linux.git/net/ipv4, branch v3.8-rc5

tcp: accept RST without ACK flag

2013-01-11T06:49:30+00:00

commit c3ae62af8e755 (tcp: should drop incoming frames without ACK flag
set) added a regression on the handling of RST messages.

RST should be allowed to come even without ACK bit set. We validate
the RST by checking the exact sequence, as requested by RFC 793 and
5961 3.2, in tcp_validate_incoming()

Reported-by: Eric Wong 
Signed-off-by: Eric Dumazet 
Acked-by: Neal Cardwell 
Tested-by: Eric Wong 
Signed-off-by: David S. Miller

tcp: fix splice() and tcp collapsing interaction

2013-01-10T22:09:57+00:00

Under unusual circumstances, TCP collapse can split a big GRO TCP packet
while its being used in a splice(socket->pipe) operation.

skb_splice_bits() releases the socket lock before calling
splice_to_pipe().

[ 1081.353685] WARNING: at net/ipv4/tcp.c:1330 tcp_cleanup_rbuf+0x4d/0xfc()
[ 1081.371956] Hardware name: System x3690 X5 -[7148Z68]-
[ 1081.391820] cleanup rbuf bug: copied AD3BCF1 seq AD370AF rcvnxt AD3CF13

To fix this problem, we must eat skbs in tcp_recv_skb().

Remove the inline keyword from tcp_recv_skb() definition since
it has three call sites.

Reported-by: Christian Becker 
Cc: Willy Tarreau 
Signed-off-by: Eric Dumazet 
Tested-by: Willy Tarreau 
Signed-off-by: David S. Miller

tcp: splice: fix an infinite loop in tcp_read_sock()

2013-01-10T22:07:19+00:00

commit 02275a2ee7c0 (tcp: don't abort splice() after small transfers)
added a regression.

[   83.843570] INFO: rcu_sched self-detected stall on CPU
[   83.844575] INFO: rcu_sched detected stalls on CPUs/tasks: { 6} (detected by 0, t=21002 jiffies, g=4457, c=4456, q=13132)
[   83.844582] Task dump for CPU 6:
[   83.844584] netperf         R  running task        0  8966   8952 0x0000000c
[   83.844587]  0000000000000000 0000000000000006 0000000000006c6c 0000000000000000
[   83.844589]  000000000000006c 0000000000000096 ffffffff819ce2bc ffffffffffffff10
[   83.844592]  ffffffff81088679 0000000000000010 0000000000000246 ffff880c4b9ddcd8
[   83.844594] Call Trace:
[   83.844596]  [] ? vprintk_emit+0x1c9/0x4c0
[   83.844601]  [] ? schedule+0x29/0x70
[   83.844606]  [] ? tcp_splice_data_recv+0x42/0x50
[   83.844610]  [] ? tcp_read_sock+0xda/0x260
[   83.844613]  [] ? tcp_prequeue_process+0xb0/0xb0
[   83.844615]  [] ? tcp_splice_read+0xc0/0x250
[   83.844618]  [] ? sock_splice_read+0x22/0x30
[   83.844622]  [] ? do_splice_to+0x7b/0xa0
[   83.844627]  [] ? sys_splice+0x59c/0x5d0
[   83.844630]  [] ? putname+0x2b/0x40
[   83.844633]  [] ? do_sys_open+0x174/0x1e0
[   83.844636]  [] ? system_call_fastpath+0x16/0x1b

if recv_actor() returns 0, we should stop immediately,
because looping wont give a chance to drain the pipe.

Signed-off-by: Eric Dumazet 
Cc: Willy Tarreau 
Signed-off-by: David S. Miller

net: prevent setting ttl=0 via IP_TTL

2013-01-09T01:57:10+00:00

A regression is introduced by the following commit:

	commit 4d52cfbef6266092d535237ba5a4b981458ab171
	Author: Eric Dumazet 
	Date:   Tue Jun 2 00:42:16 2009 -0700

	    net: ipv4/ip_sockglue.c cleanups

	    Pure cleanups

but it is not a pure cleanup...

	-               if (val != -1 && (val < 1 || val>255))
	+               if (val != -1 && (val < 0 || val > 255))

Since there is no reason provided to allow ttl=0, change it back.

Reported-by: nitin padalia 
Cc: nitin padalia 
Cc: Eric Dumazet 
Cc: David S. Miller 
Signed-off-by: Cong Wang 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

ipv4: fix NULL checking in devinet_ioctl()

2013-01-07T05:11:18+00:00

The NULL pointer check `!ifa' should come before its first use.

[ Bug origin : commit fd23c3b31107e2fc483301ee923d8a1db14e53f4
  (ipv4: Add hash table of interface addresses) in linux-2.6.39 ]

Signed-off-by: Xi Wang 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

net/ipv4/ipconfig: really display the BOOTP/DHCP server's address.

2013-01-04T23:14:14+00:00

Up to now, the debug and info messages from the ipconfig subsytem
claim to display the IP address of the DHCP/BOOTP server but
display instead the IP address of the bootserver.  Fix that.

Signed-off-by: Philippe De Muyter 
Signed-off-by: David S. Miller

Merge branch 'master' of git://1984.lsi.us.es/nf

2012-12-28T22:28:17+00:00

Pablo Neira Ayuso says:

====================
The following batch contains Netfilter fixes for 3.8-rc1. They are
a mixture of old bugs that have passed unnoticed (I'll pass these to
stable) and more fresh ones from the previous merge window, they are:

* Fix for MAC address in 6in4 tunnels via NFLOG that results in ulogd
  showing up wrong address, from Bob Hockney.

* Fix a comment in nf_conntrack_ipv6, from Florent Fourcot.

* Fix a leak an error path in ctnetlink while creating an expectation,
  from Jesper Juhl.

* Fix missing ICMP time exceeded in the IPv6 defragmentation code, from
  Haibo Xi.

* Fix inconsistent handling of routing changes in MASQUERADE for the
  new connections case, from Andrew Collins.

* Fix a missing skb_reset_transport in ip[6]t_REJECT that leads to
  crashes in the ixgbe driver (since it seems to access the transport
  header with TSO enabled), from Mukund Jampala.

* Recover obsoleted NOTRACK target by including it into the CT and spot
  a warning via printk about being obsoleted. Many people don't check the
  scheduled to be removal file under Documentation, so we follow some
  less agressive approach to kill this in a year or so. Spotted by Florian
  Westphal, patch from myself.

* Fix race condition in xt_hashlimit that allows to create two or more
  entries, from myself.

* Fix crash if the CT is used due to the recently added facilities to
  consult the dying and unconfirmed conntrack lists, from myself.
====================

Signed-off-by: David S. Miller

ipv4/ip_gre: set transport header correctly to gre header

2012-12-26T23:19:56+00:00

ipgre_tunnel_xmit() incorrectly sets transport header to inner payload
instead of GRE header. It seems copy-and-pasted from ipip.c.
So set transport header to gre header.
(In ipip case the transport header is the inner ip header, so that's
correct.)

Found by inspection. In practice the incorrect transport header
doesn't matter because the skb usually is sent to another net_device
or socket, so the transport header isn't referenced.

Signed-off-by: Isaku Yamahata 
Signed-off-by: David S. Miller

tcp: should drop incoming frames without ACK flag set

2012-12-26T23:08:55+00:00

In commit 96e0bf4b5193d (tcp: Discard segments that ack data not yet
sent) John Dykstra enforced a check against ack sequences.

In commit 354e4aa391ed5 (tcp: RFC 5961 5.2 Blind Data Injection Attack
Mitigation) I added more safety tests.

But we missed fact that these tests are not performed if ACK bit is
not set.

RFC 793 3.9 mandates TCP should drop a frame without ACK flag set.

" fifth check the ACK field,
      if the ACK bit is off drop the segment and return"

Not doing so permits an attacker to only guess an acceptable sequence
number, evading stronger checks.

Many thanks to Zhiyun Qian for bringing this issue to our attention.

See :
http://web.eecs.umich.edu/~zhiyunq/pub/ccs12_TCP_sequence_number_inference.pdf

Reported-by: Zhiyun Qian 
Signed-off-by: Eric Dumazet 
Cc: Nandita Dukkipati 
Cc: Neal Cardwell 
Cc: John Dykstra 
Signed-off-by: David S. Miller

arp: fix a regression in arp_solicit()

2012-12-25T02:42:58+00:00

Sedat reported the following commit caused a regression:

commit 9650388b5c56578fdccc79c57a8c82fb92b8e7f1
Author: Eric Dumazet 
Date:   Fri Dec 21 07:32:10 2012 +0000

    ipv4: arp: fix a lockdep splat in arp_solicit

This is due to the 6th parameter of arp_send() needs to be NULL
for the broadcast case, the above commit changed it to an all-zero
array by mistake.

Reported-by: Sedat Dilek 
Tested-by: Sedat Dilek 
Cc: Sedat Dilek 
Cc: Eric Dumazet 
Cc: David S. Miller 
Cc: Julian Anastasov 
Signed-off-by: Cong Wang 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller