26 Aug, 2008
3 commits
-
Braino: net.ipv6 in ipv6 skeleton has no business in rotable
classSigned-off-by: Al Viro
Signed-off-by: David S. Miller -
net.ipv4.neigh should be a part of skeleton to avoid ordering problems
Signed-off-by: Al Viro
Signed-off-by: David S. Miller -
The structure used for SCTP_AUTH_KEY option contains a
length that needs to be verfied to prevent buffer overflow
conditions. Spoted by Eugene Teo .Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller
23 Aug, 2008
2 commits
-
This fixes a problem spotted with zebra, but not sure if it is
necessary a kernel problem. With IPV6 when an address is added to an
interface, Zebra creates a duplicate RIB entry, one as a connected
route, and other as a kernel route.When an address is added to an interface the RTN_NEWADDR message
causes Zebra to create a connected route. In IPV4 when an address is
added to an interface a RTN_NEWROUTE message is set to user space with
the protocol RTPROT_KERNEL. Zebra ignores these messages, because it
already has the connected route.The problem is that route created in IPV6 has route protocol ==
RTPROT_BOOT. Was this a design decision or a bug? This fixes it. Same
patch applies to both net-2.6 and stable.Signed-off-by: Stephen Hemminger
Signed-off-by: David S. Miller -
Pass namespace into icmp_xmit_lock, obtain socket inside and return
it as a result for caller.Thanks Alexey Dobryan for this report:
Steps to reproduce:
CONFIG_PREEMPT=y
CONFIG_DEBUG_PREEMPT=y
tracepathBUG: using smp_processor_id() in preemptible [00000000] code: tracepath/3205
caller is icmp_sk+0x15/0x30
Pid: 3205, comm: tracepath Not tainted 2.6.27-rc4 #1Call Trace:
[] debug_smp_processor_id+0xe4/0xf0
[] icmp_sk+0x15/0x30
[] icmp_send+0x4b/0x3f0
[] ? trace_hardirqs_on_caller+0xd5/0x160
[] ? trace_hardirqs_on+0xd/0x10
[] ? local_bh_enable_ip+0x95/0x110
[] ? _spin_unlock_bh+0x39/0x40
[] ? mark_held_locks+0x4c/0x90
[] ? trace_hardirqs_on+0xd/0x10
[] ? trace_hardirqs_on_caller+0xd5/0x160
[] ip_fragment+0x8d4/0x900
[] ? ip_finish_output2+0x0/0x290
[] ? ip_finish_output+0x0/0x60
[] ? dst_output+0x0/0x10
[] ip_finish_output+0x4c/0x60
[] ip_output+0xa3/0xf0
[] ip_local_out+0x20/0x30
[] ip_push_pending_frames+0x27f/0x400
[] udp_push_pending_frames+0x233/0x3d0
[] udp_sendmsg+0x321/0x6f0
[] inet_sendmsg+0x45/0x80
[] sock_sendmsg+0xdf/0x110
[] ? autoremove_wake_function+0x0/0x40
[] ? validate_chain+0x415/0x1010
[] ? __do_fault+0x140/0x450
[] ? __lock_acquire+0x260/0x590
[] ? sockfd_lookup_light+0x45/0x80
[] sys_sendto+0xea/0x120
[] ? _spin_unlock_irqrestore+0x42/0x80
[] ? __up_read+0x4c/0xb0
[] ? up_read+0x26/0x30
[] system_call_fastpath+0x16/0x1bicmp6_sk() is similar.
Signed-off-by: Denis V. Lunev
Signed-off-by: David S. Miller
22 Aug, 2008
1 commit
-
Since some qdiscs call qdisc_tree_decrease_qlen() (so qdisc_lookup())
without rtnl_lock(), adding and deleting from a qdisc list needs
additional locking. This patch adds global spinlock qdisc_list_lock
and wrapper functions for modifying the list. It is considered as a
temporary solution until hfsc_dequeue(), netem_dequeue() and
tbf_dequeue() (or qdisc_tree_decrease_qlen()) are redone.With feedback from Herbert Xu and David S. Miller.
Signed-off-by: Jarek Poplawski
Acked-by: Herbert Xu
Signed-off-by: David S. Miller
21 Aug, 2008
2 commits
-
dev_deactivate() can skip rescheduling of a qdisc by qdisc_watchdog()
or other timer calling netif_schedule() after dev_queue_deactivate().
