* [PATCH net 0/3] vxlan: stability patches
@ 2013-06-17 19:09 Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 1/3] vxlan: fix race between flush and incoming learning Stephen Hemminger
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Stephen Hemminger @ 2013-06-17 19:09 UTC (permalink / raw)
To: davem; +Cc: netdev, Stephen Hemminger
No change to the content of any of these patches,
the only change is the order of which patches are in which bundle
and the base (these are for -net).
Stephen Hemminger (3):
vxlan: fix race between flush and incoming learning
vxlan: only migrate dynamic FDB entries
vxlan: handle skb_clone failure
drivers/net/vxlan.c | 40 ++++++++++++++++++++++++++--------------
1 file changed, 26 insertions(+), 14 deletions(-)
--
1.7.10.4
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH net 1/3] vxlan: fix race between flush and incoming learning
2013-06-17 19:09 [PATCH net 0/3] vxlan: stability patches Stephen Hemminger
@ 2013-06-17 19:09 ` Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 2/3] vxlan: only migrate dynamic FDB entries Stephen Hemminger
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Stephen Hemminger @ 2013-06-17 19:09 UTC (permalink / raw)
To: davem; +Cc: netdev, Stephen Hemminger
It is possible for a packet to arrive during vxlan_stop(), and
have a dynamic entry created. Close this by checking if device
is up.
CPU1 CPU2
vxlan_stop
vxlan_flush
hash_lock acquired
vxlan_encap_recv
vxlan_snoop
waiting for hash_lock
hash_lock relased
vxlan_flush done
hash_lock acquired
vxlan_fdb_create
This is a day-one bug in vxlan goes back to 3.7.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/net/vxlan.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 3b1d2ee..577a069 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -571,7 +571,6 @@ static void vxlan_snoop(struct net_device *dev,
{
struct vxlan_dev *vxlan = netdev_priv(dev);
struct vxlan_fdb *f;
- int err;
f = vxlan_find_mac(vxlan, src_mac);
if (likely(f)) {
@@ -588,12 +587,15 @@ static void vxlan_snoop(struct net_device *dev,
} else {
/* learned new entry */
spin_lock(&vxlan->hash_lock);
- err = vxlan_fdb_create(vxlan, src_mac, src_ip,
- NUD_REACHABLE,
- NLM_F_EXCL|NLM_F_CREATE,
- vxlan->dst_port,
- vxlan->default_dst.remote_vni,
- 0, NTF_SELF);
+
+ /* close off race between vxlan_flush and incoming packets */
+ if (netif_running(dev))
+ vxlan_fdb_create(vxlan, src_mac, src_ip,
+ NUD_REACHABLE,
+ NLM_F_EXCL|NLM_F_CREATE,
+ vxlan->dst_port,
+ vxlan->default_dst.remote_vni,
+ 0, NTF_SELF);
spin_unlock(&vxlan->hash_lock);
}
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net 2/3] vxlan: only migrate dynamic FDB entries
2013-06-17 19:09 [PATCH net 0/3] vxlan: stability patches Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 1/3] vxlan: fix race between flush and incoming learning Stephen Hemminger
@ 2013-06-17 19:09 ` Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 3/3] vxlan: handle skb_clone failure Stephen Hemminger
2013-06-17 22:56 ` [PATCH net 0/3] vxlan: stability patches David Miller
3 siblings, 0 replies; 5+ messages in thread
From: Stephen Hemminger @ 2013-06-17 19:09 UTC (permalink / raw)
To: davem; +Cc: netdev, Stephen Hemminger
Only migrate dynamic forwarding table entries, don't modify
static entries. If packet received from incorrect source IP address
assume it is an imposter and drop it.
This patch applies only to -net, a different patch would be needed for earlier
kernels since the NTF_SELF flag was introduced with 3.10.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/net/vxlan.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 577a069..15a73ec 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -565,8 +565,9 @@ skip:
/* Watch incoming packets to learn mapping between Ethernet address
* and Tunnel endpoint.
+ * Return true if packet is bogus and should be droppped.
