Skip to content

K
Kernel

openeuler / Kernel
大约 1 年 前同步成功

通知 5
Star 0
Fork 0
K
Kernel

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 03 12月, 2006 1 次提交
  3. 02 12月, 2006 1 次提交
  5. 08 11月, 2006 2 次提交
  7. 06 11月, 2006 2 次提交
  9. 31 10月, 2006 1 次提交
    • H
      [NET]: Fix segmentation of linear packets · c8884edd
      由 Herbert Xu 提交于 
      skb_segment fails to segment linear packets correctly because it
tries to write all linear parts of the original skb into each
segment.  This will always panic as each segment only contains
enough space for one MSS.

This was not detected earlier because linear packets should be
rare for GSO.  In fact it still remains to be seen what exactly
created the linear packets that triggered this bug.  Basically
the only time this should happen is if someone enables GSO
emulation on an interface that does not support SG.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c8884edd
  11. 20 10月, 2006 2 次提交
  13. 17 10月, 2006 1 次提交
  15. 12 10月, 2006 3 次提交
    • P
      [RTNETLINK]: Fix use of wrong skb in do_getlink() · b974179a
      由 Patrick McHardy 提交于 
      skb is the netlink query, nskb is the reply message.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b974179a
    • M
      [NET]: File descriptor loss while receiving SCM_RIGHTS · effee6a0
      由 Miklos Szeredi 提交于 
      If more than one file descriptor was sent with an SCM_RIGHTS message,
and on the receiving end, after installing a nonzero (but not all)
file descritpors the process runs out of fds, then the already
installed fds will be lost (userspace will have no way of knowing
about them).

The following patch makes sure, that at least the already installed
fds are sent to userspace.  It doesn't solve the issue of losing file
descriptors in case of an EFAULT on the userspace buffer.
Signed-off-by: NMiklos Szeredi <miklos@szeredi.hu>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      effee6a0
    • J
      IPsec: propagate security module errors up from flow_cache_lookup · 134b0fc5
      由 James Morris 提交于 
      When a security module is loaded (in this case, SELinux), the
security_xfrm_policy_lookup() hook can return an access denied permission
(or other error).  We were not handling that correctly, and in fact
inverting the return logic and propagating a false "ok" back up to
xfrm_lookup(), which then allowed packets to pass as if they were not
associated with an xfrm policy.

The way I was seeing the problem was when connecting via IPsec to a
confined service on an SELinux box (vsftpd), which did not have the
appropriate SELinux policy permissions to send packets via IPsec.

The first SYNACK would be blocked, because of an uncached lookup via
flow_cache_lookup(), which would fail to resolve an xfrm policy because
the SELinux policy is checked at that point via the resolver.

However, retransmitted SYNACKs would then find a cached flow entry when
calling into flow_cache_lookup() with a null xfrm policy, which is
interpreted by xfrm_lookup() as the packet not having any associated
policy and similarly to the first case, allowing it to pass without
transformation.

The solution presented here is to first ensure that errno values are
correctly propagated all the way back up through the various call chains
from security_xfrm_policy_lookup(), and handled correctly.

Then, flow_cache_lookup() is modified, so that if the policy resolver
fails (typically a permission denied via the security module), the flow
cache entry is killed rather than having a null policy assigned (which
indicates that the packet can pass freely).  This also forces any future
lookups for the same flow to consult the security module (e.g. SELinux)
for current security policy (rather than, say, caching the error on the
flow cache entry).
Signed-off-by: NJames Morris <jmorris@namei.org>
      134b0fc5
  17. 11 10月, 2006 1 次提交
  19. 04 10月, 2006 3 次提交
  21. 29 9月, 2006 8 次提交
  23. 26 9月, 2006 1 次提交
    • J
      [PATCH] WE-21 support (core API) · baef1865
      由 John W. Linville 提交于 
      This is version 21 of the Wireless Extensions. Changelog :
	o finishes migrating the ESSID API (remove the +1)
	o netdev->get_wireless_stats is no more
	o long/short retry

This is a redacted version of a patch originally submitted by Jean
Tourrilhes.  I removed most of the additions, in order to minimize
future support requirements for nl80211 (or other WE successor).

CC: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      baef1865
  25. 23 9月, 2006 14 次提交