linux-stable.git/net/bridge, branch linux-2.6.17.y

bridge-netfilter: don't overwrite memory outside of skb

2006-09-08T21:51:37+00:00

The bridge netfilter code needs to check for space at the
front of the skb before overwriting; otherwise if skb from
device doesn't have headroom, then it will cause random
memory corruption.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Greg Kroah-Hartman

ulog: fix panic on SMP kernels

2006-08-23T21:13:31+00:00

[NETFILTER]: ulog: fix panic on SMP kernels

Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: Mark Huang 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

[BRIDGE]: fix locking and memory leak in br_add_bridge

2006-06-05T23:39:34+00:00

There are several bugs in error handling in br_add_bridge:
- when dev_alloc_name fails, allocated net_device is not freed
- unregister_netdev is called when rtnl lock is held
- free_netdev is called before netdev_run_todo has a chance to be run after
  unregistering net_device

Signed-off-by: Jiri Benc 
Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[BRIDGE]: need to ref count the LLC sap

2006-05-23T22:20:25+00:00

Bridge will OOPS on removal if other application has the SAP open.
The bridge SAP might be shared with other usages, so need
to do reference counting on module removal rather than explicit
close/delete.

Since packet might arrive after or during removal, need to clear
the receive function handle, so LLC only hands it to user (if any).

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[NETFILTER]: fix format specifier for netfilter log targets

2006-05-19T09:15:47+00:00

The prefix argument for nf_log_packet is a format specifier,
so don't pass the user defined string directly to it.

Signed-off-by: Philip Craig 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[BRIDGE]: Do sysfs registration inside rtnl.

2006-05-10T20:21:53+00:00

Now that netdevice sysfs registration is done as part of
register_netdevice; bridge code no longer has to be tricky when adding
it's kobjects to bridges.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[BRIDGE]: keep track of received multicast packets

2006-05-06T00:07:13+00:00

It makes sense to add this simple statistic to keep track of received
multicast packets.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[BRIDGE]: allow full size vlan packets

2006-04-26T09:39:19+00:00

Need to allow for VLAN header when bridging.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[EBTABLES]: Clean up vmalloc usage in net/bridge/netfilter/ebtables.c

2006-04-20T07:14:49+00:00

Make all the vmalloc calls in net/bridge/netfilter/ebtables.c follow
the standard convention.  Remove unnecessary casts, and use '*object'
instead of 'type'.

Signed-off-by: Jayachandran C. 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

[BRIDGE] ebtables: fix allocation in net/bridge/netfilter/ebtables.c

2006-04-12T00:25:38+00:00

Allocate an array of 'struct ebt_chainstack *', the current code allocates
array of 'struct ebt_chainstack'.

akpm: converted to use the

	foo = alloc(sizeof(*foo))

form.  Which would have prevented this from happening in the first place.

akpm: also removed unneeded typecast.

akpm: what on earth is this code doing anyway?  cpu_possible_map can be
sparse..

Signed-off-by: Jayachandran C. 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller