linux-toradex.git, branch v2.6.16.45

Linux 2.6.16.45

2007-03-24T22:57:05+00:00

Linux 2.6.16.45-rc1

2007-03-24T20:54:43+00:00

[NETFILTER]: tcp conntrack: accept SYN|URG as valid

2007-03-24T20:36:52+00:00

Some stacks apparently send packets with SYN|URG set. Linux accepts
these packets, so TCP conntrack should to.

Pointed out by Martijn Posthuma .

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix use after free

2007-03-24T20:36:24+00:00

Paranoia: instance_put() might have freed the inst pointer when we
spin_unlock_bh().

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix reference leak

2007-03-24T20:34:37+00:00

Stop reference leaking in nfulnl_log_packet(). If we start a timer we
are already taking another reference.

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference

2007-03-24T20:33:56+00:00

Eliminate possible NULL pointer dereference in nfulnl_recv_config().

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix NULL pointer dereference

2007-03-24T20:32:13+00:00

Fix the nasty NULL dereference on multiple packets per netlink message.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000004
 printing eip:
f8a4b3bf
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: nfnetlink_log ipt_ttl ipt_REDIRECT xt_tcpudp iptable_nat nf_nat nf_conntrack
_ipv4 xt_state ipt_ipp2p xt_NFLOG xt_hashlimit ip6_tables iptable_filter xt_multiport xt_mark i
pt_set iptable_raw xt_MARK iptable_mangle ip_tables cls_fw cls_u32 sch_esfq sch_htb ip_set_ipma
p ip_set ipt_ULOG x_tables dm_snapshot dm_mirror loop e1000 parport_pc parport e100 floppy ide_
cd cdrom
CPU:    0
EIP:    0060:[]    Not tainted VLI
EFLAGS: 00010206   (2.6.20 #5)
EIP is at __nfulnl_send+0x24/0x51 [nfnetlink_log]
eax: 00000000   ebx: f2b5cbc0   ecx: c03f5f54   edx: c03f4000
esi: f2b5cbc8   edi: c03f5f54   ebp: f8a4b3ec   esp: c03f5f30
ds: 007b   es: 007b   ss: 0068
Process swapper (pid: 0, ti=c03f4000 task=c03bece0 task.ti=c03f4000)
Stack: f2b5cbc0 f8a4b401 00000100 c0444080 c012af49 00000000 f6f19100 f6f19000
       c1707800 c03f5f54 c03f5f54 00000123 00000021 c03e8d08 c0426380 00000009
       c0126932 00000000 00000046 c03e9980 c03e6000 0047b007 c01269bd 00000000
Call Trace:
 [] nfulnl_timer+0x15/0x25 [nfnetlink_log]
 [] run_timer_softirq+0x10a/0x164
 [] __do_softirq+0x60/0xba
 [] do_softirq+0x31/0x35
 [] do_IRQ+0x62/0x74
 [] common_interrupt+0x23/0x28
 [] default_idle+0x0/0x3f
 [] default_idle+0x2d/0x3f
 [] cpu_idle+0xa0/0xb9
 [] start_kernel+0x1a8/0x1ac
 [] unknown_bootoption+0x0/0x181
 =======================
Code: 5e 5f 5b 5e 5f 5d c3 53 89 c3 8d 40 1c 83 7b 1c 00 74 05 e8 2c ee 6d c7 83 7b 14 00 75 04
 31 c0 eb 34 83 7b 10 01 76 09 8b 43 18 <66> c7 40 04 03 00 8b 53 34 8b 43 14 b9 40 00 00 00 e8
 08 9a 84
EIP: [] __nfulnl_send+0x24/0x51 [nfnetlink_log] SS:ESP 0068:c03f5f30
 <0>Kernel panic - not syncing: Fatal exception in interrupt
 <0>Rebooting in 5 seconds..

Panic no more!

Signed-off-by: Michał Mirosław 
Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nfnetlink_log: fix crash on bridged packet

2007-03-24T20:30:53+00:00

physoutdev is only set on purely bridged packet, when nfnetlink_log is used
in the OUTPUT/FORWARD/POSTROUTING hooks on packets forwarded from or to a
bridge it crashes when trying to dereference skb->nf_bridge->physoutdev.

Reported by Holger Eitzenberger 

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[NETFILTER]: nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED

2007-03-24T20:30:06+00:00

The individual fragments of a packet reassembled by conntrack have the
conntrack reference from the reassembled packet attached, but nfctinfo
is not copied. This leaves it initialized to 0, which unfortunately is
the value of IP_CT_ESTABLISHED.

The result is that all IPv6 fragments are tracked as ESTABLISHED,
allowing them to bypass a usual ruleset which accepts ESTABLISHED
packets early.

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

Fix reference counting (memory leak) problem in __nfulnl_send() and callers related to packet queueing.

2007-03-24T20:27:27+00:00

Signed-off-by: Michał Mirosław 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Adrian Bunk