1. 31 Oct, 2007 6 commits
    • David S. Miller's avatar
      [NET]: Fix incorrect sg_mark_end() calls. · 51c739d1
      David S. Miller authored
      This fixes scatterlist corruptions added by
      
      	commit 68e3f5dd
      	[CRYPTO] users: Fix up scatterlist conversion errors
      
      The issue is that the code calls sg_mark_end() which clobbers the
      sg_page() pointer of the final scatterlist entry.
      
      The first part fo the fix makes skb_to_sgvec() do __sg_mark_end().
      
      After considering all skb_to_sgvec() call sites the most correct
      solution is to call __sg_mark_end() in skb_to_sgvec() since that is
      what all of the callers would end up doing anyways.
      
      I suspect this might have fixed some problems in virtio_net which is
      the sole non-crypto user of skb_to_sgvec().
      
      Other similar sg_mark_end() cases were converted over to
      __sg_mark_end() as well.
      
      Arguably sg_mark_end() is a poorly named function because it doesn't
      just "mark", it clears out the page pointer as a side effect, which is
      what led to these bugs in the first place.
      
      The one remaining plain sg_mark_end() call is in scsi_alloc_sgtable()
      and arguably it could be converted to __sg_mark_end() if only so that
      we can delete this confusing interface from linux/scatterlist.h
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      51c739d1
    • Alexey Dobriyan's avatar
      [IPVS]: Remove /proc/net/ip_vs_lblcr · 07afa040
      Alexey Dobriyan authored
      It's under CONFIG_IP_VS_LBLCR_DEBUG option which never existed.
      Signed-off-by: default avatarAlexey Dobriyan <adobriyan@sw.ru>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07afa040
    • Daniel Lezcano's avatar
      [IPV6]: remove duplicate call to proc_net_remove · 1675c7b2
      Daniel Lezcano authored
      The file /proc/net/if_inet6 is removed twice.
      First time in:
              inet6_exit
                   ->addrconf_cleanup
      And followed a few lines after by:
              inet6_exit
                   -> if6_proc_exit
      Signed-off-by: default avatarDaniel Lezcano <dlezcano@fr.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1675c7b2
    • Daniel Lezcano's avatar
      [NETNS]: fix net released by rcu callback · 310928d9
      Daniel Lezcano authored
      When a network namespace reference is held by a network subsystem,
      and when this reference is decremented in a rcu update callback, we
      must ensure that there is no more outstanding rcu update before
      trying to free the network namespace.
      
      In the normal case, the rcu_barrier is called when the network namespace
      is exiting in the cleanup_net function.
      
      But when a network namespace creation fails, and the subsystems are
      undone (like the cleanup), the rcu_barrier is missing.
      
      This patch adds the missing rcu_barrier.
      Signed-off-by: default avatarDaniel Lezcano <dlezcano@fr.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      310928d9
    • Daniel Lezcano's avatar
      [NET]: Fix free_netdev on register_netdev failure. · 93ee31f1
      Daniel Lezcano authored
      Point 1:
      The unregistering of a network device schedule a netdev_run_todo.
      This function calls dev->destructor when it is set and the
      destructor calls free_netdev.
      
      Point 2:
      In the case of an initialization of a network device the usual code
      is:
       * alloc_netdev
       * register_netdev
          -> if this one fails, call free_netdev and exit with error.
      
      Point 3:
      In the register_netdevice function at the later state, when the device
      is at the registered state, a call to the netdevice_notifiers is made.
      If one of the notification falls into an error, a rollback to the
      registered state is done using unregister_netdevice.
      
      Conclusion:
      When a network device fails to register during initialization because
      one network subsystem returned an error during a notification call
      chain, the network device is freed twice because of fact 1 and fact 2.
      The second free_netdev will be done with an invalid pointer.
      
      Proposed solution:
      The following patch move all the code of unregister_netdevice *except*
      the call to net_set_todo, to a new function "rollback_registered".
      
      The following functions are changed in this way:
       * register_netdevice: calls rollback_registered when a notification fails
       * unregister_netdevice: calls rollback_register + net_set_todo, the call
                               order to net_set_todo is changed because it is the
                               latest now. Since it justs add an element to a list
                               that should not break anything.
      Signed-off-by: default avatarDaniel Lezcano <dlezcano@fr.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      93ee31f1
    • Adrian Bunk's avatar
      5c41542b
  2. 30 Oct, 2007 34 commits