[PATCH] xen/netback: Reset nr_frags before freeing skb

At this point nr_frags has been incremented but the frag does not yet have a page assigned so freeing the skb results in a crash. Reset nr_frags before freeing the skb to prevent this. Signed-off-by: Ross Lagerwall --- drivers/net/xen-netback/netback.c | 2 ++ 1 file changed, 2 insertions

[PATCH] net: Fix usage of pskb_trim_rcsum

In certain cases, pskb_trim_rcsum() may change skb pointers. Reinitialize header pointers afterwards to avoid potential use-after-frees. Add a note in the documentation of pskb_trim_rcsum(). Found by KASAN. Signed-off-by: Ross Lagerwall --- drivers/net/ppp/pppoe.c | 1

[PATCH] openvswitch: Avoid OOB read when parsing flow nlattrs

expected length. Signed-off-by: Ross Lagerwall --- net/openvswitch/flow_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 435a4bdf8f89..691da853bef5 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net

Re: [PATCH] net: Fix xps_needed inc/dec mismatch

On 12/7/18 11:01 AM, Sabrina Dubroca wrote: Hi Ross, 2018-12-07, 10:16:21 +, Ross Lagerwall wrote: xps_needed is incremented only when a new dev map is allocated (in __netif_set_xps_queue). Therefore it should be decremented only when we actually have a dev map to destroy. Without this, it

[PATCH] net: Fix xps_needed inc/dec mismatch

count would get out of sync and eventually the above-mentioned crash would occur. Signed-off-by: Ross Lagerwall --- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index ddc551f24ba2..8aa72e93af9f 100644 --- a/net/core/dev.c +++ b

[PATCH] ixgbe: Fix race when the VF driver does a reset

: 939b701ad633 ("ixgbe: fix driver behaviour after issuing VFLR") Signed-off-by: Ross Lagerwall --- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 11 ++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/i

Re: [PATCH 2/2] xen-netfront: Fix race between device setup and open

On 01/11/2018 04:08 PM, David Miller wrote: From: Ross Lagerwall Date: Thu, 11 Jan 2018 15:49:07 + I've now added CC'd netdev on the other two. That doesn't work. If you don't post the originals explicitly to netdev then it won't get properly queued in patch

Re: [PATCH 1/2] xen/grant-table: Use put_page instead of free_page

+CC netdev On 01/11/2018 09:36 AM, Ross Lagerwall wrote: The page given to gnttab_end_foreign_access() to free could be a compound page so use put_page() instead of free_page() since it can handle both compound and single pages correctly. This bug was discovered when migrating a Xen VM with

Re: [PATCH 2/2] xen-netfront: Fix race between device setup and open

On 01/11/2018 03:26 PM, David Miller wrote: From: Ross Lagerwall Date: Thu, 11 Jan 2018 09:36:38 + When a netfront device is set up it registers a netdev fairly early on, before it has set up the queues and is actually usable. A userspace tool like NetworkManager will immediately try to

Re: [PATCH 0/2] Fix a couple of crashes in netfront

+CC netdev On 01/11/2018 09:36 AM, Ross Lagerwall wrote: Here are a couple of patches to fix two crashes in netfront. Ross Lagerwall (2): xen/grant-table: Use put_page instead of free_page xen-netfront: Fix race between device setup and open drivers/net/xen-netfront.c | 46

[PATCH 2/2] xen-netfront: Fix race between device setup and open

have been destroyed but before they have been recreated. Extend the region covered by the rtnl semaphore to protect against this race. There is a possibility that we fail to recreate the queues so check for this in the open function. Signed-off-by: Ross Lagerwall --- drivers/net/xen-netfront.c

[PATCH RESEND 4.4-only] netlink: Allow direct reclaim for fallback allocation

by adding back the direct reclaim flag to the fallback allocation. Fixes: 6d123f1d396b ("netlink: do not enter direct reclaim from netlink_dump()") Signed-off-by: Ross Lagerwall --- Note that this is only for the 4.4 branch as the regression is only in this branch. Consequently, there

[PATCH 4.4-only] netlink: Allow direct reclaim for fallback allocation

dding back the direct reclaim flag to the fallback allocation. Fixes: 6d123f1d396b ("netlink: do not enter direct reclaim from netlink_dump()") Signed-off-by: Ross Lagerwall --- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netlin

[PATCH v3] xen-netfront: Improve error handling during initialization

the napi context. * If any fatal error occurs, unregister and destroy the netdev to avoid leaving around a half setup network device. Signed-off-by: Ross Lagerwall --- Changed in V3: * If xennet_create_queues returns < 0, it will not have created any queues so there's no need to go

Re: [PATCH v2] xen-netfront: Improve error handling during initialization

On 02/07/2017 11:33 PM, Boris Ostrovsky wrote: On 02/07/2017 09:55 AM, Ross Lagerwall wrote: This fixes a crash when running out of grant refs when creating many queues across many netdevs. * If creating queues fails (i.e. there are no grant refs available), call xenbus_dev_fatal() to ensure

[PATCH v2] xen-netfront: Improve error handling during initialization

the napi context. * If any fatal error occurs, unregister and destroy the netdev to avoid leaving around a half setup network device. Signed-off-by: Ross Lagerwall --- Changed in V2: * Retested on top of v4.10-rc7 + "xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()&q

Re: [PATCH] xen-netfront: Improve error handling during initialization

On 02/01/2017 06:54 PM, Boris Ostrovsky wrote: On 02/01/2017 10:50 AM, Ross Lagerwall wrote: Improve error handling during initialization. This fixes a crash when running out of grant refs when creating many queues across many netdevs. * Delay timer creation so that if initializing a queue

[PATCH] xen-netfront: Improve error handling during initialization

d-off-by: Ross Lagerwall --- drivers/net/xen-netfront.c | 39 ++- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 8315fe7..8ca85af 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers

[PATCH v2] xen/netback: Wake dealloc thread after completing zerocopy work

decrementing inflight_packets. Signed-off-by: Ross Lagerwall --- Changed in V2: Move wakeup into zerocopy_complete function. drivers/net/xen-netback/interface.c | 6 ++ drivers/net/xen-netback/netback.c | 1 - 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/xen

[PATCH] xen/netback: Wake dealloc thread after completing zerocopy work

decrementing inflight_packets. Signed-off-by: Ross Lagerwall --- drivers/net/xen-netback/netback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 7d50711..e95ee20 100644 --- a/drivers/net/xen-netback

[PATCH] xen-netback: Allocate fraglist early to avoid complex rollback

were still executed, writing over the data area of a freed skb. Signed-off-by: Ross Lagerwall --- drivers/net/xen-netback/netback.c | 61 +-- 1 file changed, 33 insertions(+), 28 deletions(-) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen

[PATCH net v2] xen/netback: Properly initialize credit_bytes

one before multiqueue support was added. Signed-off-by: Ross Lagerwall --- Changed in v2: Fixed multiple-assignment. drivers/net/xen-netback/xenbus.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c index 3d8dbf5..fee0241 10