We prevent this checking aliveness before scheduling the timer. Since
during deactivation the root qdisc is available only as qdisc_sleeping
additional accessor qdisc_root_sleeping() is created.With feedback from Herbert Xu
Signed-off-by: Jarek Poplawski
Signed-off-by: David S. Miller -
All of the SCTP-AUTH socket options could cause a panic
if the extension is disabled and the API is envoked.Additionally, there were some additional assumptions that
certain pointers would always be valid which may not
always be the case.This patch hardens the API and address all of the crash
scenarios.Signed-off-by: Vlad Yasevich
Signed-off-by: David S. Miller
19 Aug, 2008
15 commits
-
If dev_deactivate() is trying to quiesce the queue, it
is theoretically possible for another cpu to livelock
trying to process that queue. This happens because
dev_deactivate() grabs the queue spinlock as it checks
the queue state, whereas net_tx_action() does a trylock
and reschedules the qdisc if it hits the lock.This breaks the livelock by adding a check on
__QDISC_STATE_DEACTIVATED to net_tx_action() when
the trylock fails.Based upon feedback from Herbert Xu and Jarek Poplawski.
Signed-off-by: David S. Miller
-
This reverts commit 1cfa26661a85549063e369e2b40275eeaa7b923c.
qdisc_destroy() runs fully under RTNL again and not from softint any
longer, so this change is no longer needed.Signed-off-by: David S. Miller
-
This reverts commit d4766692e72422f3b0f0e9ac6773d92baad07d51.
qdisc_destroy() now runs in RTNL fully again, so this
change is no longer needed.Signed-off-by: David S. Miller
-
...Last block local var got just deleted.
Signed-off-by: Ilpo Järvinen
Signed-off-by: David S. Miller -
Use incoming network tuple as seed for NAT port randomization.
This avoids concerns of leaking net_random() bits, and also gives better
port distribution. Don't have NAT server, compile tested only.Signed-off-by: Stephen Hemminger
[ added missing EXPORT_SYMBOL_GPL ]
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
This patch removes a GFP_KERNEL allocation while holding a spin lock with
bottom halves disabled in ctnetlink_change_helper().This problem was introduced in 2.6.23 with the netfilter extension
infrastructure.Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Fix allocation with GFP_KERNEL in ctnetlink_create_conntrack() under
read-side lock sections.This problem was introduced in 2.6.25.
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
If we create a conntrack that has NAT handlings and a helper, the helper
is assigned twice. This happens because nf_nat_setup_info() - via
nf_conntrack_alter_reply() - sets the helper before ctnetlink, which
indeed does not check if the conntrack already has a helper as it thinks that
it is a brand new conntrack.The fix moves the helper assignation before the set of the status flags.
This avoids a bogus assertion in __nf_ct_ext_add (if netfilter assertions are
enabled) which checks that the conntrack must not be confirmed.This problem was introduced in 2.6.23 with the netfilter extension
infrastructure.Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Patrick McHardy -
This patch fixes matching of inverted destination address type.
Signed-off-by: Anders Grafström
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
Thanks is due to Wei Yongjun for the detailed analysis and description of this
bug at http://marc.info/?l=dccp&m=121739364909199&w=2The problem is that invalid packets received by a client in state REQUEST cause
the retransmission timer for the DCCP-Request to be reset. This includes freeing
the Request-skb ( in dccp_rcv_request_sent_state_process() ). As a consequence,
* the arrival of further packets cause a double-free, triggering a panic(),
* the connection then may hang, since further retransmissions are blocked.This patch changes the order of statements so that the retransmission timer is
reset, and the pending Request freed, only if a valid Response has arrived (or
the number of sysctl-retries has been exhausted).Further changes:
----------------
To be on the safe side, replaced __kfree_skb with kfree_skb so that if due to
unexpected circumstances the sk_send_head is NULL the WARN_ON is used instead.Signed-off-by: Gerrit Renker
Signed-off-by: David S. Miller -
Based upon reports by Denys Fedoryshchenko, and feedback
and help from Jarek Poplawski and Herbert Xu.We always either:
1) Never made an external reference to this qdisc.
or
2) Did a dev_deactivate() which purged all asynchronous
references.So do not lock the qdisc when we call qdisc_destroy(),
it's illegal anyways as when we drop the lock this is
free'd memory.Signed-off-by: David S. Miller
-
Qdisc locks are initialized in the same function, qdisc_alloc(), so
lockdep can't distinguish tx qdisc lock from rx and reports "possible
recursive locking detected" when both these locks are taken eg. while
using act_mirred with ifb. This looks like a false positive. Anyway,
after this patch these locks will be reported more exactly.Reported-by: Denys Fedoryshchenko
Signed-off-by: Jarek Poplawski
Signed-off-by: David S. Miller -
Based upon initial discovery and patch by Jarek Poplawski.
The qdisc watchdogs can be attached to any qdisc, not just the root,
so make sure we schedule the correct one.CBQ has a similar bug.
Signed-off-by: David S. Miller
18 Aug, 2008
14 commits
-
This patch fixes needless probe request caused by zero value in
sta->last_rx inside ieee80211_associated flowSigned-off-by: Ron Rindjunsky
Signed-off-by: Tomas Winkler
Signed-off-by: John W. Linville -
Guard rfkill controllers attached to a rfkill class against state changes
after class suspend has been issued.Signed-off-by: Henrique de Moraes Holschuh
Acked-by: Ivo van Doorn
Signed-off-by: John W. Linville -
The Bluetooth entries for the MAINTAINERS file are a little bit too
much. Consolidate them into two entries. One for Bluetooth drivers and
another one for the Bluetooth subsystem.Also the MODULE_AUTHOR should indicate the current maintainer of the
module and actually not the original author. Fix all Bluetooth modules
to provide current maintainer information.Signed-off-by: Marcel Holtmann
-
The Bluetooth adapters and connections are best presented via a class
in sysfs. The removal of the links inside the Bluetooth class broke
assumptions by userspace programs on how to find attached adapters.This patch creates adapters and connections as part of the Bluetooth
class, but it uses different device types to distinguish them. The
userspace programs can now easily navigate in the sysfs device tree.The unused platform device and bus have been removed to keep the
code simple and clean.Signed-off-by: Marcel Holtmann
-
Based upon a bug report by Josip Rodin.
Packet schedulers should only return NET_XMIT_DROP iff
the packet really was dropped. If the packet does reach
the device after we return NET_XMIT_DROP then TCP can
crash because it depends upon the enqueue path return
values being accurate.Signed-off-by: David S. Miller
-
Noticed by Jarek Poplawski.
Signed-off-by: David S. Miller
-
When get receiving interface index while no message is received,
the bounded device's index of the socket should be returned.RFC 3542:
Issuing getsockopt() for the above options will return the sticky
option value i.e., the value set with setsockopt(). If no sticky
option value has been set getsockopt() will return the following
values:- For the IPV6_PKTINFO option, it will return an in6_pktinfo
structure with ipi6_addr being in6addr_any and ipi6_ifindex being
zero.Signed-off-by: Yang Hongyang
Signed-off-by: David S. Miller -
Signed-off-by: David S. Miller
-
Use return value from inner qdisc requeue when value returned isn't
NET_XMIT_SUCCESS, instead of always returning NET_XMIT_DROP.Signed-off-by: Jussi Kivilinna
Signed-off-by: David S. Miller -
We can now kill them synchronously with all of the
previous dev_deactivate() cures.This makes netdev destruction and shutdown saner as
the qdiscs hold references to the device.Signed-off-by: David S. Miller
-
From: Jarek Poplawski
When we are destroying non-root qdiscs, we need to lock
the root of the qdisc tree not the the qdisc itself.Signed-off-by: David S. Miller
-
The condition under which the previous qdisc has no more references
after we've attached &noop_qdisc is that both RUNNING and SCHED
are both seen clear while holding the root lock.So just make specifically that check in the polling loop, instead
of this overly complex "check without then check with lock held"
sequence.Signed-off-by: David S. Miller
-
Change handling of the __QDISC_STATE_SCHED flag in net_tx_action() to
enable proper control in dev_deactivate(). Now, if this flag is seen
as unset under root_lock means a qdisc can't be netif_scheduled.Signed-off-by: Jarek Poplawski
Signed-off-by: David S. Miller -
This new state lets dev_deactivate() mark a qdisc as having been
deactivated.dev_queue_xmit() and ing_filter() check for this bit and do not
try to process the qdisc if the bit is set.dev_deactivate() polls the qdisc after setting the bit, waiting
for both __QDISC_STATE_RUNNING and __QDISC_STATE_SCHED to clear.This isn't perfect yet, but subsequent changesets will make it so.
This part is just one piece of the puzzle.Signed-off-by: David S. Miller
16 Aug, 2008
3 commits
-
There's an skb_copy_datagram_iovec() to copy out of a paged skb, but
nothing the other way around (because we don't do that).We want to allocate big skbs in tun.c, so let's add the function.
It's a carbon copy of skb_copy_datagram_iovec() with enough changes to
be annoying.Signed-off-by: Rusty Russell
Signed-off-by: David S. Miller -
skb_gso_segment didn't preserve some attributes in the original skb
such as the netfilter fields. This was harmless until they were used
which is the case for packets going through lo.This patch makes it call __copy_skb_header which also picks up some
other missing attributes.Signed-off-by: Herbert Xu
Signed-off-by: David S. Miller -
Add more ethtool generic operations to dump the bridge offload
settings.Signed-off-by: Stephen Hemminger
Signed-off-by: David S. Miller
