linux.git/net/core, branch v2.6.37

Revert "ipv4: Allow configuring subnets as local addresses"

2010-12-23T20:03:57+00:00

This reverts commit 4465b469008bc03b98a1b8df4e9ae501b6c69d4b.

Conflicts:

	net/ipv4/fib_frontend.c

As reported by Ben Greear, this causes regressions:

> Change 4465b469008bc03b98a1b8df4e9ae501b6c69d4b caused rules
> to stop matching the input device properly because the
> FLOWI_FLAG_MATCH_ANY_IIF is always defined in ip_dev_find().
>
> This breaks rules such as:
>
> ip rule add pref 512 lookup local
> ip rule del pref 0 lookup local
> ip link set eth2 up
> ip -4 addr add 172.16.0.102/24 broadcast 172.16.0.255 dev eth2
> ip rule add to 172.16.0.102 iif eth2 lookup local pref 10
> ip rule add iif eth2 lookup 10001 pref 20
> ip route add 172.16.0.0/24 dev eth2 table 10001
> ip route add unreachable 0/0 table 10001
>
> If you had a second interface 'eth0' that was on a different
> subnet, pinging a system on that interface would fail:
>
>   [root@ct503-60 ~]# ping 192.168.100.1
>   connect: Invalid argument

Reported-by: Ben Greear 
Signed-off-by: David S. Miller

net: fix nulls list corruptions in sk_prot_alloc

2010-12-16T22:26:56+00:00

Special care is taken inside sk_port_alloc to avoid overwriting
skc_node/skc_nulls_node. We should also avoid overwriting
skc_bind_node/skc_portaddr_node.

The patch fixes the following crash:

 BUG: unable to handle kernel paging request at fffffffffffffff0
 IP: [] udp4_lib_lookup2+0xad/0x370
 [] __udp4_lib_lookup+0x282/0x360
 [] __udp4_lib_rcv+0x31e/0x700
 [] ? ip_local_deliver_finish+0x65/0x190
 [] ? ip_local_deliver+0x88/0xa0
 [] udp_rcv+0x15/0x20
 [] ip_local_deliver_finish+0x65/0x190
 [] ip_local_deliver+0x88/0xa0
 [] ip_rcv_finish+0x32d/0x6f0
 [] ? netif_receive_skb+0x99c/0x11c0
 [] ip_rcv+0x2bb/0x350
 [] netif_receive_skb+0x99c/0x11c0

Signed-off-by: Leonard Crestez 
Signed-off-by: Octavian Purdila 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: fix skb_defer_rx_timestamp()

2010-12-11T00:20:56+00:00

After commit c1f19b51d1d8 (net: support time stamping in phy devices.),
kernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING=y and
skb_defer_rx_timestamp() handles a packet without an ethernet header.

Fixes kernel bugzilla #24102

Reference: https://bugzilla.kernel.org/show_bug.cgi?id=24102
Reported-and-tested-by: Andrew Watts 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

filter: fix sk_filter rcu handling

2010-12-06T17:29:43+00:00

Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and
sk_clone() in commit 47e958eac280c263397

Problem is we can have several clones sharing a common sk_filter, and
these clones might want to sk_filter_attach() their own filters at the
same time, and can overwrite old_filter->rcu, corrupting RCU queues.

We can not use filter->rcu without being sure no other thread could do
the same thing.

Switch code to a more conventional ref-counting technique : Do the
atomic decrement immediately and queue one rcu call back when last
reference is released.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: allow GFP_HIGHMEM in __vmalloc()

2010-11-21T18:04:04+00:00

We forgot to use __GFP_HIGHMEM in several __vmalloc() calls.

In ceph, add the missing flag.

In fib_trie.c, xfrm_hash.c and request_sock.c, using vzalloc() is
cleaner and allows using HIGHMEM pages as well.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: fix kernel-doc for sk_filter_rcu_release

2010-11-19T17:27:15+00:00

Fix kernel-doc warning for sk_filter_rcu_release():

Warning(net/core/filter.c:586): missing initial short description on line:
 * 	sk_filter_rcu_release: Release a socket filter by rcu_head

Signed-off-by: Randy Dunlap 
Cc:	"David S. Miller" 
Cc:	netdev@vger.kernel.org
Signed-off-by: David S. Miller

net: zero kobject in rx_queue_release

2010-11-18T17:41:40+00:00

netif_set_real_num_rx_queues() can decrement and increment
the number of rx queues. For example ixgbe does this as
features and offloads are toggled. Presumably this could
also happen across down/up on most devices if the available
resources changed (cpu offlined).

The kobject needs to be zero'd in this case so that the
state is not preserved across kobject_put()/kobject_init_and_add().

This resolves the following error report.

ixgbe 0000:03:00.0: eth2: NIC Link is Up 10 Gbps, Flow Control: RX/TX
kobject (ffff880324b83210): tried to init an initialized object, something is seriously wrong.
Pid: 1972, comm: lldpad Not tainted 2.6.37-rc18021qaz+ #169
Call Trace:
 [] kobject_init+0x3a/0x83
 [] kobject_init_and_add+0x23/0x57
 [] ? mark_lock+0x21/0x267
 [] net_rx_queue_update_kobjects+0x63/0xc6
 [] netif_set_real_num_rx_queues+0x5f/0x78
 [] ixgbe_set_num_queues+0x1c6/0x1ca [ixgbe]
 [] ixgbe_init_interrupt_scheme+0x1e/0x79c [ixgbe]
 [] ixgbe_dcbnl_set_state+0x167/0x189 [ixgbe]

Signed-off-by: John Fastabend 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

rtnetlink: Fix message size calculation for link messages

2010-11-12T18:53:09+00:00

nlmsg_total_size() calculates the length of a netlink message
including header and alignment. nla_total_size() calculates the
space an individual attribute consumes which was meant to be used
in this context.

Also, ensure to account for the attribute header for the
IFLA_INFO_XSTATS attribute as implementations of get_xstats_size()
seem to assume that we do so.

The addition of two message headers minus the missing attribute
header resulted in a calculated message size that was larger than
required. Therefore we never risked running out of skb tailroom.

Signed-off-by: Thomas Graf 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller

net: avoid limits overflow

2010-11-10T20:12:00+00:00

Robin Holt tried to boot a 16TB machine and found some limits were
reached : sysctl_tcp_mem[2], sysctl_udp_mem[2]

We can switch infrastructure to use long "instead" of "int", now
atomic_long_t primitives are available for free.

Signed-off-by: Eric Dumazet 
Reported-by: Robin Holt 
Reviewed-by: Robin Holt 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

filter: make sure filters dont read uninitialized memory

2010-11-10T18:38:24+00:00

There is a possibility malicious users can get limited information about
uninitialized stack mem array. Even if sk_run_filter() result is bound
to packet length (0 .. 65535), we could imagine this can be used by
hostile user.

Initializing mem[] array, like Dan Rosenberg suggested in his patch is
expensive since most filters dont even use this array.

Its hard to make the filter validation in sk_chk_filter(), because of
the jumps. This might be done later.

In this patch, I use a bitmap (a single long var) so that only filters
using mem[] loads/stores pay the price of added security checks.

For other filters, additional cost is a single instruction.

[ Since we access fentry->k a lot now, cache it in a local variable
  and mark filter entry pointer as const. -DaveM ]

Reported-by: Dan Rosenberg 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller