Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 16 11月, 2010 11 次提交
  3. 15 11月, 2010 6 次提交
    • G
      dccp ccid-2: Separate option parsing from CCID processing · 7e87fe84
      由 Gerrit Renker 提交于 
      This patch replaces an almost identical replication of code: large parts
of dccp_parse_options() re-appeared as ccid2_ackvector() in ccid2.c.

Apart from the duplication, this caused two more problems:
 1. CCIDs should not need to be concerned with parsing header options;
 2. one can not assume that Ack Vectors appear as a contiguous area within an
    skb, it is legal to insert other options and/or padding in between. The
    current code would throw an error and stop reading in such a case.

Since Ack Vectors provide CCID-specific information, they are now processed
by the CCID directly, separating this functionality from the main DCCP code.
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      7e87fe84
    • G
      dccp ccid-2: Remove old infrastructure · 52394eec
      由 Gerrit Renker 提交于 
      This removes
 * functions for which updates have been provided in the preceding patches and
 * the @av_vec_len field - it is no longer necessary since the buffer length is
   now always computed dynamically.
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      52394eec
    • G
      dccp ccid-2: Schedule Sync as out-of-band mechanism · d83447f0
      由 Gerrit Renker 提交于 
      The problem with Ack Vectors is that
  i) their length is variable and can in principle grow quite large,
 ii) it is hard to predict exactly how large they will be.

Due to the second point it seems not a good idea to reduce the MPS; in
particular when on average there is enough room for the Ack Vector and an
increase in length is momentarily due to some burst loss, after which the
Ack Vector returns to its normal/average length.

The solution taken by this patch is to subtract a minimum-expected Ack Vector
length from the MPS, and to defer any larger Ack Vectors onto a separate
Sync - but only if indeed there is no space left on the skb.

This patch provides the infrastructure to schedule Sync-packets for transporting
(urgent) out-of-band data. Its signalling is quicker than scheduling an Ack, since
it does not need to wait for new application data.
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      d83447f0
    • G
      dccp ccid-2: Consolidate Ack-Vector processing within main DCCP module · 18219463
      由 Gerrit Renker 提交于 
      This aggregates Ack Vector processing (handling input and clearing old state)
into one function, for the following reasons and benefits:
 * all Ack Vector-specific processing is now in one place;
 * duplicated code is removed;
 * ensuring sanity: from an Ack Vector point of view, it is better to clear the
                    old state first before entering new state;
 * Ack Event handling happens mostly within the CCIDs, not the main DCCP module.
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      18219463
    • G
      dccp ccid-2: Update code for the Ack Vector input/registration routine · 38024086
      由 Gerrit Renker 提交于 
      This patch updates the code which registers new packets as received, using the
new circular buffer interface. It contributes a new algorithm which
 * supports both tail/head pointers and buffer wrap-around and
 * deals with overflow (head/tail move in lock-step).
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      38024086
    • G
      dccp ccid-2: Algorithm to update buffer state · 5753fdfe
      由 Gerrit Renker 提交于 
      This provides a routine to consistently update the buffer state when the
peer acknowledges receipt of Ack Vectors; updating state in the list of Ack
Vectors as well as in the circular buffer.

While based on RFC 4340, several additional (and necessary) precautions were
added to protect the consistency of the buffer state. These additions are
essential, since analysis and experience showed that the basic algorithm was
insufficient for this task (which lead to problems that were hard to debug).

The algorithm now
 * deals with HC-sender acknowledging to HC-receiver and vice versa,
 * keeps track of the last unacknowledged but received seqno in tail_ackno,
 * has special cases to reset the overflow condition when appropriate,
 * is protected against receiving older information (would mess up buffer state).
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      5753fdfe
  5. 13 11月, 2010 9 次提交
  7. 12 11月, 2010 3 次提交
  9. 11 11月, 2010 8 次提交
    • D
      tcp: Increase TCP_MAXSEG socket option minimum. · 7a1abd08
      由 David S. Miller 提交于 
      As noted by Steve Chen, since commit
f5fff5dc ("tcp: advertise MSS
requested by user") we can end up with a situation where
tcp_select_initial_window() does a divide by a zero (or
even negative) mss value.

The problem is that sometimes we effectively subtract
TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss.

Fix this by increasing the minimum from 8 to 64.
Reported-by: NSteve Chen <schen@mvista.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7a1abd08
    • G
      dccp ccid-2: Implementation of circular Ack Vector buffer with overflow handling · b3d14bff
      由 Gerrit Renker 提交于 
      This completes the implementation of a circular buffer for Ack Vectors, by
extending the current (linear array-based) implementation.  The changes are:

 (a) An `overflow' flag to deal with the case of overflow. As before, dynamic
     growth of the buffer will not be supported; but code will be added to deal
     robustly with overflowing Ack Vector buffers.

 (b) A `tail_seqno' field. When naively implementing the algorithm of Appendix A
     in RFC 4340, problems arise whenever subsequent Ack Vector records overlap,
     which can bring the entire run length calculation completely out of synch.
     (This is documented on http://www.erg.abdn.ac.uk/users/gerrit/dccp/notes/\
                                             ack_vectors/tracking_tail_ackno/ .)
 (c) The buffer length is now computed dynamically (i.e. current fill level),
     as the span between head to tail.

As a result, dccp_ackvec_pending() is now simpler - the #ifdef is no longer
necessary since buf_empty is always true when IP_DCCP_ACKVEC is not configured.
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      b3d14bff
    • G
      dccp ccid-2: Separate internals of Ack Vectors from option-parsing code · 7d870936
      由 Gerrit Renker 提交于 
      This patch
 * separates Ack Vector housekeeping code from option-insertion code;
 * shifts option-specific code from ackvec.c into options.c;
 * introduces a dedicated routine to take care of the Ack Vector records;
 * simplifies the dccp_ackvec_insert_avr() routine: the BUG_ON was redundant,
   since the list is automatically arranged in descending order of ack_seqno.
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      7d870936
    • G
      dccp ccid-2: Ack Vector interface clean-up · f17a37c9
      由 Gerrit Renker 提交于 
      This patch brings the Ack Vector interface up to date. Its main purpose is
to lay the basis for the subsequent patches of this set, which will use the
new data structure fields and routines.

There are no real algorithmic changes, rather an adaptation:

 (1) Replaced the static Ack Vector size (2) with a #define so that it can
     be adapted (with low loss / Ack Ratio, a value of 1 works, so 2 seems
     to be sufficient for the moment) and added a solution so that computing
     the ECN nonce will continue to work - even with larger Ack Vectors.

 (2) Replaced the #defines for Ack Vector states with a complete enum.

 (3) Replaced #defines to compute Ack Vector length and state with general
     purpose routines (inlines), and updated code to use these.

 (4) Added a `tail' field (conversion to circular buffer in subsequent patch).

 (5) Updated the (outdated) documentation for Ack Vector struct.

 (6) All sequence number containers now trimmed to 48 bits.

 (7) Removal of unused bits:
     * removed dccpav_ack_nonce from struct dccp_ackvec, since this is already
       redundantly stored in the `dccpavr_ack_nonce' (of Ack Vector record);
     * removed Elapsed Time for Ack Vectors (it was nowhere used);
     * replaced semantics of dccpavr_sent_len with dccpavr_ack_runlen, since
       the code needs to be able to remember the old run length;
     * reduced the de-/allocation routines (redundant / duplicate tests).
Signed-off-by: NGerrit Renker <gerrit@erg.abdn.ac.uk>
      f17a37c9
    • E
      net: avoid limits overflow · 8d987e5c
      由 Eric Dumazet 提交于 
      Robin Holt tried to boot a 16TB machine and found some limits were
reached : sysctl_tcp_mem[2], sysctl_udp_mem[2]

We can switch infrastructure to use long "instead" of "int", now
atomic_long_t primitives are available for free.
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Reported-by: NRobin Holt <holt@sgi.com>
Reviewed-by: NRobin Holt <holt@sgi.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8d987e5c
    • V
      net: packet: fix information leak to userland · 67286640
      由 Vasiliy Kulikov 提交于 
      packet_getname_spkt() doesn't initialize all members of sa_data field of
sockaddr struct if strlen(dev->name) < 13.  This structure is then copied
to userland.  It leads to leaking of contents of kernel stack memory.
We have to fully fill sa_data with strncpy() instead of strlcpy().

The same with packet_getname(): it doesn't initialize sll_pkttype field of
sockaddr_ll.  Set it to zero.
Signed-off-by: NVasiliy Kulikov <segooon@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      67286640
    • D
      filter: make sure filters dont read uninitialized memory · 57fe93b3
      由 David S. Miller 提交于 
      There is a possibility malicious users can get limited information about
uninitialized stack mem array. Even if sk_run_filter() result is bound
to packet length (0 .. 65535), we could imagine this can be used by
hostile user.

Initializing mem[] array, like Dan Rosenberg suggested in his patch is
expensive since most filters dont even use this array.

Its hard to make the filter validation in sk_chk_filter(), because of
the jumps. This might be done later.

In this patch, I use a bitmap (a single long var) so that only filters
using mem[] loads/stores pay the price of added security checks.

For other filters, additional cost is a single instruction.

[ Since we access fentry->k a lot now, cache it in a local variable
  and mark filter entry pointer as const. -DaveM ]
Reported-by: NDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      57fe93b3
    • V
      net: ax25: fix information leak to userland · fe10ae53
      由 Vasiliy Kulikov 提交于 
      Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater
field of fsa struct, also the struct has padding bytes between
sax25_call and sax25_ndigis fields.  This structure is then copied to
userland.  It leads to leaking of contents of kernel stack memory.
Signed-off-by: NVasiliy Kulikov <segooon@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fe10ae53
  11. 10 11月, 2010 3 次提交