linux-stable.git/net/ipv6, branch linux-2.6.17.y

IPV6 OOPS'er triggerable by any user

2006-09-08T21:51:38+00:00

[IPV6]: Fix kernel OOPs when setting sticky socket options.

Bug noticed by Remi Denis-Courmont .

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Fix output framentation of paged-skbs

2006-09-08T21:51:36+00:00

[INET]: Use pskb_trim_unique when trimming paged unique skbs

The IPv4/IPv6 datagram output path was using skb_trim to trim paged
packets because they know that the packet has not been cloned yet
(since the packet hasn't been given to anything else in the system).

This broke because skb_trim no longer allows paged packets to be
trimmed.  Paged packets must be given to one of the pskb_trim functions
instead.

This patch adds a new pskb_trim_unique function to cover the IPv4/IPv6
datagram output path scenario and replaces the corresponding skb_trim
calls with it.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] IPV6 ADDRCONF: Fix default source address selection without CONFIG_IPV6_PRIVACY

2006-06-30T00:17:16+00:00

We need to update hiscore.rule even if we don't enable CONFIG_IPV6_PRIVACY,
because we have more less significant rule; longest match.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] IPV6: Fix source address selection.

2006-06-30T00:17:16+00:00

Two additional labels (RFC 3484, sec. 10.3) for IPv6 addreses
are defined to make a distinction between global unicast
addresses and Unique Local Addresses (fc00::/7, RFC 4193) and
Teredo (2001::/32, RFC 4380). It is necessary to avoid attempts
of connection that would either fail (eg. fec0:: to 2001:feed::)
or be sub-optimal (2001:0:: to 2001:feed::).

Signed-off-by: Łukasz Stelmach 
Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] IPV6: Sum real space for RTAs.

2006-06-30T00:17:14+00:00

This patch fixes RTNLGRP_IPV6_IFINFO netlink notifications.  Issue
pointed out by Patrick McHardy .

Signed-off-by: YOSHIFUJI Hideaki 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[IPV6] ROUTE: Don't try less preferred routes for on-link routes.

2006-05-26T20:23:41+00:00

In addition to the real on-link routes, NONEXTHOP routes
should be considered on-link.

Problem reported by Meelis Roos .

Signed-off-by: YOSHIFUJI Hideaki 
Acked-by: Meelis Roos 
Signed-off-by: David S. Miller

[NET]: Fix "ntohl(ntohs" bugs

2006-05-22T23:53:22+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

[NETFILTER]: Fix do_add_counters race, possible oops or info leak (CVE-2006-0039)

2006-05-19T09:16:52+00:00

Solar Designer found a race condition in do_add_counters(). The beginning
of paddc is supposed to be the same as tmp which was sanity-checked
above, but it might not be the same in reality. In case the integer
overflow and/or the race condition are triggered, paddc->num_counters
might not match the allocation size for paddc. If the check below
(t->private->number != paddc->num_counters) nevertheless passes (perhaps
this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
would read kernel memory beyond the allocation size, potentially causing
an oops or leaking sensitive data (e.g., passwords from host system or
from another VPS) via counter increments. This requires CAP_NET_ADMIN.

Signed-off-by: Solar Designer 
Signed-off-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: fix format specifier for netfilter log targets

2006-05-19T09:15:47+00:00

The prefix argument for nf_log_packet is a format specifier,
so don't pass the user defined string directly to it.

Signed-off-by: Philip Craig 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[IPV6]: Endian fix in net/ipv6/netfilter/ip6t_eui64.c:match().

2006-05-16T22:24:41+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller