linux.git/drivers/net/pppol2tp.c, branch master

l2tp: Relocate pppol2tp driver to new net/l2tp directory

2010-04-03T21:56:01+00:00

This patch moves the existing pppol2tp driver from drivers/net into a
new net/l2tp directory, which is where the upcoming L2TPv3 code will
live. The existing CONFIG_PPPOL2TP config option is left in its
current place to avoid "make oldconfig" issues when an existing
pppol2tp user takes this change. (This is the same approach used for
the pppoatm driver, which moved to net/atm.)

There are no code changes. The existing drivers/net/pppol2tp.c is
simply moved to net/l2tp.

Signed-off-by: James Chapman 
Reviewed-by: Randy Dunlap 
Signed-off-by: David S. Miller

l2tp: Fix UDP socket reference count bugs in the pppol2tp driver

2010-03-16T21:15:44+00:00

This patch fixes UDP socket refcnt bugs in the pppol2tp driver.

A bug can cause a kernel stack trace when a tunnel socket is closed.

A way to reproduce the issue is to prepare the UDP socket for L2TP (by
opening a tunnel pppol2tp socket) and then close it before any L2TP
sessions are added to it. The sequence is

Create UDP socket
Create tunnel pppol2tp socket to prepare UDP socket for L2TP
  pppol2tp_connect: session_id=0, peer_session_id=0
L2TP SCCRP control frame received (tunnel_id==0)
  pppol2tp_recv_core: sock_hold()
  pppol2tp_recv_core: sock_put
L2TP ZLB control frame received (tunnel_id=nnn)
  pppol2tp_recv_core: sock_hold()
  pppol2tp_recv_core: sock_put
Close tunnel management socket
  pppol2tp_release: session_id=0, peer_session_id=0
Close UDP socket
  udp_lib_close: BUG

The addition of sock_hold() in pppol2tp_connect() solves the problem.

For data frames, two sock_put() calls were added to plug a refcnt leak
per received data frame. The ref that is grabbed at the top of
pppol2tp_recv_core() must always be released, but this wasn't done for
accepted data frames or data frames discarded because of bad UDP
checksums. This leak meant that any UDP socket that had passed L2TP
data traffic (i.e. L2TP data frames, not just L2TP control frames)
using pppol2tp would not be released by the kernel.

WARNING: at include/net/sock.h:435 udp_lib_unhash+0x117/0x120()
Pid: 1086, comm: openl2tpd Not tainted 2.6.33-rc1 #8
Call Trace:
 [] ? udp_lib_unhash+0x117/0x120
 [] ? warn_slowpath_common+0x71/0xd0
 [] ? udp_lib_unhash+0x117/0x120
 [] ? warn_slowpath_null+0x13/0x20
 [] ? udp_lib_unhash+0x117/0x120
 [] ? sk_common_release+0x17/0x90
 [] ? inet_release+0x33/0x60
 [] ? sock_release+0x10/0x60
 [] ? sock_close+0xf/0x30
 [] ? __fput+0x52/0x150
 [] ? filp_close+0x3e/0x70
 [] ? put_files_struct+0x62/0xb0
 [] ? do_exit+0x5e7/0x650
 [] ? mntput_no_expire+0x13/0x70
 [] ? filp_close+0x3e/0x70
 [] ? do_group_exit+0x2a/0x70
 [] ? sys_exit_group+0x11/0x20
 [] ? sysenter_do_call+0x12/0x26

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: Fix oops in pppol2tp_xmit

2010-03-16T21:15:43+00:00

When transmitting L2TP frames, we derive the outgoing interface's UDP
checksum hardware assist capabilities from the tunnel dst dev. This
can sometimes be NULL, especially when routing protocols are used and
routing changes occur. This patch just checks for NULL dst or dev
pointers when checking for netdev hardware assist features.

BUG: unable to handle kernel NULL pointer dereference at 0000000c
IP: [] pppol2tp_xmit+0x341/0x4da [pppol2tp]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/class/net/lo/operstate
Modules linked in: pppol2tp pppox ppp_generic slhc ipv6 dummy loop snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_timer snd soundcore snd_page_alloc evdev psmouse serio_raw processor button i2c_piix4 i2c_core ati_agp agpgart pcspkr ext3 jbd mbcache sd_mod ide_pci_generic atiixp ide_core ahci ata_generic floppy ehci_hcd ohci_hcd libata e1000e scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: scsi_wait_scan]

Pid: 0, comm: swapper Not tainted (2.6.32.8 #1)
EIP: 0060:[] EFLAGS: 00010297 CPU: 3
EIP is at pppol2tp_xmit+0x341/0x4da [pppol2tp]
EAX: 00000000 EBX: f64d1680 ECX: 000005b9 EDX: 00000000
ESI: f6b91850 EDI: f64d16ac EBP: f6a0c4c0 ESP: f70a9cac
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process swapper (pid: 0, ti=f70a8000 task=f70a31c0 task.ti=f70a8000)
Stack:
 000005a9 000005b9 f734c400 f66652c0 f7352e00 f67dc800 00000000 f6b91800
<0> 000005a3 f70ef6c4 f67dcda9 000005a3 f89b192e 00000246 000005a3 f64d1680
<0> f63633e0 f6363320 f64d1680 f65a7320 f65a7364 f65856c0 f64d1680 f679f02f
Call Trace:
 [] ? ppp_push+0x459/0x50e [ppp_generic]
 [] ? ppp_xmit_process+0x3b6/0x430 [ppp_generic]
 [] ? ppp_start_xmit+0x10d/0x120 [ppp_generic]
 [] ? dev_hard_start_xmit+0x21f/0x2b2
 [] ? sch_direct_xmit+0x48/0x10e
 [] ? dev_queue_xmit+0x263/0x3a6
 [] ? ip_finish_output+0x1f7/0x221
 [] ? ip_forward_finish+0x2e/0x30
 [] ? ip_rcv_finish+0x295/0x2a9
 [] ? netif_receive_skb+0x3e9/0x404
 [] ? e1000_clean_rx_irq+0x253/0x2fc [e1000e]
 [] ? e1000_clean+0x63/0x1fc [e1000e]
 [] ? sched_clock_local+0x15/0x11b
 [] ? net_rx_action+0x96/0x195
 [] ? __do_softirq+0xaa/0x151
 [] ? do_softirq+0x31/0x3c
 [] ? irq_exit+0x26/0x58
 [] ? do_IRQ+0x78/0x89
 [] ? common_interrupt+0x29/0x30
 [] ? native_safe_halt+0x2/0x3
 [] ? default_idle+0x55/0x75
 [] ? c1e_idle+0xd2/0xd5
 [] ? cpu_idle+0x46/0x62
Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 18 8b 4c 24 04 <8b> 40 0c 8d 79 11 f6 40 44 0e 8a 43 64 75 51 6a 00 8b 4c 24 08
EIP: [] pppol2tp_xmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac
CR2: 000000000000000c

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

net: Simplify pppol2tp pernet operations.

2009-12-02T00:15:57+00:00

Take advantage of the new pernet automatic storage management,
and stop using compatibility network namespace functions.

Signed-off-by: Eric W. Biederman 
Signed-off-by: David S. Miller

drivers/net/pppol2tp.c: remove exceptional & on function name

2009-11-18T18:48:42+00:00

In this file, function names are otherwise used as pointers without &.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// 
@r@
identifier f;
@@

f(...) { ... }

@@
identifier r.f;
@@

- &f
+ f
// 

Signed-off-by: Julia Lawall 
Signed-off-by: David S. Miller

netns: net_identifiers should be read_mostly

2009-11-18T13:03:25+00:00

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

inet: rename some inet_sock fields

2009-10-19T01:52:53+00:00

In order to have better cache layouts of struct sock (separate zones
for rx/tx paths), we need this preliminary patch.

Goal is to transfert fields used at lookup time in the first
read-mostly cache line (inside struct sock_common) and move sk_refcnt
to a separate cache line (only written by rx path)

This patch adds inet_ prefix to daddr, rcv_saddr, dport, num, saddr,
sport and id fields. This allows a future patch to define these
fields as macros, like sk_refcnt, without name clashes.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Make setsockopt() optlen be unsigned.

2009-09-30T23:12:20+00:00

This provides safety against negative optlen at the type
level instead of depending upon (sometimes non-trivial)
checks against this sprinkled all over the the place, in
each and every implementation.

Based upon work done by Arjan van de Ven and feedback
from Linus Torvalds.

Signed-off-by: David S. Miller

net: constify remaining proto_ops

2009-09-15T00:03:09+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

pppol2tp: calls unregister_pernet_gen_device() at unload time

2009-08-02T19:20:34+00:00

Failure to call unregister_pernet_gen_device() can exhaust memory
if module is loaded/unloaded many times.

Signed-off-by: Eric Dumazet 
Acked-by: Cyrill Gorcunov 
Signed-off-by: David S. Miller