Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: vlan: dont drop packets from unknown vlans in promiscuous mode Phonet: Correct header retrieval after pskb_may_pull um: Proper Fix for f25c80a4: remove duplicate structure field initialization ip_gre: Fix dependencies wrt. ipv6. net-2.6: SYN retransmits: Add new parameter to retransmits_timed_out() iwl3945: queue the right work if the scan needs to be aborted mac80211: fix use-after-free

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: vlan: dont drop packets from unknown vlans in promiscuous mode Phonet: Correct header retrieval after pskb_may_pull um: Proper Fix for f25c80a4: remove duplicate structure field initialization ip_gre: Fix dependencies wrt. ipv6. net-2.6: SYN retransmits: Add new parameter to retransmits_timed_out() iwl3945: queue the right work if the scan needs to be aborted mac80211: fix use-after-free
Linus Torvalds
2 parents c470af0a27 173e79fb70
Showing 8 changed files Side-by-side Diff
arch/um/drivers/net_kern.c
drivers/net/wireless/iwlwifi/iwl-agn-lib.c
drivers/net/wireless/iwlwifi/iwl3945-base.c
net/8021q/vlan_core.c
net/ipv4/Kconfig
net/ipv4/tcp_timer.c
net/mac80211/rx.c
net/phonet/pep.c
@@ -255,18 +255,6 @@
 	netif_wake_queue(dev);
 }
  
-static int uml_net_set_mac(struct net_device *dev, void *addr)
-{
-	struct uml_net_private *lp = netdev_priv(dev);
-	struct sockaddr *hwaddr = addr;
-
-	spin_lock_irq(&lp->lock);
-	eth_mac_addr(dev, hwaddr->sa_data);
-	spin_unlock_irq(&lp->lock);
-
-	return 0;
-}
-
 static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
 {
 	dev->mtu = new_mtu;
@@ -373,7 +361,7 @@
 	.ndo_start_xmit 	= uml_net_start_xmit,
 	.ndo_set_multicast_list = uml_net_set_multicast_list,
 	.ndo_tx_timeout 	= uml_net_tx_timeout,
-	.ndo_set_mac_address	= uml_net_set_mac,
+	.ndo_set_mac_address	= eth_mac_addr,
 	.ndo_change_mtu 	= uml_net_change_mtu,
 	.ndo_validate_addr	= eth_validate_addr,
 };
@@ -472,7 +460,8 @@
 	    ((*transport->user->init)(&lp->user, dev) != 0))
 		goto out_unregister;
  
-	eth_mac_addr(dev, device->mac);
+	/* don't use eth_mac_addr, it will not work here */
+	memcpy(dev->dev_addr, device->mac, ETH_ALEN);
 	dev->mtu = transport->user->mtu;
 	dev->netdev_ops = &uml_netdev_ops;
 	dev->ethtool_ops = &uml_net_ethtool_ops;
@@ -1411,7 +1411,7 @@
 	clear_bit(STATUS_SCAN_HW, &priv->status);
 	clear_bit(STATUS_SCANNING, &priv->status);
 	/* inform mac80211 scan aborted */
-	queue_work(priv->workqueue, &priv->scan_completed);
+	queue_work(priv->workqueue, &priv->abort_scan);
 }
  
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
@@ -3018,7 +3018,7 @@
 	clear_bit(STATUS_SCANNING, &priv->status);
  
 	/* inform mac80211 scan aborted */
-	queue_work(priv->workqueue, &priv->scan_completed);
+	queue_work(priv->workqueue, &priv->abort_scan);
 }
  
 static void iwl3945_bg_restart(struct work_struct *data)
@@ -24,8 +24,11 @@
  
 	if (vlan_dev)
 		skb->dev = vlan_dev;
-	else if (vlan_id)
-		goto drop;
+	else if (vlan_id) {
+		if (!(skb->dev->flags & IFF_PROMISC))
+			goto drop;
+		skb->pkt_type = PACKET_OTHERHOST;
+	}
  
 	return (polling ? netif_receive_skb(skb) : netif_rx(skb));
  
@@ -102,8 +105,11 @@
  
 	if (vlan_dev)
 		skb->dev = vlan_dev;
-	else if (vlan_id)
-		goto drop;
+	else if (vlan_id) {
+		if (!(skb->dev->flags & IFF_PROMISC))
+			goto drop;
+		skb->pkt_type = PACKET_OTHERHOST;
+	}
  
 	for (p = napi->gro_list; p; p = p->next) {
 		NAPI_GRO_CB(p)->same_flow =
@@ -217,6 +217,7 @@
  
 config NET_IPGRE
 	tristate "IP: GRE tunnels over IP"
+	depends on IPV6 || IPV6=n
 	help
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the
@@ -135,13 +135,16 @@
  
 /* This function calculates a "timeout" which is equivalent to the timeout of a
  * TCP connection after "boundary" unsuccessful, exponentially backed-off
- * retransmissions with an initial RTO of TCP_RTO_MIN.
+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
+ * syn_set flag is set.
  */
 static bool retransmits_timed_out(struct sock *sk,
-				  unsigned int boundary)
+				  unsigned int boundary,
+				  bool syn_set)
 {
 	unsigned int timeout, linear_backoff_thresh;
 	unsigned int start_ts;
+	unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
  
 	if (!inet_csk(sk)->icsk_retransmits)
 		return false;
  
  
@@ -151,12 +154,12 @@
 	else
 		start_ts = tcp_sk(sk)->retrans_stamp;
  
-	linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+	linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
  
 	if (boundary <= linear_backoff_thresh)
-		timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+		timeout = ((2 << boundary) - 1) * rto_base;
 	else
-		timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+		timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
 			  (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
  
 	return (tcp_time_stamp - start_ts) >= timeout;
  
  
@@ -167,14 +170,15 @@
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	int retry_until;
-	bool do_reset;
+	bool do_reset, syn_set = 0;
  
 	if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
 		if (icsk->icsk_retransmits)
 			dst_negative_advice(sk);
 		retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+		syn_set = 1;
 	} else {
-		if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
+		if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
 			/* Black hole detection */
 			tcp_mtu_probing(icsk, sk);
  
  
@@ -187,14 +191,14 @@
  
 			retry_until = tcp_orphan_retries(sk, alive);
 			do_reset = alive ||
-				   !retransmits_timed_out(sk, retry_until);
+				   !retransmits_timed_out(sk, retry_until, 0);
  
 			if (tcp_out_of_resources(sk, do_reset))
 				return 1;
 		}
 	}
  
-	if (retransmits_timed_out(sk, retry_until)) {
+	if (retransmits_timed_out(sk, retry_until, syn_set)) {
 		/* Has it gone just too far? */
 		tcp_write_err(sk);
 		return 1;
@@ -436,7 +440,7 @@
 		icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
 	}
 	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-	if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
+	if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
 		__sk_dst_reset(sk);
  
 out:;
@@ -2199,9 +2199,6 @@
 	struct net_device *prev_dev = NULL;
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  
-	if (status->flag & RX_FLAG_INTERNAL_CMTR)
-		goto out_free_skb;
-
 	if (skb_headroom(skb) < sizeof(*rthdr) &&
 	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
 		goto out_free_skb;
@@ -2260,7 +2257,6 @@
 	} else
 		goto out_free_skb;
  
-	status->flag |= RX_FLAG_INTERNAL_CMTR;
 	return;
  
  out_free_skb:
@@ -225,12 +225,13 @@
 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 {
 	struct pep_sock *pn = pep_sk(sk);
-	struct pnpipehdr *hdr = pnp_hdr(skb);
+	struct pnpipehdr *hdr;
 	int wake = 0;
  
 	if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
 		return -EINVAL;
  
+	hdr = pnp_hdr(skb);
 	if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
 		LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
 				(unsigned)hdr->data[0]);
...	...	@@ -255,18 +255,6 @@
255	255	netif_wake_queue(dev);
256	256	}
257	257
258		-static int uml_net_set_mac(struct net_device dev, void addr)
259		-{
260		- struct uml_net_private *lp = netdev_priv(dev);
261		- struct sockaddr *hwaddr = addr;
262		-
263		- spin_lock_irq(&lp->lock);
264		- eth_mac_addr(dev, hwaddr->sa_data);
265		- spin_unlock_irq(&lp->lock);
266		-
267		- return 0;
268		-}
269		-
270	258	static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
271	259	{
272	260	dev->mtu = new_mtu;
...	...	@@ -373,7 +361,7 @@
373	361	.ndo_start_xmit = uml_net_start_xmit,
374	362	.ndo_set_multicast_list = uml_net_set_multicast_list,
375	363	.ndo_tx_timeout = uml_net_tx_timeout,
376		- .ndo_set_mac_address = uml_net_set_mac,
	364	+ .ndo_set_mac_address = eth_mac_addr,
377	365	.ndo_change_mtu = uml_net_change_mtu,
378	366	.ndo_validate_addr = eth_validate_addr,
379	367	};
...	...	@@ -472,7 +460,8 @@
472	460	((*transport->user->init)(&lp->user, dev) != 0))
473	461	goto out_unregister;
474	462
475		- eth_mac_addr(dev, device->mac);
	463	+ /* don't use eth_mac_addr, it will not work here */
	464	+ memcpy(dev->dev_addr, device->mac, ETH_ALEN);
476	465	dev->mtu = transport->user->mtu;
477	466	dev->netdev_ops = &uml_netdev_ops;
478	467	dev->ethtool_ops = &uml_net_ethtool_ops;
...	...	@@ -1411,7 +1411,7 @@
1411	1411	clear_bit(STATUS_SCAN_HW, &priv->status);
1412	1412	clear_bit(STATUS_SCANNING, &priv->status);
1413	1413	/* inform mac80211 scan aborted */
1414		- queue_work(priv->workqueue, &priv->scan_completed);
	1414	+ queue_work(priv->workqueue, &priv->abort_scan);
1415	1415	}
1416	1416
1417	1417	int iwlagn_manage_ibss_station(struct iwl_priv *priv,
...	...	@@ -3018,7 +3018,7 @@
3018	3018	clear_bit(STATUS_SCANNING, &priv->status);
3019	3019
3020	3020	/* inform mac80211 scan aborted */
3021		- queue_work(priv->workqueue, &priv->scan_completed);
	3021	+ queue_work(priv->workqueue, &priv->abort_scan);
3022	3022	}
3023	3023
3024	3024	static void iwl3945_bg_restart(struct work_struct *data)
...	...	@@ -24,8 +24,11 @@
24	24
25	25	if (vlan_dev)
26	26	skb->dev = vlan_dev;
27		- else if (vlan_id)
28		- goto drop;
	27	+ else if (vlan_id) {
	28	+ if (!(skb->dev->flags & IFF_PROMISC))
	29	+ goto drop;
	30	+ skb->pkt_type = PACKET_OTHERHOST;
	31	+ }
29	32
30	33	return (polling ? netif_receive_skb(skb) : netif_rx(skb));
31	34
...	...	@@ -102,8 +105,11 @@
102	105
103	106	if (vlan_dev)
104	107	skb->dev = vlan_dev;
105		- else if (vlan_id)
106		- goto drop;
	108	+ else if (vlan_id) {
	109	+ if (!(skb->dev->flags & IFF_PROMISC))
	110	+ goto drop;
	111	+ skb->pkt_type = PACKET_OTHERHOST;
	112	+ }
107	113
108	114	for (p = napi->gro_list; p; p = p->next) {
109	115	NAPI_GRO_CB(p)->same_flow =
...	...	@@ -217,6 +217,7 @@
217	217
218	218	config NET_IPGRE
219	219	tristate "IP: GRE tunnels over IP"
	220	+ depends on IPV6 \|\| IPV6=n
220	221	help
221	222	Tunneling means encapsulating data of one protocol type within
222	223	another protocol and sending it over a channel that understands the
...	...	@@ -135,13 +135,16 @@
135	135
136	136	/* This function calculates a "timeout" which is equivalent to the timeout of a
137	137	* TCP connection after "boundary" unsuccessful, exponentially backed-off
138		- * retransmissions with an initial RTO of TCP_RTO_MIN.
	138	+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
	139	+ * syn_set flag is set.
139	140	*/
140	141	static bool retransmits_timed_out(struct sock *sk,
141		- unsigned int boundary)
	142	+ unsigned int boundary,
	143	+ bool syn_set)
142	144	{
143	145	unsigned int timeout, linear_backoff_thresh;
144	146	unsigned int start_ts;
	147	+ unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
145	148
146	149	if (!inet_csk(sk)->icsk_retransmits)
147	150	return false;
148	151
149	152
...	...	@@ -151,12 +154,12 @@
151	154	else
152	155	start_ts = tcp_sk(sk)->retrans_stamp;
153	156
154		- linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
	157	+ linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
155	158
156	159	if (boundary <= linear_backoff_thresh)
157		- timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
	160	+ timeout = ((2 << boundary) - 1) * rto_base;
158	161	else
159		- timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
	162	+ timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
160	163	(boundary - linear_backoff_thresh) * TCP_RTO_MAX;
161	164
162	165	return (tcp_time_stamp - start_ts) >= timeout;
163	166
164	167
...	...	@@ -167,14 +170,15 @@
167	170	{
168	171	struct inet_connection_sock *icsk = inet_csk(sk);
169	172	int retry_until;
170		- bool do_reset;
	173	+ bool do_reset, syn_set = 0;
171	174
172	175	if ((1 << sk->sk_state) & (TCPF_SYN_SENT \| TCPF_SYN_RECV)) {
173	176	if (icsk->icsk_retransmits)
174	177	dst_negative_advice(sk);
175	178	retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
	179	+ syn_set = 1;
176	180	} else {
177		- if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
	181	+ if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
178	182	/* Black hole detection */
179	183	tcp_mtu_probing(icsk, sk);
180	184
181	185
...	...	@@ -187,14 +191,14 @@
187	191
188	192	retry_until = tcp_orphan_retries(sk, alive);
189	193	do_reset = alive \|\|
190		- !retransmits_timed_out(sk, retry_until);
	194	+ !retransmits_timed_out(sk, retry_until, 0);
191	195
192	196	if (tcp_out_of_resources(sk, do_reset))
193	197	return 1;
194	198	}
195	199	}
196	200
197		- if (retransmits_timed_out(sk, retry_until)) {
	201	+ if (retransmits_timed_out(sk, retry_until, syn_set)) {
198	202	/* Has it gone just too far? */
199	203	tcp_write_err(sk);
200	204	return 1;
...	...	@@ -436,7 +440,7 @@
436	440	icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
437	441	}
438	442	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
439		- if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
	443	+ if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
440	444	__sk_dst_reset(sk);
441	445
442	446	out:;
...	...	@@ -2199,9 +2199,6 @@
2199	2199	struct net_device *prev_dev = NULL;
2200	2200	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2201	2201
2202		- if (status->flag & RX_FLAG_INTERNAL_CMTR)
2203		- goto out_free_skb;
2204		-
2205	2202	if (skb_headroom(skb) < sizeof(*rthdr) &&
2206	2203	pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2207	2204	goto out_free_skb;
...	...	@@ -2260,7 +2257,6 @@
2260	2257	} else
2261	2258	goto out_free_skb;
2262	2259
2263		- status->flag \|= RX_FLAG_INTERNAL_CMTR;
2264	2260	return;
2265	2261
2266	2262	out_free_skb:
...	...	@@ -225,12 +225,13 @@
225	225	static int pipe_rcv_status(struct sock sk, struct sk_buff skb)
226	226	{
227	227	struct pep_sock *pn = pep_sk(sk);
228		- struct pnpipehdr *hdr = pnp_hdr(skb);
	228	+ struct pnpipehdr *hdr;
229	229	int wake = 0;
230	230
231	231	if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
232	232	return -EINVAL;
233	233
	234	+ hdr = pnp_hdr(skb);
234	235	if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
235	236	LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
236	237	(unsigned)hdr->data[0]);