linux-stable.git/net/ipv6, branch v3.1.7

ah: Read nexthdr value before overwriting it in ahash input callback.

2011-12-09T16:55:57+00:00

[ Upstream commit b7ea81a58adc123a4e980cb0eff9eb5c144b5dc7 ]

The AH4/6 ahash input callbacks read out the nexthdr field from the AH
header *after* they overwrite that header.  This is obviously not going
to end well.  Fix it up.

Signed-off-by: Nick Bowler 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ah: Correctly pass error codes in ahash output callback.

2011-12-09T16:55:57+00:00

[ Upstream commit 069294e813ed5f27f82613b027609bcda5f1b914 ]

The AH4/6 ahash output callbacks pass nexthdr to xfrm_output_resume
instead of the error code.  This appears to be a copy+paste error from
the input case, where nexthdr is expected.  This causes the driver to
continuously add AH headers to the datagram until either an allocation
fails and the packet is dropped or the ahash driver hits a synchronous
fallback and the resulting monstrosity is transmitted.

Correct this issue by simply passing the error code unadulterated.

Signed-off-by: Nick Bowler 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ip6_tunnel: copy parms.name after register_netdevice

2011-11-26T17:08:34+00:00

commit 731abb9cb27aef6013ce60808a04e04a545f3f4e upstream.

Commit 1c5cae815d removed an explicit call to dev_alloc_name in ip6_tnl_create
because register_netdevice will now create a valid name.  This works for the
net_device itself.

However the tunnel keeps a copy of the name in the parms structure for the
ip6_tnl associated with the tunnel.  parms.name is set by copying the net_device
name in ip6_tnl_dev_init_gen.  That function is called from ip6_tnl_dev_init in
ip6_tnl_create, but it is done before register_netdevice is called so the name
is set to a bogus value in the parms.name structure.

This shows up if you do a simple tunnel add, followed by a tunnel show:

[root@localhost ~]# ip -6 tunnel add remote fec0::100 local fec0::200
[root@localhost ~]# ip -6 tunnel show
ip6tnl0: ipv6/ipv6 remote :: local :: encaplimit 0 hoplimit 0 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
ip6tnl%d: ipv6/ipv6 remote fec0::100 local fec0::200 encaplimit 4 hoplimit 64 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
[root@localhost ~]#

Fix this by moving the strcpy out of ip6_tnl_dev_init_gen, and calling it after
register_netdevice has successfully returned.

Signed-off-by: Josh Boyer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ipv6: fix route error binding peer in func icmp6_dst_alloc

2011-11-11T17:43:39+00:00

[ Upstream commit 7011687f0f2f12cc348f6a693fafe63d89167eac ]

in func icmp6_dst_alloc,dst_metric_set call ipv6_cow_metrics to set metric.
ipv6_cow_metrics may will call rt6_bind_peer to set rt6_info->rt6i_peer.
So,we should move ipv6_addr_copy before dst_metric_set to make sure rt6_bind_peer success.

Signed-off-by: Gao feng 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

gro: refetch inet6_protos[] after pulling ext headers

2011-10-10T18:26:16+00:00

ipv6_gro_receive() doesn't update the protocol ops after pulling
the ext headers. It looks like a typo.

Signed-off-by: Zheng Yan 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

tcp: properly handle md5sig_pool references

2011-10-05T03:31:24+00:00

tcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers
only hold one reference to md5sig_pool. but tcp_v4_md5_do_add()
increases use count of md5sig_pool for each peer. This patch
makes tcp_v4_md5_do_add() only increases use count for the first
tcp md5sig peer.

Signed-off-by: Zheng Yan 
Signed-off-by: David S. Miller

ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket

2011-09-29T04:32:10+00:00

ipv6_ac_list and ipv6_fl_list from listening socket are inadvertently
shared with new socket created for connection.

Signed-off-by: Zheng Yan 
Signed-off-by: David S. Miller

ipv6-multicast: Fix memory leak in IPv6 multicast.

2011-09-27T19:34:00+00:00

If reg_vif_xmit cannot find a routing entry, be sure to
free the skb before returning the error.

Signed-off-by: Ben Greear 
Signed-off-by: David S. Miller

ipv6: check return value for dst_alloc

2011-09-27T19:32:06+00:00

return value of dst_alloc must be checked before use

Signed-off-by: Madalin Bucur 
Signed-off-by: David S. Miller

ipv6-multicast: Fix memory leak in input path.

2011-09-27T19:16:08+00:00

Have to free the skb before returning if we fail
the fib lookup.

Signed-off-by: Ben Greear 
Signed-off-by: David S. Miller