linux.git/net/socket.c, branch v2.6.14

[NET]: Fix module reference counts for loadable protocol modules

2005-09-27T22:23:38+00:00

I have been experimenting with loadable protocol modules, and ran into
several issues with module reference counting.

The first issue was that __module_get failed at the BUG_ON check at
the top of the routine (checking that my module reference count was
not zero) when I created the first socket. When sk_alloc() is called,
my module reference count was still 0. When I looked at why sctp
didn't have this problem, I discovered that sctp creates a control
socket during module init (when the module ref count is not 0), which
keeps the reference count non-zero. This section has been updated to
address the point Stephen raised about checking the return value of
try_module_get().

The next problem arose when my socket init routine returned an error.
This resulted in my module reference count being decremented below 0.
My socket ops->release routine was also being called. The issue here
is that sock_release() calls the ops->release routine and decrements
the ref count if sock->ops is not NULL. Since the socket probably
didn't get correctly initialized, this should not be done, so we will
set sock->ops to NULL because we will not call try_module_get().

While searching for another bug, I also noticed that sys_accept() has
a possibility of doing a module_put() when it did not do an
__module_get so I re-ordered the call to security_socket_accept().

Signed-off-by: Frank Filz 
Signed-off-by: David S. Miller

[NET]: Make sure ctl buffer is aligned properly in sys_sendmsg().

2005-09-26T21:28:02+00:00

It's on the stack and declared as "unsigned char[]", but pointers
and similar can be in here thus we need to give it an explicit
alignment attribute.

Signed-off-by: Alex Williamson 
Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller

[NET]: Do not leak MSG_CMSG_COMPAT into userspace.

2005-09-16T23:51:01+00:00

Noticed by Sridhar Samudrala.

Signed-off-by: David S. Miller

[PATCH] Fix 32bit sendmsg() flaw

2005-09-08T15:14:11+00:00

When we copy 32bit ->msg_control contents to kernel, we walk the same
userland data twice without sanity checks on the second pass.

Second version of this patch: the original broke with 64-bit arches
running 32-bit-compat-mode executables doing sendmsg() syscalls with
unaligned CMSG data areas

Another thing is that we use kmalloc() to allocate and sock_kfree_s()
to free afterwards; less serious, but also needs fixing.

Signed-off-by: Al Viro 
Signed-off-by: David Woodhouse 
Signed-off-by: Chris Wright 
Signed-off-by: Linus Torvalds

[NET]: Use file->private_data to get socket pointer.

2005-09-06T21:42:45+00:00

Avoid touching file->f_dentry on sockets, since file->private_data
directly gives us the socket pointer.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

[NET]: use __read_mostly on kmem_cache_t , DEFINE_SNMP_STAT pointers

2005-08-29T23:11:18+00:00

This patch puts mostly read only data in the right section
(read_mostly), to help sharing of these data between CPUS without
memory ping pongs.

On one of my production machine, tcp_statistics was sitting in a
heavily modified cache line, so *every* SNMP update had to force a
reload.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

[NET]: Fix sparse warnings

2005-08-29T23:01:32+00:00

Of this type, mostly:

CHECK   net/ipv6/netfilter.c
net/ipv6/netfilter.c:96:12: warning: symbol 'ipv6_netfilter_init' was not declared. Should it be static?
net/ipv6/netfilter.c:101:6: warning: symbol 'ipv6_netfilter_fini' was not declared. Should it be static?

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

[NET]: Make use of ->private_data in sockfd_lookup

2005-08-29T22:56:38+00:00

Please consider the patch below which makes use of file->private_data to
store the pointer to the socket, which avoids touching several unused
cachelines in the dentry and inode in sockfd_lookup.

Signed-off-by: Benjamin LaHaise 
Signed-off-by: David S. Miller

[NET]: dont use strlen() but the result from a prior sprintf()

2005-06-22T21:32:51+00:00

Small patch to save an unecessary call to strlen() : sprintf() gave us
the length, just trust it.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

AUDIT: Fix user pointer deref thinko in sys_socketcall().

2005-06-02T11:13:21+00:00

I cunningly put the audit call immediately after the 
copy_from_user().... but used the _userspace_ copy of the args still. 
Let's not do that.

Signed-off-by: David Woodhouse