01 May, 2008

2 commits


30 Apr, 2008

1 commit

  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (53 commits)
    tcp: Overflow bug in Vegas
    [IPv4] UFO: prevent generation of chained skb destined to UFO device
    iwlwifi: move the selects to the tristate drivers
    ipv4: annotate a few functions __init in ipconfig.c
    atm: ambassador: vcc_sf semaphore to mutex
    MAINTAINERS: The socketcan-core list is subscribers-only.
    netfilter: nf_conntrack: padding breaks conntrack hash on ARM
    ipv4: Update MTU to all related cache entries in ip_rt_frag_needed()
    sch_sfq: use del_timer_sync() in sfq_destroy()
    net: Add compat support for getsockopt (MCAST_MSFILTER)
    net: Several cleanups for the setsockopt compat support.
    ipvs: fix oops in backup for fwmark conn templates
    bridge: kernel panic when unloading bridge module
    bridge: fix error handling in br_add_if()
    netfilter: {nfnetlink,ip,ip6}_queue: fix skb_over_panic when enlarging packets
    netfilter: x_tables: fix net namespace leak when reading /proc/net/xxx_tables_names
    netfilter: xt_TCPOPTSTRIP: signed tcphoff for ipv6_skip_exthdr() retval
    tcp: Limit cwnd growth when deferring for GSO
    tcp: Allow send-limited cwnd to grow up to max_burst when gso disabled
    [netdrvr] gianfar: Determine TBIPA value dynamically
    ...

    Linus Torvalds
     

29 Apr, 2008

3 commits

  • This patch adds support for getsockopt for MCAST_MSFILTER for
    both IPv4 and IPv6. It depends on the previous setsockopt patch,
    and uses the same method.

    Signed-off-by: David L Stevens
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    David L Stevens
     
  • While reinjecting *bigger* modified versions of IPv6 packets using
    libnetfilter_queue, things work fine on a 2.6.24 kernel (2.6.22 too)
    but I get the following on recents kernels (2.6.25, trace below is
    against today's net-2.6 git tree):

    skb_over_panic: text:c04fddb0 len:696 put:632 head:f7592c00 data:f7592c00 tail:0xf7592eb8 end:0xf7592e80 dev:eth0
    ------------[ cut here ]------------
    invalid opcode: 0000 [#1] PREEMPT
    Process sendd (pid: 3657, ti=f6014000 task=f77c31d0 task.ti=f6014000)
    Stack: c071e638 c04fddb0 000002b8 00000278 f7592c00 f7592c00 f7592eb8 f7592e80
    f763c000 f6bc5200 f7592c40 f6015c34 c04cdbfc f6bc5200 00000278 f6015c60
    c04fddb0 00000020 f72a10c0 f751b420 00000001 0000000a 000002b8 c065582c
    Call Trace:
    [] ? nfqnl_recv_verdict+0x1c0/0x2e0
    [] ? skb_put+0x3c/0x40
    [] ? nfqnl_recv_verdict+0x1c0/0x2e0
    [] ? nfnetlink_rcv_msg+0xf5/0x160
    [] ? nfnetlink_rcv_msg+0x1e/0x160
    [] ? nfnetlink_rcv_msg+0x0/0x160
    [] ? netlink_rcv_skb+0x77/0xa0
    [] ? nfnetlink_rcv+0x1c/0x30
    [] ? netlink_unicast+0x243/0x2b0
    [] ? memcpy_fromiovec+0x4a/0x70
    [] ? netlink_sendmsg+0x1c6/0x270
    [] ? sock_sendmsg+0xc4/0xf0
    [] ? set_next_entity+0x1d/0x50
    [] ? autoremove_wake_function+0x0/0x40
    [] ? __wake_up_common+0x3e/0x70
    [] ? n_tty_receive_buf+0x34f/0x1280
    [] ? __wake_up+0x68/0x70
    [] ? copy_from_user+0x37/0x70
    [] ? verify_iovec+0x2c/0x90
    [] ? sys_sendmsg+0x10a/0x230
    [] ? __dequeue_entity+0x2a/0xa0
    [] ? set_next_entity+0x1d/0x50
    [] ? pty_write+0x47/0x60
    [] ? tty_default_put_char+0x1b/0x20
    [] ? __wake_up+0x49/0x70
    [] ? tty_ldisc_deref+0x39/0x90
    [] ? tty_write+0x1a0/0x1b0
    [] ? sys_socketcall+0x7f/0x260
    [] ? sysenter_past_esp+0x6a/0x91
    [] ? snd_intel8x0m_probe+0x270/0x6e0
    =======================
    Code: 00 00 89 5c 24 14 8b 98 9c 00 00 00 89 54 24 0c 89 5c 24 10 8b 40 50 89 4c 24 04 c7 04 24 38 e6 71 c0 89 44 24 08 e8 c4 46 c5 ff 0b eb fe 55 89 e5 56 89 d6 53 89 c3 83 ec 0c 8b 40 50 39 d0
    EIP: [] skb_over_panic+0x5c/0x60 SS:ESP 0068:f6015bf8

    Looking at the code, I ended up in nfq_mangle() function (called by
    nfqnl_recv_verdict()) which performs a call to skb_copy_expand() due to
    the increased size of data passed to the function. AFAICT, it should ask
    for 'diff' instead of 'diff - skb_tailroom(e->skb)'. Because the
    resulting sk_buff has not enough space to support the skb_put(skb, diff)
    call a few lines later, this results in the call to skb_over_panic().

    The patch below asks for allocation of a copy with enough space for
    mangled packet and the same amount of headroom as old sk_buff. While
    looking at how the regression appeared (e2b58a67), I noticed the same
    pattern in ipq_mangle_ipv6() and ipq_mangle_ipv4(). The patch corrects
    those locations too.

    Tested with bigger reinjected IPv6 packets (nfqnl_mangle() path), things
    are ok (2.6.25 and today's net-2.6 git tree).

    Signed-off-by: Arnaud Ebalard
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Arnaud Ebalard
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
    iwlwifi: Allow building iwl3945 without iwl4965.
    wireless: Fix compile error with wifi & leds
    tcp: Fix slab corruption with ipv6 and tcp6fuzz
    ipv4/ipv6 compat: Fix SSM applications on 64bit kernels.
    [IPSEC]: Use digest_null directly for auth
    sunrpc: fix missing kernel-doc
    can: Fix copy_from_user() results interpretation
    Revert "ipv6: Fix typo in net/ipv6/Kconfig"
    tipc: endianness annotations
    ipv6: result of csum_fold() is already 16bit, no need to cast
    [XFRM] AUDIT: Fix flowlabel text format ambibuity.

    Linus Torvalds
     

28 Apr, 2008

3 commits


26 Apr, 2008

1 commit

  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (48 commits)
    net: Fix wrong interpretation of some copy_to_user() results.
    xfrm: alg_key_len & alg_icv_len should be unsigned
    [netdrvr] tehuti: move ioctl perm check closer to function start
    ipv6: Fix typo in net/ipv6/Kconfig
    via-velocity: fix vlan receipt
    tg3: sparse cleanup
    forcedeth: realtek phy crossover detection
    ibm_newemac: Increase MDIO timeouts
    gianfar: Fix skb allocation strategy
    netxen: reduce stack usage of netxen_nic_flash_print
    smc911x: test after postfix decrement fails in smc911x_{reset,drop_pkt}
    net drivers: fix platform driver hotplug/coldplug
    forcedeth: new backoff implementation
    ehea: make things static
    phylib: Add support for board-level PHY fixups
    [netdrvr] atlx: code movement: move atl1 parameter parsing
    atlx: remove flash vendor parameter
    korina: misc cleanup
    korina: fix misplaced return statement
    WAN: Fix confusing insmod error code for C101 too.
    ...

    Linus Torvalds
     

25 Apr, 2008

2 commits


24 Apr, 2008

1 commit

  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
    iwlwifi: Fix built-in compilation of iwlcore
    net: Unexport move_addr_to_{kernel,user}
    rt2x00: Select LEDS_CLASS.
    iwlwifi: Select LEDS_CLASS.
    leds: Do not guard NEW_LEDS with HAS_IOMEM
    [IPSEC]: Fix catch-22 with algorithm IDs above 31
    time: Export set_normalized_timespec.
    tcp: Make use of before macro in tcp_input.c
    hamradio: Remove unneeded and deprecated cli()/sti() calls in dmascc.c
    [NETNS]: Remove empty ->init callback.
    [DCCP]: Convert do_gettimeofday() to getnstimeofday().
    [NETNS]: Don't initialize err variable twice.
    [NETNS]: The ip6_fib_timer can work with garbage on net namespace stop.
    [IPV4]: Convert do_gettimeofday() to getnstimeofday().
    [IPV4]: Make icmp_sk_init() static.
    [IPV6]: Make struct ip6_prohibit_entry_template static.
    tcp: Trivial fix to correct function name in a comment in net/ipv4/tcp.c
    [NET]: Expose netdevice dev_id through sysfs
    skbuff: fix missing kernel-doc notation
    [ROSE]: Fix soft lockup wrt. rose_node_list_lock

    Linus Torvalds
     

22 Apr, 2008

3 commits


21 Apr, 2008

1 commit


19 Apr, 2008

1 commit


18 Apr, 2008

2 commits

  • Fixes bugzilla #8895

    If a super-tree leaf has 'rt' assigned to it and we
    get an error from fib6_add_rt2node(), we'll leave
    a reference to 'rt' in pn->leaf and then do an
    unconditional dst_free().

    We should prune such references.

    Based upon a report by Vincent Perrier.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • As I can see from the code, two places (tcp_v6_syn_recv_sock and
    dccp_v6_request_recv_sock) that call this one already run with
    BHs disabled, so it's safe to call __inet_inherit_port there.

    Besides (in case I missed smth with code review) the calltrace
    tcp_v6_syn_recv_sock
    `- tcp_v4_syn_recv_sock
    `- __inet_inherit_port
    and the similar for DCCP are valid, but assumes BHs to be disabled.

    Signed-off-by: Pavel Emelyanov
    Signed-off-by: David S. Miller

    Pavel Emelyanov
     

16 Apr, 2008

15 commits


14 Apr, 2008

5 commits