linux-stable.git/net, branch linux-2.6.11.y

[PATCH] netem: duplication fix

2005-06-12T02:45:27+00:00

Netem duplication can cause infinite loop in qdisc_run
because the qlen of the parent qdisc is not affected by the duplication.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] prevent bad forwarding table updates

2005-06-12T02:45:26+00:00

Avoid poisoning of the bridge forwarding table by frames that have been
dropped by filtering. This prevents spoofed source addresses on hostile
side of bridge from causing packet leakage, a small but possible security
risk.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix deadlock with ip_queue and tcp local input path.

2005-06-12T02:45:22+00:00

When we have ip_queue being used from LOCAL_IN, then we end up with a
situation where the verdicts coming back from userspace traverse the TCP
input path from syscall context.  While this seems to work most of the
time, there's an ugly deadlock:

syscall context is interrupted by the timer interrupt.  When the timer
interrupt leaves, the timer softirq get's scheduled and calls
tcp_delack_timer() and alike.  They themselves do bh_lock_sock(sk),
which is already held from somewhere else -> boom.

I've now tested the suggested solution by Patrick McHardy and Herbert Xu to
simply use local_bh_{en,dis}able().

Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix minor security hole

2005-05-27T04:20:06+00:00

ROSE wasn't verifying the ndigis argument of a new route resulting in a
minor security hole.

Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Chris Wright

[PATCH] Fix smp race.

2005-05-27T04:20:02+00:00

The patch below fixes an smp race that happens on such systems under
heavy load.
This bug was reported and solved by Steve Herrell


Signed-off-by: Bart De Schuymer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Chris Wright

[PATCH] Fix BIC congestion avoidance algorithm error

2005-05-12T17:00:20+00:00

Since BIC is the default congestion control algorithm
enabled in every 2.6.x kernel out there, fixing errors
in it becomes quite critical.

A flaw in the loss handling caused it to not perform
the binary search regimen of the BIC algorithm
properly.

The fix below from Stephen Hemminger has been heavily
verified.

[TCP]: BIC not binary searching correctly

While redoing BIC for the split up version, I discovered that the existing
2.6.11 code doesn't really do binary search. It ends up being just a slightly
modified version of Reno.  See attached graphs to see the effect over simulated
1mbit environment.

The problem is that BIC is supposed to reset the cwnd to the last loss value
rather than ssthresh when loss is detected.  The correct code (from the BIC
TCP code for Web100) is in this patch.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Do not hold state lock while checking size

2005-05-12T17:00:19+00:00

This patch from Herbert Xu fixes a deadlock with IPsec.
When an ICMP frag. required is sent and the ICMP message
needs the same SA as the packet that caused it the state
will be locked twice.

[IPSEC]: Do not hold state lock while checking size.

This can elicit ICMP message output and thus result in a
deadlock.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix signedness problem at socket creation

2005-05-12T17:00:16+00:00

CAN-2005-0750 is assigned to this issue

ilja  discovered potential local root exploit in
bluetooth socket creation.

This patch fixes a small signedness problem when creating the
socket.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Chris Wright

[PATCH] Fix __xfrm_find_acq_byseq()

2005-05-12T17:00:13+00:00

This function, as it's name implies, is supposed to only
return IPSEC objects which are in the XFRM_STATE_ACQ
("acquire") state.  But it returns any object with the
matching sequence number.

This is wrong and confuses IPSEC daemons to no end.

[XFRM]: xfrm_find_acq_byseq should only return XFRM_STATE_ACQ states.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix crash while reading /proc/net/route

2005-05-12T17:00:13+00:00

[IPV4]: Fix crash while reading /proc/net/route caused by stale pointers

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman