linux-stable.git/net/bridge, branch linux-2.6.18.y

[PATCH] EBTABLES: Prevent wraparounds in checks for entry components' sizes.

2006-12-17T00:20:46+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] EBTABLES: Deal with the worst-case behaviour in loop checks.

2006-12-17T00:20:46+00:00

No need to revisit a chain we'd already finished with during
the check for current hook.  It's either instant loop (which
we'd just detected) or a duplicate work.

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] EBTABLES: Verify that ebt_entries have zero ->distinguisher.

2006-12-17T00:20:46+00:00

We need that for iterator to work; existing check had been too weak.

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] EBTABLES: Fix wraparounds in ebt_entries verification.

2006-12-17T00:20:46+00:00

We need to verify that
	a) we are not too close to the end of buffer to dereference
	b) next entry we'll be checking won't be _before_ our

While we are at it, don't subtract unrelated pointers...

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] bridge: fix possible overflow in get_fdb_entries (CVE-2006-5751)

2006-11-29T19:28:24+00:00

Make sure to properly clamp maxnum to avoid overflow (CVE-2006-5751).

Signed-off-by: Chris Wright 
Acked-by: Eugene Teo 
Acked-by: Marcel Holtmann 
Signed-off-by: Linus Torvalds

[BRIDGE]: random extra bytes on STP TCN packet

2006-09-18T06:21:08+00:00

We seem to send 3 extra bytes in a TCN, which will be whatever happens
to be on the stack. Thanks to Aji_Srinivas@emc.com for seeing.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[BRIDGE] netfilter: memory corruption fix

2006-08-27T03:28:30+00:00

The bridge-netfilter code will overwrite memory if there is not
headroom in the skb to save the header.  This first showed up when
using Xen with sky2 driver that doesn't allocate the extra space.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[BRIDGE]: Disable SG/GSO if TX checksum is off

2006-08-18T01:22:32+00:00

When the bridge recomputes features, it does not maintain the
constraint that SG/GSO must be off if TX checksum is off.
This patch adds that constraint.

On a completely unrelated note, I've also added TSO6 and TSO_ECN
feature bits if GSO is enabled on the underlying device through
the new NETIF_F_GSO_SOFTWARE macro.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NETFILTER]: ulog: fix panic on SMP kernels

2006-08-14T01:57:54+00:00

Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: Mark Huang 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[BRIDGE]: netlink status fix

2006-08-05T05:59:48+00:00

Fix code that passes back netlink status messages about
bridge changes. Submitted by Aji_Srinivas@emc.com

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller