1. 13 9月, 2008 2 次提交
    • V
      tcp_ipv6: fix use of uninitialized memory · 78d15e82
      Vegard Nossum 提交于
      inet6_rsk() is called on a struct request_sock * before we
      have checked whether the socket is an ipv6 socket or a ipv6-
      mapped ipv4 socket. The access that triggers this is the
      inet_rsk(rsk)->inet6_rsk_offset dereference in inet6_rsk().
      
      This is arguably not a critical error as the inet6_rsk_offset
      is only used to compute a pointer which is never really used
      (in the code path in question) anyway. But it might be a
      latent error, so let's fix it.
      
      Spotted by kmemcheck.
      Signed-off-by: NVegard Nossum <vegard.nossum@gmail.com>
      Acked-by: NArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      78d15e82
    • B
      net: fix scheduling of dst_gc_task by __dst_free · f262b59b
      Benjamin Thery 提交于
      The dst garbage collector dst_gc_task() may not be scheduled as we
      expect it to be in __dst_free().
      
      Indeed, when the dst_gc_timer was replaced by the delayed_work
      dst_gc_work, the mod_timer() call used to schedule the garbage
      collector at an earlier date was replaced by a schedule_delayed_work()
      (see commit 86bba269).
      
      But, the behaviour of mod_timer() and schedule_delayed_work() is
      different in the way they handle the delay. 
      
      mod_timer() stops the timer and re-arm it with the new given delay,
      whereas schedule_delayed_work() only check if the work is already
      queued in the workqueue (and queue it (with delay) if it is not)
      BUT it does NOT take into account the new delay (even if the new delay
      is earlier in time).
      schedule_delayed_work() returns 0 if it didn't queue the work,
      but we don't check the return code in __dst_free().
      
      If I understand the code in __dst_free() correctly, we want dst_gc_task
      to be queued after DST_GC_INC jiffies if we pass the test (and not in
      some undetermined time in the future), so I think we should add a call
      to cancel_delayed_work() before schedule_delayed_work(). Patch below.
      
      Or we should at least test the return code of schedule_delayed_work(),
      and reset the values of dst_garbage.timer_inc and dst_garbage.timer_expires
      back to their former values if schedule_delayed_work() failed.
      Otherwise the subsequent calls to __dst_free will test the wrong values
      and assume wrong thing about when the garbage collector is supposed to
      be scheduled.
      
      dst_gc_task() also calls schedule_delayed_work() without checking
      its return code (or calling cancel_scheduled_work() first), but it
      should fine there: dst_gc_task is the routine of the delayed_work, so
      no dst_gc_work should be pending in the queue when it's running.
      Signed-off-by: NBenjamin Thery <benjamin.thery@bull.net>
      Acked-by: NEric Dumazet <dada1@cosmosbay.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f262b59b
  2. 12 9月, 2008 38 次提交