linux-stable.git/net/ipv4, branch linux-2.6.19.y

[PATCH] TCP: skb is unexpectedly freed.

2007-02-05T16:31:45+00:00

I encountered a kernel panic with my test program, which is a very
simple IPv6 client-server program.

The server side sets IPV6_RECVPKTINFO on a listening socket, and the
client side just sends a message to the server.  Then the kernel panic
occurs on the server.  (If you need the test program, please let me
know. I can provide it.)

This problem happens because a skb is forcibly freed in
tcp_rcv_state_process().

When a socket in listening state(TCP_LISTEN) receives a syn packet,
then tcp_v6_conn_request() will be called from
tcp_rcv_state_process().  If the tcp_v6_conn_request() successfully
returns, the skb would be discarded by __kfree_skb().

However, in case of a listening socket which was already set
IPV6_RECVPKTINFO, an address of the skb will be stored in
treq->pktopts and a ref count of the skb will be incremented in
tcp_v6_conn_request().  But, even if the skb is still in use, the skb
will be freed.  Then someone still using the freed skb will cause the
kernel panic.

I suggest to use kfree_skb() instead of __kfree_skb().

Signed-off-by: Masayuki Nakagawa 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] TCP: Fix sorting of SACK blocks.

2007-02-05T16:31:45+00:00

The sorting of SACK blocks actually munges them rather than sort,
causing the TCP stack to ignore some SACK information and breaking the
assumption of ordered SACK blocks after sorting.

The sort takes the data from a second buffer which isn't moved causing
subsequent data moves to occur from the wrong location. The fix is to
use a temporary buffer as a normal sort does.

Signed-off-By: Baruch Even 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] TCP: rare bad TCP checksum with 2.6.19

2007-02-05T16:31:45+00:00

The patch "Replace CHECKSUM_HW by CHECKSUM_PARTIAL/CHECKSUM_COMPLETE"
changed to unconditional copying of ip_summed field from collapsed
skb. This patch reverts this change.

The majority of substantial work including heavy testing
and diagnosing by: Michael Tokarev 
Possible reasons pointed by: Herbert Xu and Patrick McHardy.

Signed-off-by: Jarek Poplawski 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] IPV4: Fix single-entry /proc/net/fib_trie output.

2007-02-05T16:31:44+00:00

When main table is just a single leaf this gets printed as belonging to the
local table in /proc/net/fib_trie. A fix is below.

Signed-off-by: Robert Olsson 
Acked-by: Eric W. Biederman 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] IPV4: Fix the fib trie iterator to work with a single entry routing tables

2007-02-05T16:31:44+00:00

In a kernel with trie routing enabled I had a simple routing setup
with only a single route to the outside world and no default
route. "ip route table list main" showed my the route just fine but
/proc/net/route was an empty file.  What was going on?

Thinking it was a bug in something I did and I looked deeper.  Eventually
I setup a second route and everything looked correct, huh?  Finally I
realized that the it was just the iterator pair in fib_trie_get_first,
fib_trie_get_next just could not handle a routing table with a single entry.

So to save myself and others further confusion, here is a simple fix for
the fib proc iterator so it works even when there is only a single route
in a routing table.

Signed-off-by: Eric W. Biederman 
Signed-off-by: Robert Olsson 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ctnetlink: fix leak in ctnetlink_create_conntrack error path

2007-02-05T16:31:41+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ctnetlink: check for status attribute existence on conntrack creation

2007-02-05T16:31:41+00:00

Check that status flags are available in the netlink message received
to create a new conntrack.

Fixes a crash in ctnetlink_create_conntrack when the CTA_STATUS attribute
is not present.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: Fix routing of REJECT target generated packets in output chain

2007-02-05T16:31:39+00:00

Packets generated by the REJECT target in the output chain have a local
destination address and a foreign source address. Make sure not to use
the foreign source address for the output route lookup.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] IPV4/IPV6: Fix inet{,6} device initialization order.

2007-01-10T19:05:23+00:00

It is important that we only assign dev->ip{,6}_ptr
only after all portions of the inet{,6} are setup.

Otherwise we can receive packets before the multicast
spinlocks et al. are initialized.

Signed-off-by: David L Stevens 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] UDP: Fix reversed logic in udp_get_port()

2007-01-10T19:05:20+00:00

When this code was converted to use sk_for_each() the
logic for the "best hash chain length" code was reversed,
breaking everything.

The original code was of the form:

			size = 0;
			do {
				if (++size >= best_size_so_far)
					goto next;
			} while ((sk = sk->next) != NULL);
			best_size_so_far = size;
			best = result;
		next:;

and this got converted into:

			sk_for_each(sk2, node, head)
				if (++size < best_size_so_far) {
					best_size_so_far = size;
					best = result;
				}

Which does something very very different from the original.

Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright