22 Sep, 2011
2 commits
-
When asyncronous crypto algorithms are used, there might be many
packets that passed the xfrm replay check, but the replay advance
function is not called yet for these packets. So the replay check
function would accept a replay of all of these packets. Also the
system might crash if there are more packets in async processing
than the size of the anti replay window, because the replay advance
function would try to update the replay window beyond the bounds.This pach adds a second replay check after resuming from the async
processing to fix these issues.Signed-off-by: Steffen Klassert
Acked-by: Herbert Xu
Signed-off-by: David S. Miller -
add new fib rule can cause BUG_ON happen
the reproduce shell is
ip rule add pref 38
ip rule add pref 38
ip rule add to 192.168.3.0/24 goto 38
ip rule del pref 38
ip rule add to 192.168.3.0/24 goto 38
ip rule add pref 38then the BUG_ON will happen
del BUG_ON and use (ctarget == NULL) identify whether this rule is unresolvedSigned-off-by: Gao feng
Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller
21 Sep, 2011
1 commit
-
When calling snmp6_alloc_dev fails, the snmp6 relevant memory
are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
will free these memory twice.Double free will lead that undefined behavior occurs.
Signed-off-by: Roy Li
Acked-by: Eric Dumazet
Signed-off-by: David S. Miller
20 Sep, 2011
2 commits
19 Sep, 2011
2 commits
-
D-SACK is allowed to reside below snd_una. But the corresponding check
in tcp_is_sackblock_valid() is the exact opposite. It looks like a typo.Signed-off-by: Zheng Yan
Acked-by: Eric Dumazet
Signed-off-by: David S. Miller -
* git://github.com/davem330/net: (62 commits)
ipv6: don't use inetpeer to store metrics for routes.
can: ti_hecc: include linux/io.h
IRDA: Fix global type conflicts in net/irda/irsysctl.c v2
net: Handle different key sizes between address families in flow cache
net: Align AF-specific flowi structs to long
ipv4: Fix fib_info->fib_metrics leak
caif: fix a potential NULL dereference
sctp: deal with multiple COOKIE_ECHO chunks
ibmveth: Fix checksum offload failure handling
ibmveth: Checksum offload is always disabled
ibmveth: Fix issue with DMA mapping failure
ibmveth: Fix DMA unmap error
pch_gbe: support ML7831 IOH
pch_gbe: added the process of FIFO over run error
pch_gbe: fixed the issue which receives an unnecessary packet.
sfc: Use 64-bit writes for TX push where possible
Revert "sfc: Use write-combining to reduce TX latency" and follow-ups
bnx2x: Fix ethtool advertisement
bnx2x: Fix 578xx link LED
bnx2x: Fix XMAC loopback test
...
17 Sep, 2011
8 commits
-
Current IPv6 implementation uses inetpeer to store metrics for
routes. The problem of inetpeer is that it doesn't take subnet
prefix length in to consideration. If two routes have the same
address but different prefix length, they share same inetpeer.
So changing metrics of one route also affects the other. The
fix is to allocate separate metrics storage for each route.Signed-off-by: Zheng Yan
Signed-off-by: David S. Miller -
The externs here didn't agree with the declarations in qos.c.
Better would be probably to move this into a header, but since it's
common practice to have naked externs with sysctls I left it for now.Cc: samuel@sortiz.org
Signed-off-by: Andi Kleen
Signed-off-by: David S. Miller -
With the conversion of struct flowi to a union of AF-specific structs, some
operations on the flow cache need to account for the exact size of the key.Signed-off-by: David Ward
Signed-off-by: David S. Miller -
Commit 4670994d(net,rcu: convert call_rcu(fc_rport_free_rcu) to
kfree_rcu()) introduced a memory leak. This patch reverts it.Signed-off-by: Zheng Yan
Signed-off-by: David S. Miller -
Commit bd30ce4bc0b7 (caif: Use RCU instead of spin-lock in caif_dev.c)
added a potential NULL dereference in case alloc_percpu() fails.caif_device_alloc() can also use GFP_KERNEL instead of GFP_ATOMIC.
Signed-off-by: Eric Dumazet
CC: Sjur Brændeland
Acked-by: Sjur Brændeland
Signed-off-by: David S. Miller -
Attempt to reduce the number of IP packets emitted in response to single
SCTP packet (2e3216cd) introduced a complication - if a packet contains
two COOKIE_ECHO chunks and nothing else then SCTP state machine corks the
socket while processing first COOKIE_ECHO and then loses the association
and forgets to uncork the socket. To deal with the issue add new SCTP
command which can be used to set association explictly. Use this new
command when processing second COOKIE_ECHO chunk to restore the context
for SCTP state machine.Signed-off-by: Max Matveev
Signed-off-by: David S. Miller -
The scan request received from cfg80211_connect do not
have proper rate mast. So the probe request sent on each
channel do not have proper the supported rates ie.Cc: stable@kernel.org
Reviewed-by: Johannes Berg
Signed-off-by: Rajkumar Manoharan
Signed-off-by: John W. Linville -
During the association, the regulatory is updated by country IE
that reaps the previously found beacons. The impact is that
after a STA disconnects *or* when for any reason a regulatory
domain change happens the beacon hint flag is not cleared
therefore preventing future beacon hints to be learned.
This is important as a regulatory domain change or a restore
of regulatory settings would set back the passive scan and no-ibss
flags on the channel. This is the right place to do this given that
it covers any regulatory domain change.Cc: stable@kernel.org
Reviewed-by: Luis R. Rodriguez
Signed-off-by: Rajkumar Manoharan
Acked-by: Luis R. Rodriguez
Signed-off-by: John W. Linville
16 Sep, 2011
8 commits
-
d88733150 introduced the IFF_SKB_TX_SHARING flag, which I unilaterally set in
ether_setup. In doing this I didn't realize that other flags (such as
IFF_XMIT_DST_RELEASE) might be set prior to calling the ether_setup routine.
This patch changes ether_setup to or in SKB_TX_SHARING so as not to
inadvertently clear other existing flags. Thanks to Pekka Riikonen for pointing
out my errorSigned-off-by: Neil Horman
Reported-by: Pekka Riikonen
CC: "David S. Miller"
Acked-by: Eric Dumazet
Signed-off-by: David S. Miller -
dev_forward_skb loops an skb back into host networking
stack which might hang on the memory indefinitely.
In particular, this can happen in macvtap in bridged mode.
Copy the userspace fragments to avoid blocking the
sender in that case.As this patch makes skb_copy_ubufs extern now,
I also added some documentation and made it clear
the SKBTX_DEV_ZEROCOPY flag automatically instead
of doing it in all callers. This can be made into a separate
patch if people feel it's worth it.Signed-off-by: Michael S. Tsirkin
Signed-off-by: David S. Miller -
flow_cache_lookup will return a cached object (or null pointer) that the
resolver (i.e. xfrm_policy_lookup) previously found for another namespace
using the same key/family/dir. Instead, make the namespace part of what
identifies entries in the cache.As before, flow_entry_valid will return 0 for entries where the namespace
has been deleted, and they will be removed from the cache the next time
flow_cache_gc_task is run.Reported-by: Andrew Dickinson
Signed-off-by: David Ward
Signed-off-by: David S. Miller -
This is important for SMP platform to check if timer function is
executing on other CPU with deleting the timer.Signed-off-by: Rajan Aggarwal
Acked-by: Oliver Hartkopp
Signed-off-by: David S. Miller -
"Possible SYN flooding on port xxxx " messages can fill logs on servers.
Change logic to log the message only once per listener, and add two new
SNMP counters to track :TCPReqQFullDoCookies : number of times a SYNCOOKIE was replied to client
TCPReqQFullDrop : number of times a SYN request was dropped because
syncookies were not enabled.Based on a prior patch from Tom Herbert, and suggestions from David.
Signed-off-by: Eric Dumazet
CC: Tom Herbert
Signed-off-by: David S. Miller -
File cls_rsvp.h in /net/sched was outdated. I'm sending you patch for this
file.[ tb[] array should be indexed by X not X-1 -DaveM ]
Signed-off-by: Igor Maravić
Signed-off-by: David S. Miller
15 Sep, 2011
1 commit
-
The checks for HCI_INQUIRY and HCI_MGMT were in the wrong order,
so that second scans always failed.Signed-off-by: Oliver Neukum
Signed-off-by: Gustavo F. Padovan
14 Sep, 2011
1 commit
-
Since my commit 34e895075e21be3e21e71d6317440d1ee7969ad0
("mac80211: allow station add/remove to sleep") there is
a race in mac80211 when it clears the TIM bit because a
sleeping station disconnected, the spinlock isn't held
around the relevant code any more. Use the right API to
acquire the spinlock correctly.Cc: stable@kernel.org [2.6.34+]
Signed-off-by: Johannes Berg
Signed-off-by: John W. Linville
10 Sep, 2011
1 commit
-
* 'for-linus' of git://ceph.newdream.net/git/ceph-client:
libceph: fix leak of osd structs during shutdown
ceph: fix memory leak
ceph: fix encoding of ino only (not relative) paths
libceph: fix msgpool
06 Sep, 2011
1 commit
-
With msize equal to 512K (PAGE_SIZE * VIRTQUEUE_NUM), we hit multiple
crashes. This patch fix those.Signed-off-by: Aneesh Kumar K.V
Signed-off-by: Eric Van Hensbergen
01 Sep, 2011
1 commit
-
We want to remove all OSDs, not just those on the idle LRU.
Signed-off-by: Sage Weil
31 Aug, 2011
3 commits
-
commit d0733d2e29b65 (Check for mistakenly passed in non-IPv4 address)
added regression on legacy apps that use bind() with AF_UNSPEC family.Relax the check, but make sure the bind() is done on INADDR_ANY
addresses, as AF_UNSPEC has probably no sane meaning for other
addresses.Bugzilla reference : https://bugzilla.kernel.org/show_bug.cgi?id=42012
Signed-off-by: Eric Dumazet
Reported-and-bisected-by: Rene Meier
CC: Marcus Meissner
Signed-off-by: David S. Miller -
Allow transparent sockets to be less restrictive about
the source ip of ipv6 udp packets being sent.Google-Bug-Id: 5018138
Signed-off-by: Maciej Żenczykowski
CC: "Erik Kline"
CC: "Lorenzo Colitti"
Signed-off-by: David S. Miller
30 Aug, 2011
4 commits
-
The wrong multiplication of TCPOLEN_TSTAMP_ALIGNED by 4 skips the fast path
for the timestamp-only option. Bug reported by Michael M. Builov (netfilter
bugzilla #738).Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
Michael M. Builov reported that in the tcp_options and tcp_sack functions
of netfilter TCP conntrack the incorrect handling of invalid TCP option
with too big opsize may lead to read access beyond tcp-packet or buffer
allocated on stack (netfilter bugzilla #738). The fix is to stop parsing
the options at detecting the broken option.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
When both the server and the client are NATed, the set-link-info control
packet containing the peer's call-id field is not properly translated.I have verified that it was working in 2.6.16.13 kernel previously but
due to rewrite, this scenario stopped working (Not knowing exact version
when it stopped working).Signed-off-by: Sanket Shah
Signed-off-by: Patrick McHardy -
A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.
This problem was previously fixed via
64507fdbc29c3a622180378210ecea8659b14e40 (netfilter:
nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
NF_STOLEN can also be returned by a netfilter hook when iterating the
rules in nf_reinject.Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.
This is complementary to commit fad54440438a7c231a6ae347738423cbabc936d9
(netfilter: avoid double free in nf_reinject).Cc: Julian Anastasov
Cc: Eric Dumazet
Signed-off-by: Florian Westphal
Signed-off-by: Patrick McHardy
27 Aug, 2011
1 commit
-
__netpoll_rx() doesnt properly handle skbs with small header
pskb_may_pull() or pskb_trim_rcsum() can change skb->data, we must
reload it.Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller
26 Aug, 2011
1 commit
-
…wireless into for-davem
25 Aug, 2011
3 commits
-
Dereferencing a user pointer directly from kernel-space without going
through the copy_from_user family of functions is a bad idea. Two of
such usages can be found in the sendmsg code path called from sendmmsg,
added bycommit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a upstream.
commit 5b47b8038f183b44d2d8ff1c7d11a5c1be706b34 in the 3.0-stable tree.Usages are performed through memcmp() and memcpy() directly. Fix those
by using the already copied msg_sys structure instead of the __user *msg
structure. Note that msg_sys can be set to NULL by verify_compat_iovec()
or verify_iovec(), which requires additional NULL pointer checks.Signed-off-by: Mathieu Desnoyers
Signed-off-by: David Goulet
CC: Tetsuo Handa
CC: Anton Blanchard
CC: David S. Miller
CC: stable
Signed-off-by: David S. Miller -
Dave Jones reported a lockdep splat triggered by an arp_process() call
from parp_redo().Commit faa9dcf793be (arp: RCU changes) is the origin of the bug, since
it assumed arp_process() was called under rcu_read_lock(), which is not
true in this particular path.Instead of adding rcu_read_lock() in parp_redo(), I chose to add it in
neigh_proxy_process() to take care of IPv6 side too.===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
include/linux/inetdevice.h:209 invoked rcu_dereference_check() without
protection!other info that might help us debug this:
rcu_scheduler_active = 1, debug_locks = 0
4 locks held by setfiles/2123:
#0: (&sb->s_type->i_mutex_key#13){+.+.+.}, at: []
walk_component+0x1ef/0x3e8
#1: (&isec->lock){+.+.+.}, at: []
inode_doinit_with_dentry+0x3f/0x41f
#2: (&tbl->proxy_timer){+.-...}, at: []
run_timer_softirq+0x157/0x372
#3: (class){+.-...}, at: [] neigh_proxy_process
+0x36/0x103stack backtrace:
Pid: 2123, comm: setfiles Tainted: G W
3.1.0-0.rc2.git7.2.fc16.x86_64 #1
Call Trace:
[] lockdep_rcu_dereference+0xa7/0xaf
[] __in_dev_get_rcu+0x55/0x5d
[] arp_process+0x25/0x4d7
[] parp_redo+0xe/0x10
[] neigh_proxy_process+0x9a/0x103
[] run_timer_softirq+0x218/0x372
[] ? run_timer_softirq+0x157/0x372
[] ? neigh_stat_seq_open+0x41/0x41
[] ? mark_held_locks+0x6d/0x95
[] __do_softirq+0x112/0x25a
[] call_softirq+0x1c/0x30
[] do_softirq+0x4b/0xa2
[] irq_exit+0x5d/0xcf
[] smp_apic_timer_interrupt+0x7c/0x8a
[] apic_timer_interrupt+0x73/0x80
[] ? trace_hardirqs_on_caller+0x121/0x158
[] ? __slab_free+0x30/0x24c
[] ? __slab_free+0x2e/0x24c
[] ? inode_doinit_with_dentry+0x2e9/0x41f
[] ? inode_doinit_with_dentry+0x2e9/0x41f
[] ? inode_doinit_with_dentry+0x2e9/0x41f
[] kfree+0x108/0x131
[] inode_doinit_with_dentry+0x2e9/0x41f
[] selinux_d_instantiate+0x1c/0x1e
[] security_d_instantiate+0x21/0x23
[] d_instantiate+0x5c/0x61
[] d_splice_alias+0xbc/0xd2
[] ext4_lookup+0xba/0xeb
[] d_alloc_and_lookup+0x45/0x6b
[] walk_component+0x215/0x3e8
[] lookup_last+0x3b/0x3d
[] path_lookupat+0x82/0x2af
[] ? might_fault+0xa5/0xac
[] ? might_fault+0x5c/0xac
[] ? getname_flags+0x31/0x1ca
[] do_path_lookup+0x28/0x97
[] user_path_at+0x59/0x96
[] ? cp_new_stat+0xf7/0x10d
[] vfs_fstatat+0x44/0x6e
[] vfs_lstat+0x1e/0x20
[] sys_newlstat+0x1a/0x33
[] ? trace_hardirqs_on_caller+0x121/0x158
[] ? trace_hardirqs_on_thunk+0x3a/0x3f
[] system_call_fastpath+0x16/0x1bReported-by: Dave Jones
Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller -
br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb
head can be reallocated.Cache icmp6_type field instead of dereferencing twice the struct
icmp6hdr pointer.Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller
