Thread Jiri Benc
Currently, make bpf_install in tools/ does not respect DESTDIR. Moreover, it installs to /usr/bin/ unconditionally. Let it respect DESTDIR and allow prefix to be specified. Also, to be more consistent with bpftool and with the usual customs, default the prefix to /usr/local instead of /usr. Signe

[PATCH bpf-next 1/7] tools: bpftool: silence 'missing initializer' warnings

2018-03-08 Thread Jiri Benc
When building bpf tool, gcc emits piles of warnings: prog.c: In function ‘prog_fd_by_tag’: prog.c:101:9: warning: missing initializer for field ‘type’ of ‘struct bpf_prog_info’ [-Wmissing-field-initializers] struct bpf_prog_info info = {}; ^ In file included from /home/storage/jbenc/gi

Re: [1/2] net: macb: Add phy-handle DT support

2018-03-08 Thread Brad Mouring
On Thu, Mar 08, 2018 at 06:32:47PM +0100, Andrew Lunn wrote: > On Wed, Mar 07, 2018 at 04:42:56PM -0600, Brad Mouring wrote: > > This optional binding (as described in the ethernet DT bindings doc) > > directs the netdev to the phydev to use. This is useful for a phy > > chip that has >1 phy in it,

[PATCH bpf-next 5/7] tools: bpf: call descend in Makefile

2018-03-08 Thread Jiri Benc
Use the descend macro to properly propagate $(subdir) to bpftool. Signed-off-by: Jiri Benc --- tools/bpf/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile index e8d9e4125bf3..daca0a4277d1 100644 --- a/tools/bpf/Makefile +++

[PATCH v3 net-next 3/4] net sched actions: calculate add/delete event message size

2018-03-08 Thread Roman Mashak
Introduce routines to calculate size of the shared tc netlink attributes and the full message size including netlink header and tc service header. Update add/delete action logic to have the size for event messages, the size is passed to tcf_add_notify() and tcf_del_notify() where the notification

[PATCH v3 net-next 4/4] net sched actions: implement get_fill_size routine in act_gact

2018-03-08 Thread Roman Mashak
Signed-off-by: Roman Mashak --- net/sched/act_gact.c | 14 ++ 1 file changed, 14 insertions(+) diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c index 74563254e676..88fbb8403565 100644 --- a/net/sched/act_gact.c +++ b/net/sched/act_gact.c @@ -217,6 +217,19 @@ static int tcf_ga

  1   2   3   >