24 Nov, 2011

1 commit


07 Nov, 2011

1 commit

  • * 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
    Revert "tracing: Include module.h in define_trace.h"
    irq: don't put module.h into irq.h for tracking irqgen modules.
    bluetooth: macroize two small inlines to avoid module.h
    ip_vs.h: fix implicit use of module_get/module_put from module.h
    nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
    include: replace linux/module.h with "struct module" wherever possible
    include: convert various register fcns to macros to avoid include chaining
    crypto.h: remove unused crypto_tfm_alg_modname() inline
    uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
    pm_runtime.h: explicitly requires notifier.h
    linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
    miscdevice.h: fix up implicit use of lists and types
    stop_machine.h: fix implicit use of smp.h for smp_processor_id
    of: fix implicit use of errno.h in include/linux/of.h
    of_platform.h: delete needless include
    acpi: remove module.h include from platform/aclinux.h
    miscdevice.h: delete unnecessary inclusion of module.h
    device_cgroup.h: delete needless include
    net: sch_generic remove redundant use of
    net: inet_timewait_sock doesnt need
    ...

    Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in
    - drivers/media/dvb/frontends/dibx000_common.c
    - drivers/media/video/{mt9m111.c,ov6650.c}
    - drivers/mfd/ab3550-core.c
    - include/linux/dmaengine.h

    Linus Torvalds
     

01 Nov, 2011

3 commits


22 Sep, 2011

1 commit

  • Conflicts:
    MAINTAINERS
    drivers/net/Kconfig
    drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    drivers/net/ethernet/broadcom/tg3.c
    drivers/net/wireless/iwlwifi/iwl-pci.c
    drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
    drivers/net/wireless/rt2x00/rt2800usb.c
    drivers/net/wireless/wl12xx/main.c

    David S. Miller
     

31 Aug, 2011

1 commit


30 Aug, 2011

1 commit

  • A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.

    This problem was previously fixed via
    64507fdbc29c3a622180378210ecea8659b14e40 (netfilter:
    nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
    NF_STOLEN can also be returned by a netfilter hook when iterating the
    rules in nf_reinject.

    Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.

    This is complementary to commit fad54440438a7c231a6ae347738423cbabc936d9
    (netfilter: avoid double free in nf_reinject).

    Cc: Julian Anastasov
    Cc: Eric Dumazet
    Signed-off-by: Florian Westphal
    Signed-off-by: Patrick McHardy

    Florian Westphal
     

08 Aug, 2011

1 commit


07 Aug, 2011

1 commit

  • Computers have become a lot faster since we compromised on the
    partial MD4 hash which we use currently for performance reasons.

    MD5 is a much safer choice, and is inline with both RFC1948 and
    other ISS generators (OpenBSD, Solaris, etc.)

    Furthermore, only having 24-bits of the sequence number be truly
    unpredictable is a very serious limitation. So the periodic
    regeneration and 8-bit counter have been removed. We compute and
    use a full 32-bit sequence number.

    For ipv6, DCCP was found to use a 32-bit truncated initial sequence
    number (it needs 43-bits) and that is fixed here as well.

    Reported-by: Dan Kaminsky
    Tested-by: Willy Tarreau
    Signed-off-by: David S. Miller

    David S. Miller
     

02 Aug, 2011

1 commit

  • When assigning a NULL value to an RCU protected pointer, no barrier
    is needed. The rcu_assign_pointer, used to handle that but will soon
    change to not handle the special case.

    Convert all rcu_assign_pointer of NULL value.

    //smpl
    @@ expression P; @@

    - rcu_assign_pointer(P, NULL)
    + RCU_INIT_POINTER(P, NULL)

    //

    Signed-off-by: Stephen Hemminger
    Acked-by: Paul E. McKenney
    Signed-off-by: David S. Miller

    Stephen Hemminger
     

29 Jul, 2011

1 commit

  • ipq_build_packet_message() in net/ipv4/netfilter/ip_queue.c and
    net/ipv6/netfilter/ip6_queue.c contain a small potential mem leak as
    far as I can tell.

    We allocate memory for 'skb' with alloc_skb() annd then call
    nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));

    NLMSG_PUT is a macro
    NLMSG_PUT(skb, pid, seq, type, len) \
    NLMSG_NEW(skb, pid, seq, type, len, 0)

    that expands to NLMSG_NEW, which is also a macro which expands to:
    NLMSG_NEW(skb, pid, seq, type, len, flags) \
    ({ if (unlikely(skb_tailroom(skb) < (int)NLMSG_SPACE(len))) \
    goto nlmsg_failure; \
    __nlmsg_put(skb, pid, seq, type, len, flags); })

    If we take the true branch of the 'if' statement and 'goto
    nlmsg_failure', then we'll, at that point, return from
    ipq_build_packet_message() without having assigned 'skb' to anything
    and we'll leak the memory we allocated for it when it goes out of
    scope.

    Fix this by placing a 'kfree(skb)' at 'nlmsg_failure'.

    I admit that I do not know how likely this to actually happen or even
    if there's something that guarantees that it will never happen - I'm
    not that familiar with this code, but if that is so, I've not been
    able to spot it.

    Signed-off-by: Jesper Juhl
    Signed-off-by: Patrick McHardy

    Jesper Juhl
     

06 Jul, 2011

1 commit


02 Jul, 2011

1 commit

  • Make the case labels the same indent as the switch.

    git diff -w shows miscellaneous 80 column wrapping,
    comment reflowing and a comment for a useless gcc
    warning for an otherwise unused default: case.

    Signed-off-by: Joe Perches
    Signed-off-by: David S. Miller

    Joe Perches
     

29 Jun, 2011

1 commit

  • Avoid creating input routes with ip_route_me_harder.
    It does not work for locally generated packets. Instead,
    restrict sockets to provide valid saddr for output route (or
    unicast saddr for transparent proxy). For other traffic
    allow saddr to be unicast or local but if callers forget
    to check saddr type use 0 for the output route.

    The resulting handling should be:

    - REJECT TCP:
    - in INPUT we can provide addr_type = RTN_LOCAL but
    better allow rejecting traffic delivered with
    local route (no IP address => use RTN_UNSPEC to
    allow also RTN_UNICAST).
    - FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST
    saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST
    - OUTPUT: RTN_UNSPEC

    - NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT

    - IPVS:
    - use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT
    to restrict saddr to be local

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     

22 Jun, 2011

1 commit


16 Jun, 2011

5 commits


06 Jun, 2011

4 commits

  • Netlink message lengths can't be negative, so use unsigned variables.

    Signed-off-by: Dave Jones
    Signed-off-by: Pablo Neira Ayuso

    Dave Jones
     
  • This patch fixes a refcount leak of ct objects that may occur if
    l4proto->error() assigns one conntrack object to one skbuff. In
    that case, we have to skip further processing in nf_conntrack_in().

    With this patch, we can also fix wrong return values (-NF_ACCEPT)
    for special cases in ICMP[v6] that should not bump the invalid/error
    statistic counters.

    Reported-by: Zoltan Menyhart
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • Fix crash in nf_nat_csum when mangling packets
    in OUTPUT hook where skb->dev is not defined, it is set
    later before POSTROUTING. Problem happens for CHECKSUM_NONE.
    We can check device from rt but using CHECKSUM_PARTIAL
    should be safe (skb_checksum_help).

    Signed-off-by: Julian Anastasov
    Signed-off-by: Pablo Neira Ayuso

    Julian Anastasov
     
  • Following error is raised (and other similar ones) :

    net/ipv4/netfilter/nf_nat_standalone.c: In function ‘nf_nat_fn’:
    net/ipv4/netfilter/nf_nat_standalone.c:119:2: warning: case value ‘4’
    not in enumerated type ‘enum ip_conntrack_info’

    gcc barfs on adding two enum values and getting a not enumerated
    result :

    case IP_CT_RELATED+IP_CT_IS_REPLY:

    Add missing enum values

    Signed-off-by: Eric Dumazet
    CC: David Miller
    Signed-off-by: Pablo Neira Ayuso

    Eric Dumazet
     

23 Apr, 2011

1 commit


20 Apr, 2011

1 commit


04 Apr, 2011

1 commit

  • We currently use a percpu spinlock to 'protect' rule bytes/packets
    counters, after various attempts to use RCU instead.

    Lately we added a seqlock so that get_counters() can run without
    blocking BH or 'writers'. But we really only need the seqcount in it.

    Spinlock itself is only locked by the current/owner cpu, so we can
    remove it completely.

    This cleanups api, using correct 'writer' vs 'reader' semantic.

    At replace time, the get_counters() call makes sure all cpus are done
    using the old table.

    Signed-off-by: Eric Dumazet
    Cc: Jan Engelhardt
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     

31 Mar, 2011

1 commit


20 Mar, 2011

2 commits

  • 'buffer' string is copied from userspace. It is not checked whether it is
    zero terminated. This may lead to overflow inside of simple_strtoul().
    Changli Gao suggested to copy not more than user supplied 'size' bytes.

    It was introduced before the git epoch. Files "ipt_CLUSTERIP/*" are
    root writable only by default, however, on some setups permissions might be
    relaxed to e.g. network admin user.

    Signed-off-by: Vasiliy Kulikov
    Acked-by: Changli Gao
    Signed-off-by: Patrick McHardy

    Vasiliy Kulikov
     
  • commit f3c5c1bfd4308 (make ip_tables reentrant) introduced a race in
    handling the stackptr restore, at the end of ipt_do_table()

    We should do it before the call to xt_info_rdunlock_bh(), or we allow
    cpu preemption and another cpu overwrites stackptr of original one.

    A second fix is to change the underflow test to check the origptr value
    instead of 0 to detect underflow, or else we allow a jump from different
    hooks.

    Signed-off-by: Eric Dumazet
    Cc: Jan Engelhardt
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     

16 Mar, 2011

2 commits


15 Mar, 2011

2 commits

  • Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
    copied from userspace. Fields of these structs that are
    zero-terminated strings are not checked. When they are used as argument
    to a format string containing "%s" in request_module(), some sensitive
    information is leaked to userspace via argument of spawned modprobe
    process.

    The first and the third bugs were introduced before the git epoch; the
    second was introduced in 2722971c (v2.6.17-rc1). To trigger the bug
    one should have CAP_NET_ADMIN.

    Signed-off-by: Vasiliy Kulikov
    Signed-off-by: Patrick McHardy

    Vasiliy Kulikov
     
  • Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
    copied from userspace. Fields of these structs that are
    zero-terminated strings are not checked. When they are used as argument
    to a format string containing "%s" in request_module(), some sensitive
    information is leaked to userspace via argument of spawned modprobe
    process.

    The first bug was introduced before the git epoch; the second is
    introduced by 6b7d31fc (v2.6.15-rc1); the third is introduced by
    6b7d31fc (v2.6.15-rc1). To trigger the bug one should have
    CAP_NET_ADMIN.

    Signed-off-by: Vasiliy Kulikov
    Signed-off-by: Patrick McHardy

    Vasiliy Kulikov
     

13 Mar, 2011

3 commits


05 Feb, 2011

1 commit


01 Feb, 2011

1 commit

  • In 135367b "netfilter: xtables: change xt_target.checkentry return type",
    the type returned by checkentry was changed from boolean to int, but the
    return values where not adjusted.

    arptables: Input/output error

    This broke arptables with the mangle target since it returns true
    under success, which is interpreted by xtables as >0, thus
    returning EIO.

    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Patrick McHardy

    Pablo Neira Ayuso