linux-stable.git/net, branch linux-2.6.20.y

[PATCH] Fix datagram recvmsg NULL iov handling regression.

2007-10-17T19:30:39+00:00

commit ef8aef55ce61fd0e2af798695f7386ac756ae1e7 in mainline

Subject: [PATCH] [NET]: Do not dereference iov if length is zero

When msg_iovlen is zero we shouldn't try to dereference
msg_iov.  Right now the only thing that tries to do so
is skb_copy_and_csum_datagram_iovec.  Since the total
length should also be zero if msg_iovlen is zero, it's
sufficient to check the total length there and simply
return if it's zero.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix ipv6 double-sock-release with MSG_CONFIRM

2007-10-17T19:30:39+00:00

commit 3ef9d943d26dea764f4fecf3767001c90b778b0c in mainline

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix IPSEC AH4 options handling

2007-10-17T19:30:38+00:00

commit 8ee4f391831cb96916a8e8a05f04b1c1d7dd30d8 in mainline.

In testing our ESP/AH offload hardware, I discovered an issue with how
AH handles mutable fields in IPv4.  RFC 4302 (AH) states the following
on the subject:

        For IPv4, the entire option is viewed as a unit; so even
        though the type and length fields within most options are immutable
        in transit, if an option is classified as mutable, the entire option
        is zeroed for ICV computation purposes.

The current implementation does not zero the type and length fields,
resulting in authentication failures when communicating with hosts
that do (i.e. FreeBSD).

I have tested record route and timestamp options (ping -R and ping -T)
on a small network involving Windows XP, FreeBSD 6.2, and Linux hosts,
with one router.  In the presence of these options, the FreeBSD and
Linux hosts (with the patch or with the hardware) can communicate.
The Windows XP host simply fails to accept these packets with or
without the patch.

I have also been trying to test source routing options (using
traceroute -g), but haven't had much luck getting this option to work
*without* AH, let alone with.

Signed-off-by: Nick Bowler 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix IPV6 append OOPS.

2007-10-17T19:30:37+00:00

commit e1f52208bb968291f7d9142eff60b62984b4a511 in mainline.

[IPv6]: Fix NULL pointer dereference in ip6_flush_pending_frames

Some of skbs in sk->write_queue do not have skb->dst because
we do not fill skb->dst when we allocate new skb in append_data().

BTW, I think we may not need to (or we should not) increment some stats
when using corking; if 100 sendmsg() (with MSG_MORE) result in 2 packets,
how many should we increment?

If 100, we should set skb->dst for every queued skbs.

If 1 (or 2 (*)), we increment the stats for the first queued skb and
we should just skip incrementing OutDiscards for the rest of queued skbs,
adn we should also impelement this semantics in other places;
e.g., we should increment other stats just once, not 100 times.

*: depends on the place we are discarding the datagram.

I guess should just increment by 1 (or 2).

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] TCP: Do not autobind ports for TCP sockets

2007-10-17T19:30:26+00:00

[TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg().

As discovered by Evegniy Polyakov, if we try to sendmsg after
a connection reset, we can do incredibly stupid things.

The core issue is that inet_sendmsg() tries to autobind the
socket, but we should never do that for TCP.  Instead we should
just go straight into TCP's sendmsg() code which will do all
of the necessary state and pending socket error checks.

TCP's sendpage already directly vectors to tcp_sendpage(), so this
merely brings sendmsg() in line with that.

Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] NET: Fix missing rcu unlock in __sock_create()

2007-10-17T19:30:25+00:00

[NET]: Fix unbalanced rcu_read_unlock in __sock_create

The recent RCU work created an unbalanced rcu_read_unlock
in __sock_create.  This patch fixes that.  Reported by
oleg 123.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] SNAP: Fix SNAP protocol header accesses.

2007-10-17T19:30:24+00:00

The snap_rcv code reads 5 bytes so we should make sure that
we have 5 bytes in the head before proceeding.

Based on diagnosis and fix by Evgeniy Polyakov, reported by
Alan J. Wylie.

Patch also kills the skb->sk assignment before kfree_skb
since it's redundant.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] DCCP: Fix DCCP GFP_KERNEL allocation in atomic context

2007-10-17T19:30:23+00:00

This fixes the following bug reported in syslog:

[ 4039.051658] BUG: sleeping function called from invalid context at /usr/src/davem-2.6/mm/slab.c:3032
[ 4039.051668] in_atomic():1, irqs_disabled():0
[ 4039.051670] INFO: lockdep is turned off.
[ 4039.051674]  [] show_trace_log_lvl+0x1a/0x30
[ 4039.051687]  [] show_trace+0x12/0x14
[ 4039.051691]  [] dump_stack+0x16/0x18
[ 4039.051695]  [] __might_sleep+0xaf/0xbe
[ 4039.051700]  [] __kmalloc+0xb1/0xd0
[ 4039.051706]  [] ccid2_hc_tx_alloc_seq+0x35/0xc3 [dccp_ccid2]
[ 4039.051717]  [] ccid2_hc_tx_packet_sent+0x27f/0x2d9 [dccp_ccid2]
[ 4039.051723]  [] dccp_write_xmit+0x1eb/0x338 [dccp]
[ 4039.051741]  [] dccp_sendmsg+0x113/0x18f [dccp]
[ 4039.051750]  [] inet_sendmsg+0x2e/0x4c
[ 4039.051758]  [] sock_aio_write+0xd5/0x107
[ 4039.051766]  [] do_sync_write+0xcd/0x11c
[ 4039.051772]  [] vfs_write+0x118/0x11f
[ 4039.051840]  [] sys_write+0x3d/0x64
[ 4039.051845]  [] syscall_call+0x7/0xb
[ 4039.051848]  =======================

The problem was that GFP_KERNEL was used; fixed by using gfp_any().

Signed-off-by: Gerrit Renker 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[IPV6]: Do no rely on skb->dst before it is assigned.

2007-09-08T19:21:38+00:00

Because skb->dst is assigned in ip6_route_input(), it is really
bad to use it in hop-by-hop option handler(s).

Closes: Bug #8450 (Eric Sesterhenn )
Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Willy Tarreau

[PATCH] Fix incorrect config #ifdef around skb_copy_secmark

2007-08-28T10:14:55+00:00

secmark doesn't depend on CONFIG_NET_SCHED.

Signed-off-by: Patrick McHardy 
Acked-by: James Morris 
Signed-off-by: David S. Miller