1b59618ce4
https://source.android.com/docs/security/bulletin/2023-09-01 * tag 'ASB-2023-09-05_4.19-stable' of https://android.googlesource.com/kernel/common: Linux 4.19.294 Revert "ARM: ep93xx: fix missing-prototype warnings" Revert "MIPS: Alchemy: fix dbdma2" Linux 4.19.293 dma-buf/sw_sync: Avoid recursive lock during fence signal clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' scsi: core: raid_class: Remove raid_component_add() scsi: snic: Fix double free in snic_tgt_create() irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable rtnetlink: Reject negative ifindexes in RTM_NEWLINK netfilter: nf_queue: fix socket leak sched/rt: pick_next_rt_entity(): check list_entry mmc: block: Fix in_flight[issue_type] value error x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus media: vcodec: Fix potential array out-of-bounds in encoder queue_setup lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels batman-adv: Fix batadv_v_ogm_aggr_send memory leak batman-adv: Fix TT global entry leak when client roamed back batman-adv: Do not get eth header before batadv_check_management_packet batman-adv: Don't increase MTU when set by user batman-adv: Trigger events for auto adjusted MTU nfsd: Fix race to FREE_STATEID and cl_revoked ibmveth: Use dcbf rather than dcbfl ipvs: fix racy memcpy in proc_do_sync_threshold ipvs: Improve robustness to the ipvs sysctl bonding: fix macvlan over alb bond support net: remove bond_slave_has_mac_rcu() net/sched: fix a qdisc modification with ambiguous command request igb: Avoid starting unnecessary workqueues dccp: annotate data-races in dccp_poll() sock: annotate data-races around prot->memory_pressure tracing: Fix memleak due to race between current_tracer and trace drm/amd/display: check TG is non-null before checking if enabled drm/amd/display: do not wait for mpc idle if tg is disabled regmap: Account for register length in SMBus I/O limits dm integrity: reduce vmalloc space footprint on 32-bit architectures dm integrity: increase RECALC_SECTORS to improve recalculate speed powerpc: Fail build if using recordmcount with binutils v2.37 powerpc: remove leftover code of old GCC version checks powerpc/32: add stack protector support fbdev: fix potential OOB read in fast_imageblit() fbdev: Fix sys_imageblit() for arbitrary image widths fbdev: Improve performance of sys_imageblit() tty: serial: fsl_lpuart: add earlycon for imx8ulp platform Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP" MIPS: cpu-features: Use boot_cpu_type for CPU type based features MIPS: cpu-features: Enable octeon_cache by cpu_type fs: dlm: fix mismatch of plock results from userspace fs: dlm: use dlm_plock_info for do_unlock_close fs: dlm: change plock interrupted message to debug again fs: dlm: add pid to debug log dlm: replace usage of found with dedicated list iterator variable dlm: improve plock logging if interrupted PCI: acpiphp: Reassign resources on bridge if necessary net: phy: broadcom: stub c45 read/write for 54810 net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled virtio-net: set queues after driver_ok af_unix: Fix null-ptr-deref in unix_stream_sendpage(). netfilter: set default timeout to 3 secs for sctp shutdown send and recv state test_firmware: prevent race conditions by a correct implementation of locking mmc: wbsd: fix double mmc_free_host() in wbsd_init() cifs: Release folio lock on fscache read hit. ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. serial: 8250: Fix oops for port->pm on uart_change_pm() ASoC: meson: axg-tdm-formatter: fix channel slot allocation ASoC: rt5665: add missed regulator_bulk_disable net: do not allow gso_size to be set to GSO_BY_FRAGS sock: Fix misuse of sk_under_memory_pressure() i40e: fix misleading debug logs team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves netfilter: nft_dynset: disallow object maps selftests: mirror_gre_changes: Tighten up the TTL test match xfrm: add NULL check in xfrm_update_ae_params ip_vti: fix potential slab-use-after-free in decode_session6 ip6_vti: fix slab-use-after-free in decode_session6 xfrm: fix slab-use-after-free in decode_session6 xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c net: af_key: fix sadb_x_filter validation net: xfrm: Fix xfrm_address_filter OOB read btrfs: fix BUG_ON condition in btrfs_cancel_balance powerpc/rtas_flash: allow user copy to flash block cache objects fbdev: mmp: fix value check in mmphw_probe() virtio-mmio: don't break lifecycle of vm_dev virtio-mmio: Use to_virtio_mmio_device() to simply code virtio-mmio: convert to devm_platform_ioremap_resource nfsd: Remove incorrect check in nfsd4_validate_stateid nfsd4: kill warnings on testing stateids with mismatched clientids block: fix signed int overflow in Amiga partition support mmc: sunxi: fix deferred probing mmc: bcm2835: fix deferred probing mmc: Remove dev_err() usage after platform_get_irq() mmc: tmio: move tmio_mmc_set_clock() to platform hook mmc: tmio: replace tmio_mmc_clk_stop() calls with tmio_mmc_set_clock() mmc: meson-gx: remove redundant mmc_request_done() call from irq context mmc: meson-gx: remove useless lock USB: dwc3: qcom: fix NULL-deref on suspend usb: dwc3: qcom: Add helper functions to enable,disable wake irqs irqchip/mips-gic: Use raw spinlock for gic_lock irqchip/mips-gic: Get rid of the reliance on irq_cpu_online() x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms powerpc/64s/radix: Fix soft dirty tracking powerpc: Move page table dump files in a dedicated subdirectory powerpc/mm: dump block address translation on book3s/32 powerpc/mm: dump segment registers on book3s/32 powerpc/mm: Move pgtable_t into platform headers powerpc/mm: move platform specific mmu-xxx.h in platform directories iio: addac: stx104: Fix race condition when converting analog-to-digital iio: addac: stx104: Fix race condition for stx104_write_raw() iio: adc: stx104: Implement and utilize register structures iio: adc: stx104: Utilize iomap interface iio: add addac subdirectory IMA: allow/fix UML builds drm/amdgpu: Fix potential fence use-after-free v2 Bluetooth: L2CAP: Fix use-after-free pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() gfs2: Fix possible data races in gfs2_show_options() media: platform: mediatek: vpu: fix NULL ptr dereference media: v4l2-mem2mem: add lock to protect parameter num_rdy FS: JFS: Check for read-only mounted filesystem in txBegin FS: JFS: Fix null-ptr-deref Read in txBegin MIPS: dec: prom: Address -Warray-bounds warning fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev udf: Fix uninitialized array access for some pathnames HID: add quirk for 03f0:464a HP Elite Presenter Mouse quota: fix warning in dqgrab() quota: Properly disable quotas when add_dquot_ref() fails ALSA: emu10k1: roll up loops in DSP setup code for Audigy drm/radeon: Fix integer overflow in radeon_cs_parser_init selftests: forwarding: tc_flower: Relax success criterion lib/mpi: Eliminate unused umul_ppmm definitions for MIPS Revert "posix-timers: Ensure timer ID search-loop limit is valid" UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free Linux 4.19.292 sch_netem: fix issues in netem_change() vs get_dist_table() alpha: remove __init annotation from exported page_is_ram() scsi: core: Fix possible memory leak if device_add() fails scsi: snic: Fix possible memory leak if device_add() fails scsi: 53c700: Check that command slot is not NULL scsi: storvsc: Fix handling of virtual Fibre Channel timeouts scsi: core: Fix legacy /proc parsing buffer overflow netfilter: nf_tables: report use refcount overflow netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush btrfs: don't stop integrity writeback too early ibmvnic: Handle DMA unmapping of login buffs in release functions wifi: cfg80211: fix sband iftype data lookup for AP_VLAN IB/hfi1: Fix possible panic during hotplug remove drivers: net: prevent tun_build_skb() to exceed the packet size limit dccp: fix data-race around dp->dccps_mss_cache bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves net/packet: annotate data-races around tp->status mISDN: Update parameter type of dsp_cmx_send() drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes x86: Move gds_ucode_mitigated() declaration to header x86/mm: Fix VDSO and VVAR placement on 5-level paging machines x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 usb: dwc3: Properly handle processing of pending events usb-storage: alauda: Fix uninit-value in alauda_check_media() binder: fix memory leak in binder_init() iio: cros_ec: Fix the allocation size for cros_ec_command nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput radix tree test suite: fix incorrect allocation size for pthreads drm/nouveau/gr: enable memory loads on helper invocation on all channels dmaengine: pl330: Return DMA_PAUSED when transaction is paused ipv6: adjust ndisc_is_useropt() to also return true for PIO mmc: moxart: read scr register without changing byte order sparc: fix up arch_cpu_finalize_init() build breakage. UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free Linux 4.19.291 drm/edid: fix objtool warning in drm_cvt_modes() arm64: dts: stratix10: fix incorrect I2C property for SCL signal drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node ARM: dts: imx6sll: fixup of operating points ARM: dts: imx: add usb alias ARM: dts: imx6sll: Make ssi node name same as other platforms PM: sleep: wakeirq: fix wake irq arming PM / wakeirq: support enabling wake-up irq after runtime_suspend called powerpc/mm/altmap: Fix altmap boundary check mtd: rawnand: omap_elm: Fix incorrect type in assignment test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation test_firmware: fix a memory leak with reqs buffer ext2: Drop fragment support net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb fs/sysv: Null check to prevent null-ptr-deref bug USB: zaurus: Add ID for A-300/B-500/C-700 libceph: fix potential hang in ceph_osdc_notify() scsi: zfcp: Defer fc_rport blocking until after ADISC response tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen tcp_metrics: annotate data-races around tm->tcpm_net tcp_metrics: annotate data-races around tm->tcpm_vals[] tcp_metrics: annotate data-races around tm->tcpm_lock tcp_metrics: annotate data-races around tm->tcpm_stamp tcp_metrics: fix addr_same() helper ip6mr: Fix skb_under_panic in ip6mr_cache_report() net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free net: add missing data-race annotation for sk_ll_usec net: add missing data-race annotations around sk->sk_peek_off net: sched: cls_u32: Fix match key mis-addressing perf test uprobe_from_different_cu: Skip if there is no gcc net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() KVM: s390: fix sthyi error handling word-at-a-time: use the same return type for has_zero regardless of endianness loop: Select I/O scheduler 'none' from inside add_disk() perf: Fix function pointer case net/sched: cls_u32: Fix reference counter leak leading to overflow ASoC: cs42l51: fix driver to properly autoload with automatic module loading net/sched: sch_qfq: account for stab overhead in qfq_enqueue net/sched: cls_fw: Fix improper refcount update leads to use-after-free drm/client: Fix memory leak in drm_client_target_cloned dm cache policy smq: ensure IO doesn't prevent cleaner policy progress ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register s390/dasd: fix hanging device after quiesce/resume virtio-net: fix race between set queues and probe serial: 8250_dw: Preserve original value of DLF register serial: 8250_dw: split Synopsys DesignWare 8250 common functions irq-bcm6345-l1: Do not assume a fixed block to cpu mapping tpm_tis: Explicitly check for error code btrfs: check for commit error at btrfs_attach_transaction_barrier() hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() Documentation: security-bugs.rst: clarify CVE handling Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group usb: xhci-mtk: set the dma max_seg_size USB: quirks: add quirk for Focusrite Scarlett usb: ohci-at91: Fix the unhandle interrupt when resume usb: dwc3: don't reset device side if dwc3 was configured as host-only usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED USB: serial: simple: sort driver entries USB: serial: simple: add Kaufmann RKS+CAN VCP USB: serial: option: add Quectel EC200A module support USB: serial: option: support Quectel EM060K_128 tracing: Fix warning in trace_buffered_event_disable() ring-buffer: Fix wrong stat of cpu_buffer->read ata: pata_ns87415: mark ns87560_tf_read static dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths block: Fix a source code comment in include/uapi/linux/blkzoned.h ASoC: fsl_spdif: Silence output on stop drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() RDMA/mlx4: Make check for invalid flags stricter benet: fix return value check in be_lancer_xmit_workarounds() net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 net/sched: mqprio: add extack to mqprio_parse_nlattr() net/sched: mqprio: refactor nlattr parsing to a separate function platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 team: reset team's flags when down link is P2P device bonding: reset bond's flags when down link is P2P device tcp: Reduce chance of collisions in inet6_hashfn(). ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address ethernet: atheros: fix return value check in atl1e_tso_csum() phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() ext4: fix to check return value of freeze_bdev() in ext4_shutdown() scsi: qla2xxx: Array index may go out of bound scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() ftrace: Store the order of pages allocated in ftrace_page ftrace: Check if pages were allocated before calling free_pages() ftrace: Add information on number of page groups allocated fs: dlm: interrupt posix locks only when process is killed dlm: rearrange async condition return dlm: cleanup plock_op vs plock_xop PCI/ASPM: Avoid link retraining race PCI/ASPM: Factor out pcie_wait_for_retrain() PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() PCI: Rework pcie_retrain_link() wait loop ext4: Fix reusing stale buffer heads from last failed mounting ext4: rename journal_dev to s_journal_dev inside ext4_sb_info btrfs: fix extent buffer leak after tree mod log failure at split_node() bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent bcache: remove 'int n' from parameter list of bch_bucket_alloc_set() bcache: use MAX_CACHES_PER_SET instead of magic number 8 in __bch_bucket_alloc_set gpio: tps68470: Make tps68470_gpio_output() always set the initial value tracing/histograms: Return an error if we fail to add histogram to hist_vars list tcp: annotate data-races around fastopenq.max_qlen tcp: annotate data-races around tp->notsent_lowat tcp: annotate data-races around rskq_defer_accept tcp: annotate data-races around tp->linger2 net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX netfilter: nf_tables: can't schedule in nft_chain_validate netfilter: nf_tables: fix spurious set element insertion failure llc: Don't drop packet from non-root netns. fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe Revert "tcp: avoid the lookup process failing to get sk in ehash table" net:ipv6: check return value of pskb_trim() net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() pinctrl: amd: Use amd_pinconf_set() for all config options fbdev: imxfb: warn about invalid left/right margin spi: bcm63xx: fix max prepend length igb: Fix igb_down hung on surprise removal wifi: iwlwifi: mvm: avoid baid size integer overflow wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() bpf: Address KCSAN report on bpf_lru_list sched/fair: Don't balance task to its current running CPU posix-timers: Ensure timer ID search-loop limit is valid md/raid10: prevent soft lockup while flush writes md: fix data corruption for raid456 when reshape restart while grow up nbd: Add the maximum limit of allocated index in nbd_dev_add debugobjects: Recheck debug_objects_enabled before reporting ext4: correct inline offset when handling xattrs in inode body can: bcm: Fix UAF in bcm_proc_show() fuse: revalidate: don't invalidate if interrupted perf probe: Add test for regression introduced by switch to die_get_decl_file() tracing/histograms: Add histograms to hist_vars if they have referenced variables drm/atomic: Fix potential use-after-free in nonblocking commits scsi: qla2xxx: Pointer may be dereferenced scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() scsi: qla2xxx: Fix potential NULL pointer dereference scsi: qla2xxx: Wait for io return on terminate rport xtensa: ISS: fix call to split_if_spec ring-buffer: Fix deadloop issue on reading trace_pipe tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error Revert "8250: add support for ASIX devices with a FIFO bug" meson saradc: fix clock divider mask length ceph: don't let check_caps skip sending responses for revoke msgs hwrng: imx-rngc - fix the timeout for init and self check serial: atmel: don't enable IRQs prematurely fs: dlm: return positive pid value for F_GETLK md/raid0: add discard support for the 'original' layout misc: pci_endpoint_test: Re-init completion for every test misc: pci_endpoint_test: Free IRQs before removing the device PCI: rockchip: Use u32 variable to access 32-bit registers PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked PCI: rockchip: Write PCI Device ID to correct register PCI: rockchip: Assert PCI Configuration Enable bit after probe PCI: qcom: Disable write access to read only registers for IP v2.3.3 PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold jfs: jfs_dmap: Validate db_l2nbperpage while mounting ext4: only update i_reserved_data_blocks on successful block allocation ext4: fix wrong unit use in ext4_mb_clear_bb perf intel-pt: Fix CYC timestamps after standalone CBR SUNRPC: Fix UAF in svc_tcp_listen_data_ready() net: bcmgenet: Ensure MDIO unregistration has clocks enabled tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation pinctrl: amd: Only use special debounce behavior for GPIO 0 pinctrl: amd: Detect internal GPIO0 debounce handling pinctrl: amd: Fix mistake in handling clearing pins at startup net/sched: make psched_mtu() RTNL-less safe wifi: airo: avoid uninitialized warning in airo_get_rate() ipv6/addrconf: fix a potential refcount underflow for idev NTB: ntb_tool: Add check for devm_kcalloc NTB: ntb_transport: fix possible memory leak while device_register() fails ntb: intel: Fix error handling in intel_ntb_pci_driver_init() NTB: amd: Fix error handling in amd_ntb_pci_driver_init() ntb: idt: Fix error handling in idt_pci_driver_init() udp6: fix udp6_ehashfn() typo icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). vrf: Increment Icmp6InMsgs on the original netdev net: mvneta: fix txq_map in case of txq_number==1 workqueue: clean up WORK_* constant types, clarify masking net: lan743x: Don't sleep in atomic context netfilter: nf_tables: prevent OOB access in nft_byteorder_eval netfilter: conntrack: Avoid nf_ct_helper_hash uses after free netfilter: nf_tables: fix scheduling-while-atomic splat netfilter: nf_tables: unbind non-anonymous set if rule construction fails netfilter: nf_tables: reject unbound anonymous set before commit phase netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE netfilter: nf_tables: use net_generic infra for transaction data netfilter: add helper function to set up the nfnetlink header and use it netfilter: nftables: add helper function to set the base sequence number netfilter: nf_tables: add rescheduling points during loop detection walks netfilter: nf_tables: fix nat hook table deletion spi: spi-fsl-spi: allow changing bits_per_word while CS is still active spi: spi-fsl-spi: relax message sanity checking a little spi: spi-fsl-spi: remove always-true conditional in fsl_spi_do_one_msg ARM: orion5x: fix d2net gpio initialization btrfs: fix race when deleting quota root from the dirty cow roots list jffs2: reduce stack usage in jffs2_build_xattr_subsystem() integrity: Fix possible multiple allocation in integrity_inode_get() bcache: Remove unnecessary NULL point check in node allocations mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M mmc: core: disable TRIM on Kingston EMMC04G-M627 NFSD: add encoding of op_recall flag for write delegation ALSA: jack: Fix mutex call in snd_jack_report() i2c: xiic: Don't try to handle more interrupt events after error i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() sh: dma: Fix DMA channel offset calculation net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX tcp: annotate data races in __tcp_oow_rate_limited() net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y f2fs: fix error path handling in truncate_dnode() mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 spi: bcm-qspi: return error if neither hif_mspi nor mspi is available Add MODULE_FIRMWARE() for FIRMWARE_TG357766. sctp: fix potential deadlock on &net->sctp.addr_wq_lock rtc: st-lpc: Release some resources in st_rtc_probe() in case of error mfd: stmpe: Only disable the regulators if they are enabled mfd: intel-lpss: Add missing check for platform_get_resource KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes mfd: rt5033: Drop rt5033-battery sub-device usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() extcon: Fix kernel doc of property capability fields to avoid warnings extcon: Fix kernel doc of property fields to avoid warnings media: usb: siano: Fix warning due to null work_func_t function pointer media: videodev2.h: Fix struct v4l2_input tuner index comment media: usb: Check az6007_read() return value sh: j2: Use ioremap() to translate device tree address into kernel memory w1: fix loop in w1_fini() block: change all __u32 annotations to __be32 in affs_hardblocks.h USB: serial: option: add LARA-R6 01B PIDs ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard ARCv2: entry: rewrite to enable use of double load/stores LDD/STD ARCv2: entry: avoid a branch ARCv2: entry: push out the Z flag unclobber from common EXCEPTION_PROLOGUE ARCv2: entry: comments about hardware auto-save on taken interrupts modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} modpost: fix section mismatch message for R_ARM_ABS32 crypto: nx - fix build warnings when DEBUG_FS is not enabled hwrng: virtio - Fix race on data_avail and actual data hwrng: virtio - always add a pending request hwrng: virtio - don't waste entropy hwrng: virtio - don't wait on cleanup hwrng: virtio - add an internal buffer pinctrl: at91-pio4: check return value of devm_kasprintf() perf dwarf-aux: Fix off-by-one in die_get_varname() pinctrl: cherryview: Return correct value if pin in push-pull mode PCI: Add pci_clear_master() stub for non-CONFIG_PCI scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer drm/radeon: fix possible division-by-zero errors fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors soc/fsl/qe: fix usb.c build errors ASoC: es8316: Increment max value for ALC Capture Target Volume control ARM: ep93xx: fix missing-prototype warnings drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H Input: adxl34x - do not hardcode interrupt trigger type ARM: dts: BCM5301X: Drop "clock-names" from the SPI node Input: drv260x - sleep between polling GO bit radeon: avoid double free in ci_dpm_init() netlink: Add __sock_i_ino() for __netlink_diag_dump(). ipvlan: Fix return value of ipvlan_queue_xmit() netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. lib/ts_bm: reset initial match offset for every block of text gtp: Fix use-after-free in __gtp_encap_destroy(). netlink: do not hard code device address lenth in fdb dumps netlink: fix potential deadlock in netlink_set_err() wifi: ath9k: convert msecs to jiffies where needed wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() memstick r592: make memstick_debug_get_tpc_name() static kexec: fix a memory leak in crash_shrink_memory() watchdog/perf: more properly prevent false positives with turbo modes watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes wifi: ray_cs: Fix an error handling path in ray_probe() wifi: ray_cs: Drop useless status variable in parse_addr() wifi: ray_cs: Utilize strnlen() in parse_addr() wifi: wl3501_cs: Fix an error handling path in wl3501_probe() wl3501_cs: use eth_hw_addr_set() net: create netdev->dev_addr assignment helpers wl3501_cs: Fix misspelling and provide missing documentation wl3501_cs: Remove unnecessary NULL check wl3501_cs: Fix a bunch of formatting issues related to function docs wifi: atmel: Fix an error handling path in atmel_probe() wifi: orinoco: Fix an error handling path in orinoco_cs_probe() wifi: orinoco: Fix an error handling path in spectrum_cs_probe() nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() nfc: constify several pointers to u8, char and sk_buff wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() samples/bpf: Fix buffer overflow in tcp_basertt wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation evm: Complete description of evm_inode_setattr() ARM: 9303/1: kprobes: avoid missing-declaration warnings PM: domains: fix integer overflow issues in genpd_parse_state() clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe clocksource/drivers/cadence-ttc: Use ttc driver as platform driver clocksource/drivers: Unify the names to timer-* format irqchip/jcore-aic: Fix missing allocation of IRQ descriptors irqchip/jcore-aic: Kill use of irq_create_strict_mappings() md/raid10: fix io loss while replacement replace rdev md/raid10: fix wrong setting of max_corr_read_errors md/raid10: fix overflow of md/safe_mode_delay md/raid10: check slab-out-of-bounds in md_bitmap_get_counter treewide: Remove uninitialized_var() usage drm/amdgpu: Validate VM ioctl flags. scripts/tags.sh: Resolve gtags empty index generation drm/edid: Fix uninitialized variable in drm_cvt_modes() fbdev: imsttfb: Fix use after free bug in imsttfb_probe video: imsttfb: check for ioremap() failures x86/smp: Use dedicated cache-line for mwait_play_dead() gfs2: Don't deref jdesc in evict Linux 4.19.290 x86: fix backwards merge of GDS/SRSO bit xen/netback: Fix buffer overrun triggered by unusual packet Documentation/x86: Fix backwards on/off logic about YMM support x86/xen: Fix secondary processors' FPU initialization KVM: Add GDS_NO support to KVM x86/speculation: Add Kconfig option for GDS x86/speculation: Add force option to GDS mitigation x86/speculation: Add Gather Data Sampling mitigation x86/fpu: Move FPU initialization into arch_cpu_finalize_init() x86/fpu: Mark init functions __init x86/fpu: Remove cpuinfo argument from init functions init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() init: Invoke arch_cpu_finalize_init() earlier init: Remove check_bugs() leftovers um/cpu: Switch to arch_cpu_finalize_init() sparc/cpu: Switch to arch_cpu_finalize_init() sh/cpu: Switch to arch_cpu_finalize_init() mips/cpu: Switch to arch_cpu_finalize_init() m68k/cpu: Switch to arch_cpu_finalize_init() ia64/cpu: Switch to arch_cpu_finalize_init() ARM: cpu: Switch to arch_cpu_finalize_init() x86/cpu: Switch to arch_cpu_finalize_init() init: Provide arch_cpu_finalize_init() Conflicts: drivers/mmc/core/block.c drivers/mmc/host/sdhci-msm.c drivers/usb/dwc3/core.c drivers/usb/dwc3/gadget.c Change-Id: Id2f4d5c8067f8e5eda39c0eaa5e59d54a394b4c7
795 lines
23 KiB
C
795 lines
23 KiB
C
/*
|
|
* INET An implementation of the TCP/IP protocol suite for the LINUX
|
|
* operating system. INET is implemented using the BSD Socket
|
|
* interface as the means of communication with the user level.
|
|
*
|
|
* Implementation of the Transmission Control Protocol(TCP).
|
|
*
|
|
* Authors: Ross Biro
|
|
* Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
|
|
* Mark Evans, <evansmp@uhura.aston.ac.uk>
|
|
* Corey Minyard <wf-rch!minyard@relay.EU.net>
|
|
* Florian La Roche, <flla@stud.uni-sb.de>
|
|
* Charles Hedrick, <hedrick@klinzhai.rutgers.edu>
|
|
* Linus Torvalds, <torvalds@cs.helsinki.fi>
|
|
* Alan Cox, <gw4pts@gw4pts.ampr.org>
|
|
* Matthew Dillon, <dillon@apollo.west.oic.com>
|
|
* Arnt Gulbrandsen, <agulbra@nvg.unit.no>
|
|
* Jorge Cwik, <jorge@laser.satlink.net>
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/gfp.h>
|
|
#include <net/tcp.h>
|
|
|
|
static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
u32 elapsed, start_ts;
|
|
s32 remaining;
|
|
|
|
start_ts = tcp_sk(sk)->retrans_stamp;
|
|
if (!icsk->icsk_user_timeout)
|
|
return icsk->icsk_rto;
|
|
elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts;
|
|
remaining = icsk->icsk_user_timeout - elapsed;
|
|
if (remaining <= 0)
|
|
return 1; /* user timeout has passed; fire ASAP */
|
|
|
|
return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining));
|
|
}
|
|
|
|
static void set_tcp_default(void)
|
|
{
|
|
sysctl_tcp_delack_seg = TCP_DELACK_SEG;
|
|
}
|
|
|
|
/*sysctl handler for tcp_ack realted master control */
|
|
int tcp_proc_delayed_ack_control(struct ctl_table *table, int write,
|
|
void __user *buffer, size_t *length,
|
|
loff_t *ppos)
|
|
{
|
|
int ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
|
|
|
|
/* The ret value will be 0 if the input validation is successful
|
|
* and the values are written to sysctl table. If not, the stack
|
|
* will continue to work with currently configured values
|
|
*/
|
|
return ret;
|
|
}
|
|
|
|
/*sysctl handler for tcp_ack realted master control */
|
|
int tcp_use_userconfig_sysctl_handler(struct ctl_table *table, int write,
|
|
void __user *buffer, size_t *length,
|
|
loff_t *ppos)
|
|
{
|
|
int ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
|
|
|
|
if (write && ret == 0) {
|
|
if (!sysctl_tcp_use_userconfig)
|
|
set_tcp_default();
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
/**
|
|
* tcp_write_err() - close socket and save error info
|
|
* @sk: The socket the error has appeared on.
|
|
*
|
|
* Returns: Nothing (void)
|
|
*/
|
|
static void tcp_write_err(struct sock *sk)
|
|
{
|
|
sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT;
|
|
sk->sk_error_report(sk);
|
|
|
|
tcp_write_queue_purge(sk);
|
|
tcp_done(sk);
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
|
|
}
|
|
|
|
/**
|
|
* tcp_out_of_resources() - Close socket if out of resources
|
|
* @sk: pointer to current socket
|
|
* @do_reset: send a last packet with reset flag
|
|
*
|
|
* Do not allow orphaned sockets to eat all our resources.
|
|
* This is direct violation of TCP specs, but it is required
|
|
* to prevent DoS attacks. It is called when a retransmission timeout
|
|
* or zero probe timeout occurs on orphaned socket.
|
|
*
|
|
* Also close if our net namespace is exiting; in that case there is no
|
|
* hope of ever communicating again since all netns interfaces are already
|
|
* down (or about to be down), and we need to release our dst references,
|
|
* which have been moved to the netns loopback interface, so the namespace
|
|
* can finish exiting. This condition is only possible if we are a kernel
|
|
* socket, as those do not hold references to the namespace.
|
|
*
|
|
* Criteria is still not confirmed experimentally and may change.
|
|
* We kill the socket, if:
|
|
* 1. If number of orphaned sockets exceeds an administratively configured
|
|
* limit.
|
|
* 2. If we have strong memory pressure.
|
|
* 3. If our net namespace is exiting.
|
|
*/
|
|
static int tcp_out_of_resources(struct sock *sk, bool do_reset)
|
|
{
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
int shift = 0;
|
|
|
|
/* If peer does not open window for long time, or did not transmit
|
|
* anything for long time, penalize it. */
|
|
if ((s32)(tcp_jiffies32 - tp->lsndtime) > 2*TCP_RTO_MAX || !do_reset)
|
|
shift++;
|
|
|
|
/* If some dubious ICMP arrived, penalize even more. */
|
|
if (sk->sk_err_soft)
|
|
shift++;
|
|
|
|
if (tcp_check_oom(sk, shift)) {
|
|
/* Catch exceptional cases, when connection requires reset.
|
|
* 1. Last segment was sent recently. */
|
|
if ((s32)(tcp_jiffies32 - tp->lsndtime) <= TCP_TIMEWAIT_LEN ||
|
|
/* 2. Window is closed. */
|
|
(!tp->snd_wnd && !tp->packets_out))
|
|
do_reset = true;
|
|
if (do_reset)
|
|
tcp_send_active_reset(sk, GFP_ATOMIC);
|
|
tcp_done(sk);
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY);
|
|
return 1;
|
|
}
|
|
|
|
if (!check_net(sock_net(sk))) {
|
|
/* Not possible to send reset; just close */
|
|
tcp_done(sk);
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* tcp_orphan_retries() - Returns maximal number of retries on an orphaned socket
|
|
* @sk: Pointer to the current socket.
|
|
* @alive: bool, socket alive state
|
|
*/
|
|
static int tcp_orphan_retries(struct sock *sk, bool alive)
|
|
{
|
|
int retries = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_orphan_retries); /* May be zero. */
|
|
|
|
/* We know from an ICMP that something is wrong. */
|
|
if (sk->sk_err_soft && !alive)
|
|
retries = 0;
|
|
|
|
/* However, if socket sent something recently, select some safe
|
|
* number of retries. 8 corresponds to >100 seconds with minimal
|
|
* RTO of 200msec. */
|
|
if (retries == 0 && alive)
|
|
retries = 8;
|
|
return retries;
|
|
}
|
|
|
|
static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
|
|
{
|
|
const struct net *net = sock_net(sk);
|
|
int mss;
|
|
|
|
/* Black hole detection */
|
|
if (!READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing))
|
|
return;
|
|
|
|
if (!icsk->icsk_mtup.enabled) {
|
|
icsk->icsk_mtup.enabled = 1;
|
|
icsk->icsk_mtup.probe_timestamp = tcp_jiffies32;
|
|
} else {
|
|
mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
|
|
mss = min(net->ipv4.sysctl_tcp_base_mss, mss);
|
|
mss = max(mss, 68 - tcp_sk(sk)->tcp_header_len);
|
|
mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss);
|
|
icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
|
|
}
|
|
tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
|
|
}
|
|
|
|
static unsigned int tcp_model_timeout(struct sock *sk,
|
|
unsigned int boundary,
|
|
unsigned int rto_base)
|
|
{
|
|
unsigned int linear_backoff_thresh, timeout;
|
|
|
|
linear_backoff_thresh = ilog2(TCP_RTO_MAX / rto_base);
|
|
if (boundary <= linear_backoff_thresh)
|
|
timeout = ((2 << boundary) - 1) * rto_base;
|
|
else
|
|
timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
|
|
(boundary - linear_backoff_thresh) * TCP_RTO_MAX;
|
|
return jiffies_to_msecs(timeout);
|
|
}
|
|
/**
|
|
* retransmits_timed_out() - returns true if this connection has timed out
|
|
* @sk: The current socket
|
|
* @boundary: max number of retransmissions
|
|
* @timeout: A custom timeout value.
|
|
* If set to 0 the default timeout is calculated and used.
|
|
* Using TCP_RTO_MIN and the number of unsuccessful retransmits.
|
|
*
|
|
* The default "timeout" value this function can calculate and use
|
|
* is equivalent to the timeout of a TCP Connection
|
|
* after "boundary" unsuccessful, exponentially backed-off
|
|
* retransmissions with an initial RTO of TCP_RTO_MIN.
|
|
*/
|
|
static bool retransmits_timed_out(struct sock *sk,
|
|
unsigned int boundary,
|
|
unsigned int timeout)
|
|
{
|
|
unsigned int start_ts;
|
|
|
|
if (!inet_csk(sk)->icsk_retransmits)
|
|
return false;
|
|
|
|
start_ts = tcp_sk(sk)->retrans_stamp;
|
|
if (likely(timeout == 0)) {
|
|
unsigned int rto_base = TCP_RTO_MIN;
|
|
|
|
if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))
|
|
rto_base = tcp_timeout_init(sk);
|
|
timeout = tcp_model_timeout(sk, boundary, rto_base);
|
|
}
|
|
|
|
return (s32)(tcp_time_stamp(tcp_sk(sk)) - start_ts - timeout) >= 0;
|
|
}
|
|
|
|
/* A write timeout has occurred. Process the after effects. */
|
|
static int tcp_write_timeout(struct sock *sk)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
struct net *net = sock_net(sk);
|
|
bool expired = false, do_reset;
|
|
int retry_until;
|
|
|
|
if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
|
|
if (icsk->icsk_retransmits) {
|
|
dst_negative_advice(sk);
|
|
} else {
|
|
sk_rethink_txhash(sk);
|
|
}
|
|
retry_until = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries;
|
|
expired = icsk->icsk_retransmits >= retry_until;
|
|
} else {
|
|
if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1), 0)) {
|
|
/* Black hole detection */
|
|
tcp_mtu_probing(icsk, sk);
|
|
|
|
dst_negative_advice(sk);
|
|
} else {
|
|
sk_rethink_txhash(sk);
|
|
}
|
|
|
|
retry_until = READ_ONCE(net->ipv4.sysctl_tcp_retries2);
|
|
if (sock_flag(sk, SOCK_DEAD)) {
|
|
const bool alive = icsk->icsk_rto < TCP_RTO_MAX;
|
|
|
|
retry_until = tcp_orphan_retries(sk, alive);
|
|
do_reset = alive ||
|
|
!retransmits_timed_out(sk, retry_until, 0);
|
|
|
|
if (tcp_out_of_resources(sk, do_reset))
|
|
return 1;
|
|
}
|
|
}
|
|
if (!expired)
|
|
expired = retransmits_timed_out(sk, retry_until,
|
|
icsk->icsk_user_timeout);
|
|
tcp_fastopen_active_detect_blackhole(sk, expired);
|
|
|
|
if (BPF_SOCK_OPS_TEST_FLAG(tp, BPF_SOCK_OPS_RTO_CB_FLAG))
|
|
tcp_call_bpf_3arg(sk, BPF_SOCK_OPS_RTO_CB,
|
|
icsk->icsk_retransmits,
|
|
icsk->icsk_rto, (int)expired);
|
|
|
|
if (expired) {
|
|
/* Has it gone just too far? */
|
|
tcp_write_err(sk);
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Called with BH disabled */
|
|
void tcp_delack_timer_handler(struct sock *sk)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
|
|
sk_mem_reclaim_partial(sk);
|
|
|
|
if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
|
|
!(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
|
|
goto out;
|
|
|
|
if (time_after(icsk->icsk_ack.timeout, jiffies)) {
|
|
sk_reset_timer(sk, &icsk->icsk_delack_timer, icsk->icsk_ack.timeout);
|
|
goto out;
|
|
}
|
|
icsk->icsk_ack.pending &= ~ICSK_ACK_TIMER;
|
|
|
|
if (inet_csk_ack_scheduled(sk)) {
|
|
if (!icsk->icsk_ack.pingpong) {
|
|
/* Delayed ACK missed: inflate ATO. */
|
|
icsk->icsk_ack.ato = min(icsk->icsk_ack.ato << 1, icsk->icsk_rto);
|
|
} else {
|
|
/* Delayed ACK missed: leave pingpong mode and
|
|
* deflate ATO.
|
|
*/
|
|
icsk->icsk_ack.pingpong = 0;
|
|
icsk->icsk_ack.ato = TCP_ATO_MIN;
|
|
}
|
|
tcp_mstamp_refresh(tcp_sk(sk));
|
|
tcp_send_ack(sk);
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKS);
|
|
}
|
|
|
|
out:
|
|
if (tcp_under_memory_pressure(sk))
|
|
sk_mem_reclaim(sk);
|
|
}
|
|
|
|
|
|
/**
|
|
* tcp_delack_timer() - The TCP delayed ACK timeout handler
|
|
* @data: Pointer to the current socket. (gets casted to struct sock *)
|
|
*
|
|
* This function gets (indirectly) called when the kernel timer for a TCP packet
|
|
* of this socket expires. Calls tcp_delack_timer_handler() to do the actual work.
|
|
*
|
|
* Returns: Nothing (void)
|
|
*/
|
|
static void tcp_delack_timer(struct timer_list *t)
|
|
{
|
|
struct inet_connection_sock *icsk =
|
|
from_timer(icsk, t, icsk_delack_timer);
|
|
struct sock *sk = &icsk->icsk_inet.sk;
|
|
|
|
bh_lock_sock(sk);
|
|
if (!sock_owned_by_user(sk)) {
|
|
tcp_delack_timer_handler(sk);
|
|
} else {
|
|
icsk->icsk_ack.blocked = 1;
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOCKED);
|
|
/* deleguate our work to tcp_release_cb() */
|
|
if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED, &sk->sk_tsq_flags))
|
|
sock_hold(sk);
|
|
}
|
|
bh_unlock_sock(sk);
|
|
sock_put(sk);
|
|
}
|
|
|
|
static void tcp_probe_timer(struct sock *sk)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
struct sk_buff *skb = tcp_send_head(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
int max_probes;
|
|
u32 start_ts;
|
|
|
|
if (tp->packets_out || !skb) {
|
|
icsk->icsk_probes_out = 0;
|
|
return;
|
|
}
|
|
|
|
/* RFC 1122 4.2.2.17 requires the sender to stay open indefinitely as
|
|
* long as the receiver continues to respond probes. We support this by
|
|
* default and reset icsk_probes_out with incoming ACKs. But if the
|
|
* socket is orphaned or the user specifies TCP_USER_TIMEOUT, we
|
|
* kill the socket when the retry count and the time exceeds the
|
|
* corresponding system limit. We also implement similar policy when
|
|
* we use RTO to probe window in tcp_retransmit_timer().
|
|
*/
|
|
start_ts = tcp_skb_timestamp(skb);
|
|
if (!start_ts)
|
|
skb->skb_mstamp = tp->tcp_mstamp;
|
|
else if (icsk->icsk_user_timeout &&
|
|
(s32)(tcp_time_stamp(tp) - start_ts) > icsk->icsk_user_timeout)
|
|
goto abort;
|
|
|
|
max_probes = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retries2);
|
|
if (sock_flag(sk, SOCK_DEAD)) {
|
|
const bool alive = inet_csk_rto_backoff(icsk, TCP_RTO_MAX) < TCP_RTO_MAX;
|
|
|
|
max_probes = tcp_orphan_retries(sk, alive);
|
|
if (!alive && icsk->icsk_backoff >= max_probes)
|
|
goto abort;
|
|
if (tcp_out_of_resources(sk, true))
|
|
return;
|
|
}
|
|
|
|
if (icsk->icsk_probes_out >= max_probes) {
|
|
abort: tcp_write_err(sk);
|
|
} else {
|
|
/* Only send another probe if we didn't close things up. */
|
|
tcp_send_probe0(sk);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Timer for Fast Open socket to retransmit SYNACK. Note that the
|
|
* sk here is the child socket, not the parent (listener) socket.
|
|
*/
|
|
static void tcp_fastopen_synack_timer(struct sock *sk)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
int max_retries = icsk->icsk_syn_retries ? :
|
|
sock_net(sk)->ipv4.sysctl_tcp_synack_retries + 1; /* add one more retry for fastopen */
|
|
struct request_sock *req;
|
|
|
|
req = tcp_sk(sk)->fastopen_rsk;
|
|
req->rsk_ops->syn_ack_timeout(req);
|
|
|
|
if (req->num_timeout >= max_retries) {
|
|
tcp_write_err(sk);
|
|
return;
|
|
}
|
|
/* XXX (TFO) - Unlike regular SYN-ACK retransmit, we ignore error
|
|
* returned from rtx_syn_ack() to make it more persistent like
|
|
* regular retransmit because if the child socket has been accepted
|
|
* it's not good to give up too easily.
|
|
*/
|
|
inet_rtx_syn_ack(sk, req);
|
|
req->num_timeout++;
|
|
icsk->icsk_retransmits++;
|
|
inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
|
|
TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX);
|
|
}
|
|
|
|
|
|
/**
|
|
* tcp_retransmit_timer() - The TCP retransmit timeout handler
|
|
* @sk: Pointer to the current socket.
|
|
*
|
|
* This function gets called when the kernel timer for a TCP packet
|
|
* of this socket expires.
|
|
*
|
|
* It handles retransmission, timer adjustment and other necesarry measures.
|
|
*
|
|
* Returns: Nothing (void)
|
|
*/
|
|
void tcp_retransmit_timer(struct sock *sk)
|
|
{
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
struct net *net = sock_net(sk);
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
|
|
if (tp->fastopen_rsk) {
|
|
WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
|
|
sk->sk_state != TCP_FIN_WAIT1);
|
|
tcp_fastopen_synack_timer(sk);
|
|
/* Before we receive ACK to our SYN-ACK don't retransmit
|
|
* anything else (e.g., data or FIN segments).
|
|
*/
|
|
return;
|
|
}
|
|
if (!tp->packets_out || WARN_ON_ONCE(tcp_rtx_queue_empty(sk)))
|
|
return;
|
|
|
|
tp->tlp_high_seq = 0;
|
|
|
|
if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
|
|
!((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {
|
|
/* Receiver dastardly shrinks window. Our retransmits
|
|
* become zero probes, but we should not timeout this
|
|
* connection. If the socket is an orphan, time it out,
|
|
* we cannot allow such beasts to hang infinitely.
|
|
*/
|
|
struct inet_sock *inet = inet_sk(sk);
|
|
if (sk->sk_family == AF_INET) {
|
|
net_dbg_ratelimited("Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
|
|
&inet->inet_daddr,
|
|
ntohs(inet->inet_dport),
|
|
inet->inet_num,
|
|
tp->snd_una, tp->snd_nxt);
|
|
}
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
else if (sk->sk_family == AF_INET6) {
|
|
net_dbg_ratelimited("Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
|
|
&sk->sk_v6_daddr,
|
|
ntohs(inet->inet_dport),
|
|
inet->inet_num,
|
|
tp->snd_una, tp->snd_nxt);
|
|
}
|
|
#endif
|
|
if (tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX) {
|
|
tcp_write_err(sk);
|
|
goto out;
|
|
}
|
|
tcp_enter_loss(sk);
|
|
tcp_retransmit_skb(sk, tcp_rtx_queue_head(sk), 1);
|
|
__sk_dst_reset(sk);
|
|
goto out_reset_timer;
|
|
}
|
|
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
|
|
if (tcp_write_timeout(sk))
|
|
goto out;
|
|
|
|
if (icsk->icsk_retransmits == 0) {
|
|
int mib_idx = 0;
|
|
|
|
if (icsk->icsk_ca_state == TCP_CA_Recovery) {
|
|
if (tcp_is_sack(tp))
|
|
mib_idx = LINUX_MIB_TCPSACKRECOVERYFAIL;
|
|
else
|
|
mib_idx = LINUX_MIB_TCPRENORECOVERYFAIL;
|
|
} else if (icsk->icsk_ca_state == TCP_CA_Loss) {
|
|
mib_idx = LINUX_MIB_TCPLOSSFAILURES;
|
|
} else if ((icsk->icsk_ca_state == TCP_CA_Disorder) ||
|
|
tp->sacked_out) {
|
|
if (tcp_is_sack(tp))
|
|
mib_idx = LINUX_MIB_TCPSACKFAILURES;
|
|
else
|
|
mib_idx = LINUX_MIB_TCPRENOFAILURES;
|
|
}
|
|
if (mib_idx)
|
|
__NET_INC_STATS(sock_net(sk), mib_idx);
|
|
}
|
|
|
|
tcp_enter_loss(sk);
|
|
|
|
icsk->icsk_retransmits++;
|
|
if (tcp_retransmit_skb(sk, tcp_rtx_queue_head(sk), 1) > 0) {
|
|
/* Retransmission failed because of local congestion,
|
|
* Let senders fight for local resources conservatively.
|
|
*/
|
|
inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
|
|
TCP_RESOURCE_PROBE_INTERVAL,
|
|
TCP_RTO_MAX);
|
|
goto out;
|
|
}
|
|
|
|
/* Increase the timeout each time we retransmit. Note that
|
|
* we do not increase the rtt estimate. rto is initialized
|
|
* from rtt, but increases here. Jacobson (SIGCOMM 88) suggests
|
|
* that doubling rto each time is the least we can get away with.
|
|
* In KA9Q, Karn uses this for the first few times, and then
|
|
* goes to quadratic. netBSD doubles, but only goes up to *64,
|
|
* and clamps at 1 to 64 sec afterwards. Note that 120 sec is
|
|
* defined in the protocol as the maximum possible RTT. I guess
|
|
* we'll have to use something other than TCP to talk to the
|
|
* University of Mars.
|
|
*
|
|
* PAWS allows us longer timeouts and large windows, so once
|
|
* implemented ftp to mars will work nicely. We will have to fix
|
|
* the 120 second clamps though!
|
|
*/
|
|
icsk->icsk_backoff++;
|
|
|
|
out_reset_timer:
|
|
/* If stream is thin, use linear timeouts. Since 'icsk_backoff' is
|
|
* used to reset timer, set to 0. Recalculate 'icsk_rto' as this
|
|
* might be increased if the stream oscillates between thin and thick,
|
|
* thus the old value might already be too high compared to the value
|
|
* set by 'tcp_set_rto' in tcp_input.c which resets the rto without
|
|
* backoff. Limit to TCP_THIN_LINEAR_RETRIES before initiating
|
|
* exponential backoff behaviour to avoid continue hammering
|
|
* linear-timeout retransmissions into a black hole
|
|
*/
|
|
if (sk->sk_state == TCP_ESTABLISHED &&
|
|
(tp->thin_lto || READ_ONCE(net->ipv4.sysctl_tcp_thin_linear_timeouts)) &&
|
|
tcp_stream_is_thin(tp) &&
|
|
icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
|
|
icsk->icsk_backoff = 0;
|
|
icsk->icsk_rto = clamp(__tcp_set_rto(tp),
|
|
tcp_rto_min(sk),
|
|
TCP_RTO_MAX);
|
|
} else {
|
|
/* Use normal (exponential) backoff */
|
|
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
|
|
}
|
|
inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
|
|
tcp_clamp_rto_to_user_timeout(sk), TCP_RTO_MAX);
|
|
if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1) + 1, 0))
|
|
__sk_dst_reset(sk);
|
|
|
|
out:;
|
|
}
|
|
|
|
/* Called with bottom-half processing disabled.
|
|
Called by tcp_write_timer() */
|
|
void tcp_write_timer_handler(struct sock *sk)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
int event;
|
|
|
|
if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
|
|
!icsk->icsk_pending)
|
|
goto out;
|
|
|
|
if (time_after(icsk->icsk_timeout, jiffies)) {
|
|
sk_reset_timer(sk, &icsk->icsk_retransmit_timer, icsk->icsk_timeout);
|
|
goto out;
|
|
}
|
|
|
|
tcp_mstamp_refresh(tcp_sk(sk));
|
|
event = icsk->icsk_pending;
|
|
|
|
switch (event) {
|
|
case ICSK_TIME_REO_TIMEOUT:
|
|
tcp_rack_reo_timeout(sk);
|
|
break;
|
|
case ICSK_TIME_LOSS_PROBE:
|
|
tcp_send_loss_probe(sk);
|
|
break;
|
|
case ICSK_TIME_RETRANS:
|
|
icsk->icsk_pending = 0;
|
|
tcp_retransmit_timer(sk);
|
|
break;
|
|
case ICSK_TIME_PROBE0:
|
|
icsk->icsk_pending = 0;
|
|
tcp_probe_timer(sk);
|
|
break;
|
|
}
|
|
|
|
out:
|
|
sk_mem_reclaim(sk);
|
|
}
|
|
|
|
static void tcp_write_timer(struct timer_list *t)
|
|
{
|
|
struct inet_connection_sock *icsk =
|
|
from_timer(icsk, t, icsk_retransmit_timer);
|
|
struct sock *sk = &icsk->icsk_inet.sk;
|
|
|
|
bh_lock_sock(sk);
|
|
if (!sock_owned_by_user(sk)) {
|
|
tcp_write_timer_handler(sk);
|
|
} else {
|
|
/* delegate our work to tcp_release_cb() */
|
|
if (!test_and_set_bit(TCP_WRITE_TIMER_DEFERRED, &sk->sk_tsq_flags))
|
|
sock_hold(sk);
|
|
}
|
|
bh_unlock_sock(sk);
|
|
sock_put(sk);
|
|
}
|
|
|
|
void tcp_syn_ack_timeout(const struct request_sock *req)
|
|
{
|
|
struct net *net = read_pnet(&inet_rsk(req)->ireq_net);
|
|
|
|
__NET_INC_STATS(net, LINUX_MIB_TCPTIMEOUTS);
|
|
}
|
|
EXPORT_SYMBOL(tcp_syn_ack_timeout);
|
|
|
|
void tcp_set_keepalive(struct sock *sk, int val)
|
|
{
|
|
if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
|
|
return;
|
|
|
|
if (val && !sock_flag(sk, SOCK_KEEPOPEN))
|
|
inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tcp_sk(sk)));
|
|
else if (!val)
|
|
inet_csk_delete_keepalive_timer(sk);
|
|
}
|
|
EXPORT_SYMBOL_GPL(tcp_set_keepalive);
|
|
|
|
|
|
static void tcp_keepalive_timer (struct timer_list *t)
|
|
{
|
|
struct sock *sk = from_timer(sk, t, sk_timer);
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
u32 elapsed;
|
|
|
|
/* Only process if socket is not in use. */
|
|
bh_lock_sock(sk);
|
|
if (sock_owned_by_user(sk)) {
|
|
/* Try again later. */
|
|
inet_csk_reset_keepalive_timer (sk, HZ/20);
|
|
goto out;
|
|
}
|
|
|
|
if (sk->sk_state == TCP_LISTEN) {
|
|
pr_err("Hmm... keepalive on a LISTEN ???\n");
|
|
goto out;
|
|
}
|
|
|
|
tcp_mstamp_refresh(tp);
|
|
if (sk->sk_state == TCP_FIN_WAIT2 && sock_flag(sk, SOCK_DEAD)) {
|
|
if (tp->linger2 >= 0) {
|
|
const int tmo = tcp_fin_time(sk) - TCP_TIMEWAIT_LEN;
|
|
|
|
if (tmo > 0) {
|
|
tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
|
|
goto out;
|
|
}
|
|
}
|
|
tcp_send_active_reset(sk, GFP_ATOMIC);
|
|
goto death;
|
|
}
|
|
|
|
if (!sock_flag(sk, SOCK_KEEPOPEN) ||
|
|
((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)))
|
|
goto out;
|
|
|
|
elapsed = keepalive_time_when(tp);
|
|
|
|
/* It is alive without keepalive 8) */
|
|
if (tp->packets_out || !tcp_write_queue_empty(sk))
|
|
goto resched;
|
|
|
|
elapsed = keepalive_time_elapsed(tp);
|
|
|
|
if (elapsed >= keepalive_time_when(tp)) {
|
|
/* If the TCP_USER_TIMEOUT option is enabled, use that
|
|
* to determine when to timeout instead.
|
|
*/
|
|
if ((icsk->icsk_user_timeout != 0 &&
|
|
elapsed >= msecs_to_jiffies(icsk->icsk_user_timeout) &&
|
|
icsk->icsk_probes_out > 0) ||
|
|
(icsk->icsk_user_timeout == 0 &&
|
|
icsk->icsk_probes_out >= keepalive_probes(tp))) {
|
|
tcp_send_active_reset(sk, GFP_ATOMIC);
|
|
tcp_write_err(sk);
|
|
goto out;
|
|
}
|
|
if (tcp_write_wakeup(sk, LINUX_MIB_TCPKEEPALIVE) <= 0) {
|
|
icsk->icsk_probes_out++;
|
|
elapsed = keepalive_intvl_when(tp);
|
|
} else {
|
|
/* If keepalive was lost due to local congestion,
|
|
* try harder.
|
|
*/
|
|
elapsed = TCP_RESOURCE_PROBE_INTERVAL;
|
|
}
|
|
} else {
|
|
/* It is tp->rcv_tstamp + keepalive_time_when(tp) */
|
|
elapsed = keepalive_time_when(tp) - elapsed;
|
|
}
|
|
|
|
sk_mem_reclaim(sk);
|
|
|
|
resched:
|
|
inet_csk_reset_keepalive_timer (sk, elapsed);
|
|
goto out;
|
|
|
|
death:
|
|
tcp_done(sk);
|
|
|
|
out:
|
|
bh_unlock_sock(sk);
|
|
sock_put(sk);
|
|
}
|
|
|
|
static enum hrtimer_restart tcp_compressed_ack_kick(struct hrtimer *timer)
|
|
{
|
|
struct tcp_sock *tp = container_of(timer, struct tcp_sock, compressed_ack_timer);
|
|
struct sock *sk = (struct sock *)tp;
|
|
|
|
bh_lock_sock(sk);
|
|
if (!sock_owned_by_user(sk)) {
|
|
if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
|
|
tcp_send_ack(sk);
|
|
} else {
|
|
if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
|
|
&sk->sk_tsq_flags))
|
|
sock_hold(sk);
|
|
}
|
|
bh_unlock_sock(sk);
|
|
|
|
sock_put(sk);
|
|
|
|
return HRTIMER_NORESTART;
|
|
}
|
|
|
|
void tcp_init_xmit_timers(struct sock *sk)
|
|
{
|
|
inet_csk_init_xmit_timers(sk, &tcp_write_timer, &tcp_delack_timer,
|
|
&tcp_keepalive_timer);
|
|
hrtimer_init(&tcp_sk(sk)->pacing_timer, CLOCK_MONOTONIC,
|
|
HRTIMER_MODE_ABS_PINNED_SOFT);
|
|
tcp_sk(sk)->pacing_timer.function = tcp_pace_kick;
|
|
|
|
hrtimer_init(&tcp_sk(sk)->compressed_ack_timer, CLOCK_MONOTONIC,
|
|
HRTIMER_MODE_REL_PINNED_SOFT);
|
|
tcp_sk(sk)->compressed_ack_timer.function = tcp_compressed_ack_kick;
|
|
}
|