1. 01 12月, 2012 5 次提交
    • T
      sctp: fix CONFIG_SCTP_DBG_MSG=y null pointer dereference in sctp_v6_get_dst() · ee3f34e8
      Tommi Rantala 提交于
      Trinity (the syscall fuzzer) triggered the following BUG, reproducible
      only when the kernel is configured with CONFIG_SCTP_DBG_MSG=y.
      
      When CONFIG_SCTP_DBG_MSG is not set, the null pointer is never
      dereferenced.
      
      ---[ end trace a4de0bfcb38a3642 ]---
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000100
      IP: [<ffffffff8136796e>] ip6_string+0x1e/0xa0
      PGD 4eead067 PUD 4e472067 PMD 0
      Oops: 0000 [#1] PREEMPT SMP
      Modules linked in:
      CPU 3
      Pid: 21324, comm: trinity-child11 Tainted: G        W    3.7.0-rc7+ #61 ASUSTeK Computer INC. EB1012/EB1012
      RIP: 0010:[<ffffffff8136796e>]  [<ffffffff8136796e>] ip6_string+0x1e/0xa0
      RSP: 0018:ffff88004e4637a0  EFLAGS: 00010046
      RAX: ffff88004e4637da RBX: ffff88004e4637da RCX: 0000000000000000
      RDX: ffffffff8246e92a RSI: 0000000000000100 RDI: ffff88004e4637da
      RBP: ffff88004e4637a8 R08: 000000000000ffff R09: 000000000000ffff
      R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8289d600
      R13: ffffffff8289d230 R14: ffffffff8246e928 R15: ffffffff8289d600
      FS:  00007fed95153700(0000) GS:ffff88005fd80000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000100 CR3: 000000004eeac000 CR4: 00000000000007e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process trinity-child11 (pid: 21324, threadinfo ffff88004e462000, task ffff8800524b0000)
      Stack:
       ffff88004e4637da ffff88004e463828 ffffffff81368eee 000000004e4637d8
       ffffffff0000ffff ffff88000000ffff 0000000000000000 000000004e4637f8
       ffffffff826285d8 ffff88004e4637f8 0000000000000000 ffff8800524b06b0
      Call Trace:
       [<ffffffff81368eee>] ip6_addr_string.isra.11+0x3e/0xa0
       [<ffffffff81369183>] pointer.isra.12+0x233/0x2d0
       [<ffffffff810a413a>] ? vprintk_emit+0x1ba/0x450
       [<ffffffff8110953d>] ? trace_hardirqs_on_caller+0x10d/0x1a0
       [<ffffffff81369757>] vsnprintf+0x187/0x5d0
       [<ffffffff81369c62>] vscnprintf+0x12/0x30
       [<ffffffff810a4028>] vprintk_emit+0xa8/0x450
       [<ffffffff81e5cb00>] printk+0x49/0x4b
       [<ffffffff81d17221>] sctp_v6_get_dst+0x731/0x780
       [<ffffffff81d16e15>] ? sctp_v6_get_dst+0x325/0x780
       [<ffffffff81d00a96>] sctp_transport_route+0x46/0x120
       [<ffffffff81cff0f1>] sctp_assoc_add_peer+0x161/0x350
       [<ffffffff81d0fd8d>] sctp_sendmsg+0x6cd/0xcb0
       [<ffffffff81b55bf0>] ? inet_create+0x670/0x670
       [<ffffffff81b55cfb>] inet_sendmsg+0x10b/0x220
       [<ffffffff81b55bf0>] ? inet_create+0x670/0x670
       [<ffffffff81a72a64>] ? sock_update_classid+0xa4/0x2b0
       [<ffffffff81a72ab0>] ? sock_update_classid+0xf0/0x2b0
       [<ffffffff81a6ac1c>] sock_sendmsg+0xdc/0xf0
       [<ffffffff8118e9e5>] ? might_fault+0x85/0x90
       [<ffffffff8118e99c>] ? might_fault+0x3c/0x90
       [<ffffffff81a6e12a>] sys_sendto+0xfa/0x130
       [<ffffffff810a9887>] ? do_setitimer+0x197/0x380
       [<ffffffff81e960d5>] ? sysret_check+0x22/0x5d
       [<ffffffff81e960a9>] system_call_fastpath+0x16/0x1b
      Code: 01 eb 89 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 f8 31 c9 48 89 e5 53 eb 12 0f 1f 40 00 48 83 c1 01 48 83 c0 04 48 83 f9 08 74 70 <0f> b6 3c 4e 89 fb 83 e7 0f c0 eb 04 41 89 d8 41 83 e0 0f 0f b6
      RIP  [<ffffffff8136796e>] ip6_string+0x1e/0xa0
       RSP <ffff88004e4637a0>
      CR2: 0000000000000100
      ---[ end trace a4de0bfcb38a3643 ]---
      Signed-off-by: NTommi Rantala <tt.rantala@gmail.com>
      Acked-by: NVlad Yasevich <vyasevich@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ee3f34e8
    • A
      mac802154: use kfree_skb() instead of dev_kfree_skb() · 92a2ec72
      Alan Ott 提交于
      kfree_skb() indicates failure, which is where this is being used.
      Signed-off-by: NAlan Ott <alan@signal11.us>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      92a2ec72
    • A
      mac802154: fix memory leaks · fcefbe9f
      Alan Ott 提交于
      kfree_skb() was not getting called in the case of some failures.
      This was pointed out by Eric Dumazet.
      Signed-off-by: NAlan Ott <alan@signal11.us>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fcefbe9f
    • A
      6lowpan: consider checksum bytes in fragmentation threshold · b333b7e6
      Alan Ott 提交于
      Change the threshold for framentation of a lowpan packet from
      using the MTU size to now use the MTU size minus the checksum length,
      which is added by the hardware. For IEEE 802.15.4, this effectively
      changes it from 127 bytes to 125 bytes.
      Signed-off-by: NAlan Ott <alan@signal11.us>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b333b7e6
    • Y
      8021q: fix vlan device to inherit the unicast filtering capability flag · 6e22ce2c
      Yi Zou 提交于
      This bug is observed on running FCoE over a VLAN device associated w/
      a real device that has IFF_UNICAST_FLT set since FCoE would add unicast
      address such as FLOGI MAC to the VLAN interface that FCoE is on. Since
      currently, VLAN device is not inheriting the IFF_UNICAST_FLT flag from the
      parent real device even though the real device is capable of doing unicast
      filtering. This forces the VLAN device and its real device go to promiscuous
      mode unnecessarily even the added address is actually being added to the
      available unicast filter table in real device.
      Signed-off-by: NYi Zou <yi.zou@intel.com>
      Cc: devel@open-fcoe.org
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6e22ce2c
  2. 30 11月, 2012 2 次提交
  3. 29 11月, 2012 7 次提交
  4. 27 11月, 2012 8 次提交
    • E
      net: ipmr: limit MRT_TABLE identifiers · b49d3c1e
      Eric Dumazet 提交于
      Name of pimreg devices are built from following format :
      
      char name[IFNAMSIZ]; // IFNAMSIZ == 16
      
      sprintf(name, "pimreg%u", mrt->id);
      
      We must therefore limit mrt->id to 9 decimal digits
      or risk a buffer overflow and a crash.
      
      Restrict table identifiers in [0 ... 999999999] interval.
      Reported-by: NChen Gang <gang.chen@asianux.com>
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b49d3c1e
    • J
      ip6mr: Add sizeof verification to MRT6_ASSERT and MT6_PIM · 03f52a0a
      Joe Perches 提交于
      Verify the length of the user-space arguments.
      Signed-off-by: NJoe Perches <joe@perches.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      03f52a0a
    • N
      ipv4: avoid passing NULL to inet_putpeer() in icmpv4_xrlim_allow() · e1a67642
      Neal Cardwell 提交于
      inet_getpeer_v4() can return NULL under OOM conditions, and while
      inet_peer_xrlim_allow() is OK with a NULL peer, inet_putpeer() will
      crash.
      
      This code path now uses the same idiom as the others from:
      1d861aa4 ("inet: Minimize use of
      cached route inetpeer.").
      Signed-off-by: NNeal Cardwell <ncardwell@google.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e1a67642
    • B
      sockopt: Change getsockopt() of SO_BINDTODEVICE to return an interface name · c91f6df2
      Brian Haley 提交于
      Instead of having the getsockopt() of SO_BINDTODEVICE return an index, which
      will then require another call like if_indextoname() to get the actual interface
      name, have it return the name directly.
      
      This also matches the existing man page description on socket(7) which mentions
      the argument being an interface name.
      
      If the value has not been set, zero is returned and optlen will be set to zero
      to indicate there is no interface name present.
      
      Added a seqlock to protect this code path, and dev_ifname(), from someone
      changing the device name via dev_change_name().
      
      v2: Added seqlock protection while copying device name.
      
      v3: Fixed word wrap in patch.
      Signed-off-by: NBrian Haley <brian.haley@hp.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c91f6df2
    • D
      atm: br2684: Fix excessive queue bloat · ae088d66
      David Woodhouse 提交于
      There's really no excuse for an additional wmem_default of buffering
      between the netdev queue and the ATM device. Two packets (one in-flight,
      and one ready to send) ought to be fine. It's not as if it should take
      long to get another from the netdev queue when we need it.
      
      If necessary we can make the queue space configurable later, but I don't
      think it's likely to be necessary.
      
      cf. commit 9d02daf7 (pppoatm: Fix
      excessive queue bloat) which did something very similar for PPPoATM.
      
      Note that there is a tremendously unlikely race condition which may
      result in qspace temporarily going negative. If a CPU running the
      br2684_pop() function goes off into the weeds for a long period of time
      after incrementing qspace to 1, but before calling netdev_wake_queue()...
      and another CPU ends up calling br2684_start_xmit() and *stopping* the
      queue again before the first CPU comes back, the netdev queue could
      end up being woken when qspace has already reached zero.
      
      An alternative approach to coping with this race would be to check in
      br2684_start_xmit() for qspace==0 and return NETDEV_TX_BUSY, but just
      using '> 0' and '< 1' for comparison instead of '== 0' and '!= 0' is
      simpler. It just warranted a mention of *why* we do it that way...
      
      Move the call to atmvcc->send() to happen *after* the accounting and
      potentially stopping the netdev queue, in br2684_xmit_vcc(). This matters
      if the ->send() call suffers an immediate failure, because it'll call
      br2684_pop() with the offending skb before returning. We want that to
      happen *after* we've done the initial accounting for the packet in
      question. Also make it return an appropriate success/failure indication
      while we're at it.
      
      Tested by running 'ping -l 1000 bottomless.aaisp.net.uk' from within my
      network, with only a single PPPoE-over-BR2684 link running. And after
      setting txqueuelen on the nas0 interface to something low (5, in fact).
      Before the patch, we'd see about 15 packets being queued and a resulting
      latency of ~56ms being reached. After the patch, we see only about 8,
      which is fairly much what we expect. And a max latency of ~36ms. On this
      OpenWRT box, wmem_default is 163840.
      Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>
      Reviewed-by: NKrzysztof Mazur <krzysiek@podlesie.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ae088d66
    • B
      dsa: Hide core config options; make drivers select what they need · b3422a31
      Ben Hutchings 提交于
      Commit 82167cb8 ('net: dsa/slave: Fix
      compilation warnings') fixed one possible invalid configuration
      (NET_DSA enabled with no trailer formats) but added others: drivers
      can select NET_DSA without its dependencies being met.
      
      It's not very useful to make either the DSA core or the tagging
      formats manually selectable without a driver to use them, so:
      
      1. Define a hidden HAVE_NET_DSA option and move the dependencies of
         NET_DSA to that.  While we're at it, drop the deprecated
         EXPERIMENTAL dependency.
      2. Make NET_DSA and the drivers dependent on HAVE_NET_DSA.
      3. Hide the tagging format options again.
      4. Make drivers select both NET_DSA and the appropriate tagging format
         option.
      Signed-off-by: NBen Hutchings <bhutchings@solarflare.com>
      Acked-by: NRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b3422a31
    • O
      can: bcm: initialize ifindex for timeouts without previous frame reception · 81b40110
      Oliver Hartkopp 提交于
      Set in the rx_ifindex to pass the correct interface index in the case of a
      message timeout detection. Usually the rx_ifindex value is set at receive
      time. But when no CAN frame has been received the RX_TIMEOUT notification
      did not contain a valid value.
      
      Cc: linux-stable <stable@vger.kernel.org>
      Reported-by: NAndre Naujoks <nautsch2@googlemail.com>
      Signed-off-by: NOliver Hartkopp <socketcan@hartkopp.net>
      Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
      81b40110
    • A
      openvswitch: add skb mark matching and set action · 39c7caeb
      Ansis Atteka 提交于
      This patch adds support for skb mark matching and set action.
      Signed-off-by: NAnsis Atteka <aatteka@nicira.com>
      Signed-off-by: NJesse Gross <jesse@nicira.com>
      39c7caeb
  5. 26 11月, 2012 18 次提交