*/
-static void vxlan_snoop(struct net_device *dev,
+static bool vxlan_snoop(struct net_device *dev,
__be32 src_ip, const u8 *src_mac)
{
struct vxlan_dev *vxlan = netdev_priv(dev);
@@ -575,7 +576,11 @@ static void vxlan_snoop(struct net_device *dev,
f = vxlan_find_mac(vxlan, src_mac);
if (likely(f)) {
if (likely(f->remote.remote_ip == src_ip))
- return;
+ return false;
+
+ /* Don't migrate static entries, drop packets */
+ if (!(f->flags & NTF_SELF))
+ return true;
if (net_ratelimit())
netdev_info(dev,
@@ -598,6 +603,8 @@ static void vxlan_snoop(struct net_device *dev,
0, NTF_SELF);
spin_unlock(&vxlan->hash_lock);
}
+
+ return false;
}
@@ -729,8 +736,9 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
vxlan->dev->dev_addr) == 0)
goto drop;
- if (vxlan->flags & VXLAN_F_LEARN)
- vxlan_snoop(skb->dev, oip->saddr, eth_hdr(skb)->h_source);
+ if ((vxlan->flags & VXLAN_F_LEARN) &&
+ vxlan_snoop(skb->dev, oip->saddr, eth_hdr(skb)->h_source))
+ goto drop;
__skb_tunnel_rx(skb, vxlan->dev);
skb_reset_network_header(skb);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net 3/3] vxlan: handle skb_clone failure
2013-06-17 19:09 [PATCH net 0/3] vxlan: stability patches Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 1/3] vxlan: fix race between flush and incoming learning Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 2/3] vxlan: only migrate dynamic FDB entries Stephen Hemminger
@ 2013-06-17 19:09 ` Stephen Hemminger
2013-06-17 22:56 ` [PATCH net 0/3] vxlan: stability patches David Miller
3 siblings, 0 replies; 5+ messages in thread
From: Stephen Hemminger @ 2013-06-17 19:09 UTC (permalink / raw)
To: davem; +Cc: netdev, Stephen Hemminger
If skb_clone fails if out of memory then just skip the fanout.
Problem was introduced in 3.10 with:
commit 6681712d67eef14c4ce793561c3231659153a320
Author: David Stevens <dlstevens@us.ibm.com>
Date: Fri Mar 15 04:35:51 2013 +0000
vxlan: generalize forwarding tables
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/net/vxlan.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 15a73ec..dda997a 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1161,9 +1161,11 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
struct sk_buff *skb1;
skb1 = skb_clone(skb, GFP_ATOMIC);
- rc1 = vxlan_xmit_one(skb1, dev, rdst, did_rsc);
- if (rc == NETDEV_TX_OK)
- rc = rc1;
+ if (skb1) {
+ rc1 = vxlan_xmit_one(skb1, dev, rdst, did_rsc);
+ if (rc == NETDEV_TX_OK)
+ rc = rc1;
+ }
}
rc1 = vxlan_xmit_one(skb, dev, rdst0, did_rsc);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net 0/3] vxlan: stability patches
2013-06-17 19:09 [PATCH net 0/3] vxlan: stability patches Stephen Hemminger
` (2 preceding siblings ...)
2013-06-17 19:09 ` [PATCH net 3/3] vxlan: handle skb_clone failure Stephen Hemminger
@ 2013-06-17 22:56 ` David Miller
3 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2013-06-17 22:56 UTC (permalink / raw)
To: stephen; +Cc: netdev
From: Stephen Hemminger <stephen@networkplumber.org>
Date: Mon, 17 Jun 2013 12:09:56 -0700
> No change to the content of any of these patches,
> the only change is the order of which patches are in which bundle
> and the base (these are for -net).
Series applied, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-06-17 22:56 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-06-17 19:09 [PATCH net 0/3] vxlan: stability patches Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 1/3] vxlan: fix race between flush and incoming learning Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 2/3] vxlan: only migrate dynamic FDB entries Stephen Hemminger
2013-06-17 19:09 ` [PATCH net 3/3] vxlan: handle skb_clone failure Stephen Hemminger
2013-06-17 22:56 ` [PATCH net 0/3] vxlan: stability patches David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.