linux.git/net/can, branch v2.6.31

can: Fix raw_getname() leak

2009-08-10T04:45:32+00:00

raw_getname() can leak 10 bytes of kernel memory to user

(two bytes hole between can_family and can_ifindex,
8 bytes at the end of sockaddr_can structure)

Signed-off-by: Eric Dumazet 
Acked-by: Oliver Hartkopp 
Signed-off-by: David S. Miller

net/can: add module alias to can protocol drivers

2009-07-15T18:20:38+00:00

Add appropriate MODULE_ALIAS() to facilitate autoloading of can protocol drivers

Signed-off-by: Lothar Wassmann 
Acked-by: Oliver Hartkopp 
Signed-off-by: David S. Miller

net/can bugfix: use after free bug in can protocol drivers

2009-07-15T18:20:37+00:00

Fix a use after free bug in can protocol drivers

The release functions of the can protocol drivers lack a call to
sock_orphan() which leads to referencing freed memory under certain
circumstances.

This patch fixes a bug reported here:
https://lists.berlios.de/pipermail/socketcan-users/2009-July/000985.html

Signed-off-by: Lothar Wassmann 
Acked-by: Oliver Hartkopp 
Signed-off-by: David S. Miller

can: af_can.c use rcu_barrier() on module unload.

2009-06-10T08:11:24+00:00

This module uses rcu_call() thus it should use rcu_barrier()
on module unload.

Signed-off-by: Jesper Dangaard Brouer 
Acked-by: Oliver Hartkopp 
Signed-off-by: David S. Miller

can: Network Drop Monitor: Make use of consume_skb() in af_can.c

2009-04-17T08:38:46+00:00

Since commit ead2ceb0ec9f85cff19c43b5cdb2f8a054484431 ("Network Drop
Monitor: Adding kfree_skb_clean for non-drops and modifying
end-of-line points for skbs") so called end-of-line points for skb's
should use consume_skb() to free the socket buffer.

In opposite to consume_skb() the function kfree_skb() is intended to
be used for unexpected skb drops e.g. in error conditions that now can
trigger the network drop monitor if enabled.

This patch moves the skb end-of-line point in af_can.c to use
consume_skb().

Signed-off-by: Oliver Hartkopp 
Signed-off-by: David S. Miller

proc 2/2: remove struct proc_dir_entry::owner

2009-03-30T21:14:44+00:00

Setting ->owner as done currently (pde->owner = THIS_MODULE) is racy
as correctly noted at bug #12454. Someone can lookup entry with NULL
->owner, thus not pinning enything, and release it later resulting
in module refcount underflow.

We can keep ->owner and supply it at registration time like ->proc_fops
and ->data.

But this leaves ->owner as easy-manipulative field (just one C assignment)
and somebody will forget to unpin previous/pin current module when
switching ->owner. ->proc_fops is declared as "const" which should give
some thoughts.

->read_proc/->write_proc were just fixed to not require ->owner for
protection.

rmmod'ed directories will be empty and return "." and ".." -- no harm.
And directories with tricky enough readdir and lookup shouldn't be modular.
We definitely don't want such modular code.

Removing ->owner will also make PDE smaller.

So, let's nuke it.

Kudos to Jeff Layton for reminding about this, let's say, oversight.

http://bugzilla.kernel.org/show_bug.cgi?id=12454

Signed-off-by: Alexey Dobriyan

can: remove some pointless conditionals before kfree_skb()

2009-02-27T07:07:35+00:00

Remove some pointless conditionals before kfree_skb().

Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller

ip: support for TX timestamps on UDP and RAW sockets

2009-02-16T06:43:38+00:00

Instructions for time stamping outgoing packets are take from the
socket layer and later copied into the new skb.

Signed-off-by: Patrick Ohly 
Signed-off-by: David S. Miller

net: replace uses of __constant_{endian}

2009-02-01T08:45:17+00:00

Base versions handle constant folding now.

Signed-off-by: Harvey Harrison 
Signed-off-by: David S. Miller

can: fix slowpath issue in hrtimer callback function

2009-01-15T05:06:55+00:00

Due to the loopback functionality in can_send() we can not invoke it
from hardirq context which was done inside the
bcm_tx_timeout_handler() hrtimer callback:

[  700.361154]  [] warn_slowpath+0x80/0xb6
[  700.361163]  [] valid_state+0x125/0x136
[  700.361171]  [] mark_lock+0x18e/0x332
[  700.361180]  [] __lock_acquire+0x12e/0xb1e
[  700.361189]  [] bcm_tx_timeout_handler+0x0/0xbc [can_bcm]
[  700.361198]  [] dev_queue_xmit+0x191/0x479
[  700.361206]  [] __local_bh_disable+0x2b/0x64
[  700.361213]  [] dev_queue_xmit+0x191/0x479
[  700.361225]  [] can_send+0xd7/0x11a [can]
[  700.361235]  [] bcm_can_tx+0x9d/0xd9 [can_bcm]
[  700.361245]  [] bcm_tx_timeout_handler+0x6a/0xbc [can_bcm]
[  700.361255]  [] bcm_tx_timeout_handler+0x0/0xbc [can_bcm]
[  700.361263]  [] __run_hrtimer+0x5a/0x86
[  700.361273]  [] bcm_tx_timeout_handler+0x0/0xbc [can_bcm]
[  700.361282]  [] hrtimer_interrupt+0xb9/0x110

This patch moves the rest of the functionality from the hrtimer
callback to the already existing tasklet to fix this slowpath problem.

Signed-off-by: Oliver Hartkopp 
Signed-off-by: David S. Miller