Skip to content

L
linux-davinci
Switch branch/tag
  1. 09 Jun, 2009 1 commit
  3. 02 Jun, 2009 3 commits
    • Minoru Usui's avatar
      net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel... · 12186be7
      Minoru Usui authored 
      net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup

This patch fixes a bug which unconfigured struct tcf_proto keeps
chaining in tc_ctl_tfilter(), and avoids kernel panic in
cls_cgroup_classify() when we use cls_cgroup.

When we execute 'tc filter add', tcf_proto is allocated, initialized
by classifier's init(), and chained.  After it's chained,
tc_ctl_tfilter() calls classifier's change().  When classifier's
change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.

In addition, cls_cgroup is initialized in change() not in init().  It
accesses unconfigured struct tcf_proto which is chained before
change(), then hits Oops.
Signed-off-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: default avatarJamal Hadi Salim <hadi@cyberus.ca>
Tested-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12186be7
    • Neil Horman's avatar
      e1000: add missing length check to e1000 receive routine · ea30e119
      Neil Horman authored 
      	Patch to fix bad length checking in e1000.  E1000 by default does two
things:

1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
doing an skb_put

Since the e1000 driver isn't written to support receiving packets that span
multiple rx buffers, it checks the End of Packet bit of every frame, and
discards it if its not set.  This places us in a situation where, if we have a
spanning packet, the first part is discarded, but the second part is not (since
it is the end of packet, and it passes the EOP bit test).  If the second part of
the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
underflow the length, and wind up in skb_over_panic, when we try to skb_put a
huge number of bytes into the skb.  This amounts to a remote DOS attack through
careful selection of frame size in relation to interface MTU.  The fix for this
is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
small frames from causing the underflow described above
Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Tested-by: default avatarAndy Gospodarek <andy@greyhouse.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea30e119
    • Ed Swierk's avatar
      forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) · 5a9a8e32
      Ed Swierk authored 
      Add a phy_power_down parameter to forcedeth: set to 1 to power down the
phy and disable the link when an interface goes down; set to 0 to always
leave the phy powered up.

The phy power state persists across reboots; Windows, some BIOSes, and
older versions of Linux don't bother to power up the phy again, forcing
users to remove all power to get the interface working (see
http://bugzilla.kernel.org/show_bug.cgi?id=13072).  Leaving the phy
powered on is the safest default behavior.  Users accustomed to seeing
the link state reflect the interface state and/or wanting to minimize
power consumption can set phy_power_down=1 if compatibility with other
OSes is not an issue.
Signed-off-by: default avatarEd Swierk <eswierk@aristanetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a9a8e32
  5. 01 Jun, 2009 3 commits
  7. 30 May, 2009 4 commits
  9. 29 May, 2009 5 commits
  11. 27 May, 2009 8 commits
  13. 26 May, 2009 4 commits
  15. 25 May, 2009 3 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_dccp: add missing DCCP protocol changes in event cache · b38b1f61
      Pablo Neira Ayuso authored 
      This patch adds the missing protocol state-change event reporting
for DCCP.

$ sudo conntrack -E
    [NEW] dccp     33 240 src=192.168.0.2 dst=192.168.1.2 sport=57040 dport=5001 [UNREPLIED] src=192.168.1.2 dst=192.168.1.100 sport=5001 dport=57040

With this patch:

$ sudo conntrack -E
    [NEW] dccp     33 240 REQUEST src=192.168.0.2 dst=192.168.1.2 sport=57040 dport=5001 [UNREPLIED] src=192.168.1.2 dst=192.168.1.100 sport=5001 dport=57040
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      b38b1f61
    • Jozsef Kadlecsik's avatar
      netfilter: nf_ct_tcp: fix accepting invalid RST segments · bfcaa502
      Jozsef Kadlecsik authored 
      Robert L Mathews discovered that some clients send evil TCP RST segments,
which are accepted by netfilter conntrack but discarded by the
destination. Thus the conntrack entry is destroyed but the destination
retransmits data until timeout.

The same technique, i.e. sending properly crafted RST segments, can easily
be used to bypass connlimit/connbytes based restrictions (the sample
script written by Robert can be found in the netfilter mailing list
archives).

The patch below adds a new flag and new field to struct ip_ct_tcp_state so
that checking RST segments can be made more strict and thus TCP conntrack
can catch the invalid ones: the RST segment is accepted only if its
sequence number higher than or equal to the highest ack we seen from the
other direction. (The last_ack field cannot be reused because it is used
to catch resent packets.)
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      bfcaa502
    • Lennert Buytenhek's avatar
      gianfar: fix BUG under load after introduction of skb recycling · 4e2fd555
      Lennert Buytenhek authored 
      Since commit 0fd56bb5 ("gianfar:
Add support for skb recycling"), gianfar puts skbuffs that are in
the rx ring back onto the recycle list as-is in case there was a
receive error, but this breaks the following invariant: that all
skbuffs on the recycle list have skb->data = skb->head + NET_SKB_PAD.

The RXBUF_ALIGNMENT realignment done in gfar_new_skb() will be done
twice on skbuffs recycled in this way, causing there not to be enough
room in the skb anymore to receive a full packet, eventually leading
to an skb_over_panic from gfar_clean_rx_ring() -> skb_put().

Resetting the skb->data pointer to skb->head + NET_SKB_PAD before
putting the skb back onto the recycle list restores the mentioned
invariant, and should fix this issue.
Reported-by: default avatarMichael Guntsche <mike@it-loops.com>
Tested-by: default avatarMichael Guntsche <mike@it-loops.com>
Signed-off-by: default avatarLennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e2fd555
  17. 22 May, 2009 1 commit
    • Inaky Perez-Gonzalez's avatar
      wimax/i2400m: usb: fix device reset on autosuspend while not yet idle · e069c0cf
      Inaky Perez-Gonzalez authored 
      When the i2400m is connected to a network, the host interface (USB)
cannot be suspended. For that to happen, the device has to have
negotiated with the basestation to put the link on IDLE state.

If the host tries to put the device in standby while it is connected
but not idle, the device resets, as the driver should not do that.

To avoid triggering that, when the USB susbsytem requires the driver
to autosuspend the device, the driver checks if the device is not yet
idle. If it is not, the request is rejected (will be retried again
later on after the autosuspend timeout). At some point the device will
enter idle and the request will succeed (unless of course, there is
network traffic, but at that point, there is no idle neither in the
link or the host interface).
Signed-off-by: default avatarInaky Perez-Gonzalez <inaky@linux.intel.com>
      e069c0cf
  19. 21 May, 2009 8 commits