linux.git/drivers/net/pppol2tp.c, branch v2.6.29

l2tp: fix UDP checksum support

2008-12-16T09:23:49+00:00

The pppol2tp driver has had broken UDP checksum code for a long
time. This patch fixes it. If UDP checksums are enabled in the
tunnel's UDP socket, the L2TP driver now properly validates the
checksum on receive and fills in the checksum on transmit. If the
network device has hardware checksum support and is enabled, it is
used instead of generating/checking the checksum in software.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

pppol2tp: Add missing sock_put() in pppol2tp_release()

2008-11-29T06:12:02+00:00

pppol2tp_sock_to_session() do sock_hold() if the session to release is
not NULL.

Signed-off-by: Frédéric Moulins 
Signed-off-by: David S. Miller

net: Remove __skb_insert() calls outside of skbuff internals.

2008-09-22T04:28:51+00:00

This minor cleanup simplifies later changes which will convert
struct sk_buff and friends over to using struct list_head.

Signed-off-by: David S. Miller

[netdrvr] remove unnecessary #include

2008-08-14T08:26:38+00:00

The drivers below do not use LINUX_VERSION_CODE nor KERNEL_VERSION.
  drivers/net/acenic.c
  drivers/net/bnx2x_link.c
  drivers/net/bnx2x_main.c
  drivers/net/cpmac.c
  drivers/net/gianfar_sysfs.c
  drivers/net/ipg.h
  drivers/net/ppp_mppe.c
  drivers/net/pppol2tp.c
  drivers/net/r6040.c
  drivers/net/sh_eth.c
  drivers/net/sky2.c
  drivers/net/tehuti.h
  drivers/net/typhoon.c

This patch removes the said #include .

Signed-off-by: Huang Weiyi 
Signed-off-by: Jeff Garzik

l2tp: Fix potential memory corruption in pppol2tp_recvmsg()

2008-06-10T19:35:00+00:00

This patch fixes a potential memory corruption in
pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer
length, memcpy_toiovec() will go into unintialized data on the kernel
heap, interpret it as an iovec and start modifying memory.

The fix is to change the memcpy_toiovec() call to
skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP)
are handled properly. Also check that the caller's buffer is big
enough for the data and set the MSG_TRUNC flag if it is not so.

Reported-by: Ilja 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: Fix possible oops if transmitting or receiving when tunnel goes down

2008-06-04T22:54:07+00:00

Some problems have been experienced in the field which cause an oops
in the pppol2tp driver if L2TP tunnels fail while passing data.

The pppol2tp driver uses private data that is referenced via the
sk->sk_user_data of its UDP and PPPoL2TP sockets. This patch makes
sure that the driver uses sock_hold() when it holds a reference to the
sk pointer. This affects its sendmsg(), recvmsg(), getname(),
[gs]etsockopt() and ioctl() handlers.

Tested by ISP where problem was seen. System has been up 10 days with
no oops since running this patch. Without the patch, an oops would
occur every 1-2 days.

Signed-off-by: James Chapman  
Signed-off-by: David S. Miller

lt2p: Fix possible WARN_ON from socket code when UDP socket is closed

2008-06-04T22:07:32+00:00

If an L2TP daemon closes a tunnel socket while packets are queued in
the tunnel's reorder queue, a kernel warning is logged because the
socket is closed while skbs are still referencing it. The fix is to
purge the queue in the socket's release handler.

WARNING: at include/net/sock.h:351 udp_lib_unhash+0x41/0x68()
Pid: 12998, comm: openl2tpd Not tainted 2.6.25 #8
 [] warn_on_slowpath+0x41/0x51
 [] udp_lib_unhash+0x41/0x68
 [] sk_common_release+0x23/0x90
 [] udp_lib_close+0x8/0xa
 [] inet_release+0x42/0x48
 [] sock_release+0x14/0x60
 [] sock_close+0x29/0x30
 [] __fput+0xad/0x15b
 [] fput+0x17/0x19
 [] filp_close+0x50/0x5a
 [] sys_close+0x69/0x9f
 [] syscall_call+0x7/0xb

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: avoid skb truesize bug if headroom is increased

2008-05-19T21:10:01+00:00

A user reported seeing occasional bugs such as the following when
using the L2TP driver.

  SKB BUG: Invalid truesize (272) len=72, sizeof(sk_buff)=208

When L2TP adds its header in the transmit path, it might need to
increase the headroom of the skb. In some cases, the increased
headroom trips a kernel bug when the skb is freed because the skb has
grown beyond its truesize value. The fix is to increase the truesize
by the amount of headroom added, after orphaning the skb.

While here, fix a misleading comment.

Thanks to Iouri Kharon  for the initial
report and testing the fix.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

pppol2tp: Remove null pointer dereference.

2008-05-12T22:43:46+00:00

If session is NULL, it is not possible to access its name field.  So I
have split apart the printing of the error message to drop the
printing of the name field in this case.

The macro PRINTK actually only evaluates its arguments starting with
the third one if the bitwise conjunction of the first two is non-zero.
Normally, this conjunction would only be non-zero if debugging mode
were turned on, but when session is NULL, the first argument in both
the old and new code is -1, and thus the bitwise conjunction is true.
Perhaps a different strategy is desired, such as using tunnel->debug,
which session->debug is initialized to, but tunnel can also be NULL,
so this does not completely solve the problem.


This problem was found using the following semantic match
(http://www.emn.fr/x-info/coccinelle/)

// 
@@
expression E, E1;
identifier f;
statement S1,S2,S3;
@@

* if (E == NULL)
{
  ... when != if (E == NULL) S1 else S2
      when != E = E1
* E->f
  ... when any
  return ...;
}
else S3
// 

Signed-off-by: Julia Lawall 
Signed-off-by: David S. Miller

netdev: use non-racy method for proc entries creation

2008-04-29T15:06:22+00:00

Use proc_create()/proc_create_data() to make sure that ->proc_fops and ->data
be setup before gluing PDE to main tree.

Signed-off-by: Denis V. Lunev 
Cc: Jeff Garzik 
Cc: Alexey Dobriyan 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds