linux-stable.git/net/ipv6/ip6_output.c, branch linux-3.3.y

ipv6: fix incorrent ipv6 ipsec packet fragment

2012-04-02T17:32:22+00:00

[ Upstream commit 1f85851e17b64cabd089a8a8839dddebc627948c ]

Since commit 299b0767(ipv6: Fix IPsec slowpath fragmentation problem)
In func ip6_append_data,after call skb_put(skb, fraglen + dst_exthdrlen)
the skb->len contains dst_exthdrlen,and we don't reduce dst_exthdrlen at last
This will make fraggap>0 in next "while cycle",and cause the size of skb incorrent

Fix this by reserve headroom for dst_exthdrlen.

Signed-off-by: Gao feng 
Acked-by: Steffen Klassert 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2011-12-23T22:13:56+00:00

Conflicts:
	net/bluetooth/l2cap_core.c

Just two overlapping changes, one added an initialization of
a local variable, and another change added a new local variable.

Signed-off-by: David S. Miller

net: introduce DST_NOPEER dst flag

2011-12-23T03:34:56+00:00

Chris Boot reported crashes occurring in ipv6_select_ident().

[  461.457562] RIP: 0010:[]  []
ipv6_select_ident+0x31/0xa7

[  461.578229] Call Trace:
[  461.580742] 
[  461.582870]  [] ? udp6_ufo_fragment+0x124/0x1a2
[  461.589054]  [] ? ipv6_gso_segment+0xc0/0x155
[  461.595140]  [] ? skb_gso_segment+0x208/0x28b
[  461.601198]  [] ? ipv6_confirm+0x146/0x15e
[nf_conntrack_ipv6]
[  461.608786]  [] ? nf_iterate+0x41/0x77
[  461.614227]  [] ? dev_hard_start_xmit+0x357/0x543
[  461.620659]  [] ? nf_hook_slow+0x73/0x111
[  461.626440]  [] ? br_parse_ip_options+0x19a/0x19a
[bridge]
[  461.633581]  [] ? dev_queue_xmit+0x3af/0x459
[  461.639577]  [] ? br_dev_queue_push_xmit+0x72/0x76
[bridge]
[  461.646887]  [] ? br_nf_post_routing+0x17d/0x18f
[bridge]
[  461.653997]  [] ? nf_iterate+0x41/0x77
[  461.659473]  [] ? br_flood+0xfa/0xfa [bridge]
[  461.665485]  [] ? nf_hook_slow+0x73/0x111
[  461.671234]  [] ? br_flood+0xfa/0xfa [bridge]
[  461.677299]  [] ?
nf_bridge_update_protocol+0x20/0x20 [bridge]
[  461.684891]  [] ? nf_ct_zone+0xa/0x17 [nf_conntrack]
[  461.691520]  [] ? br_flood+0xfa/0xfa [bridge]
[  461.697572]  [] ? NF_HOOK.constprop.8+0x3c/0x56
[bridge]
[  461.704616]  [] ?
nf_bridge_push_encap_header+0x1c/0x26 [bridge]
[  461.712329]  [] ? br_nf_forward_finish+0x8a/0x95
[bridge]
[  461.719490]  [] ?
nf_bridge_pull_encap_header+0x1c/0x27 [bridge]
[  461.727223]  [] ? br_nf_forward_ip+0x1c0/0x1d4 [bridge]
[  461.734292]  [] ? nf_iterate+0x41/0x77
[  461.739758]  [] ? __br_deliver+0xa0/0xa0 [bridge]
[  461.746203]  [] ? nf_hook_slow+0x73/0x111
[  461.751950]  [] ? __br_deliver+0xa0/0xa0 [bridge]
[  461.758378]  [] ? NF_HOOK.constprop.4+0x56/0x56
[bridge]

This is caused by bridge netfilter special dst_entry (fake_rtable), a
special shared entry, where attaching an inetpeer makes no sense.

Problem is present since commit 87c48fa3b46 (ipv6: make fragment
identifications less predictable)

Introduce DST_NOPEER dst flag and make sure ipv6_select_ident() and
__ip_select_ident() fallback to the 'no peer attached' handling.

Reported-by: Chris Boot 
Tested-by: Chris Boot 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Rename dst_get_neighbour{, _raw} to dst_get_neighbour_noref{, _raw}.

2011-12-05T20:20:19+00:00

To reflect the fact that a refrence is not obtained to the
resulting neighbour entry.

Signed-off-by: David S. Miller 
Acked-by: Roland Dreier

ipv6: Add fragment reporting to ipv6_skip_exthdr().

2011-12-03T17:35:10+00:00

While parsing through IPv6 extension headers, fragment headers are
skipped making them invisible to the caller.  This reports the
fragment offset of the last header in order to make it possible to
determine whether the packet is fragmented and, if so whether it is
a first or last fragment.

Signed-off-by: Jesse Gross

net: remove ipv6_addr_copy()

2011-11-22T21:43:32+00:00

C assignment can handle struct in6_addr copying.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

ipv6: Remove all uses of LL_ALLOCATED_SPACE

2011-11-18T19:37:09+00:00

ipv6: Remove all uses of LL_ALLOCATED_SPACE

The macro LL_ALLOCATED_SPACE was ill-conceived.  It applies the
alignment to the sum of needed_headroom and needed_tailroom.  As
the amount that is then reserved for head room is needed_headroom
with alignment, this means that the tail room left may be too small.

This patch replaces all uses of LL_ALLOCATED_SPACE in net/ipv6
with the macro LL_RESERVED_SPACE and direct reference to
needed_tailroom.

This also fixes the problem with needed_headroom changing between
allocating the skb and reserving the head room.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

ipv6: fix error propagation in ip6_ufo_append_data()

2011-10-28T04:26:00+00:00

We should return errcode from sock_alloc_send_skb()

Signed-off-by: Zheng Yan 
Signed-off-by: David S. Miller

ipv6: tcp: fix TCLASS value in ACK messages sent from TIME_WAIT

2011-10-27T04:44:35+00:00

commit 66b13d99d96a (ipv4: tcp: fix TOS value in ACK messages sent from
TIME_WAIT) fixed IPv4 only.

This part is for the IPv6 side, adding a tclass param to ip6_xmit()

We alias tw_tclass and tw_tos, if socket family is INET6.

[ if sockets is ipv4-mapped, only IP_TOS socket option is used to fill
TOS field, TCLASS is not taken into account ]

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: add skb frag size accessors

2011-10-19T07:10:46+00:00

To ease skb->truesize sanitization, its better to be able to localize
all references to skb frags size.

Define accessors : skb_frag_size() to fetch frag size, and
skb_frag_size_{set|add|sub}() to manipulate it.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller