linux-toradex.git/include/linux/skbuff.h, branch v2.6.16.50

[IFB]: Fix crash on input device removal

2007-04-03T02:03:55+00:00

The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().

Fix by storing the interface index instead and do a lookup where neccessary.

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

remove garbage the sneaked into the ext3 fix

2006-12-04T11:18:43+00:00

Spotted by Thomas Voegtle.

Signed-off-by: Adrian Bunk

add forgotten ->b_data in memcpy() call in ext3/resize.c (oopsable)

2006-11-29T10:40:22+00:00

sbi->s_group_desc is an array of pointers to buffer_head.  memcpy() of
buffer size from address of buffer_head is a bad idea - it will generate
junk in any case, may oops if buffer_head is close to the end of slab
page and next page is not mapped and isn't what was intended there.
IOW, ->b_data is missing in that call.  Fortunately, result doesn't go
into the primary on-disk data structures, so only backup ones get crap
written to them; that had allowed this bug to remain unnoticed until
now.

Signed-off-by: Al Viro 
Signed-off-by: Adrian Bunk

[NET]: Update frag_list in pskb_trim

2006-11-10T23:15:10+00:00

When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of
the packet, the frag_list is not updated to reflect the trimming.  This
will usually work fine until you hit something that uses the packet length
or tail from the frag_list.

Examples include esp_output and ip_fragment.

Another problem caused by this is that you can end up with a linear packet
with a frag_list attached.

It is possible to get away with this if we audit everything to make sure
that they always consult skb->len before going down onto frag_list.  In
fact we can do the samething for the paged part as well to avoid copying
the data area of the skb.  For now though, let's do the conservative fix
and update frag_list.

Many thanks to Marco Berizzi for helping me to track down this bug.

This 4-year old bug took 3 months to track down.  Marco was very patient
indeed :)

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[NET]: Make second arg to skb_reserved() signed.

2006-01-17T10:54:21+00:00

Some subsystems, such as PPP, can send negative values
here.  It just happened to work correctly on 32-bit with
an unsigned value, but on 64-bit this explodes.

Figured out by Paul Mackerras based upon several PPP crash
reports.

Signed-off-by: David S. Miller

[NETFILTER]: Fix xfrm lookup in ip_route_me_harder/ip6_route_me_harder

2006-01-07T20:57:33+00:00

ip_route_me_harder doesn't use the port numbers of the xfrm lookup and
uses ip_route_input for non-local addresses which doesn't do a xfrm
lookup, ip6_route_me_harder doesn't do a xfrm lookup at all.

Use xfrm_decode_session and do the lookup manually, make sure both
only do the lookup if the packet hasn't been transformed already.

Makeing sure the lookup only happens once needs a new field in the
IP6CB, which exceeds the size of skb->cb. The size of skb->cb is
increased to 48b. Apparently the IPv6 mobile extensions need some
more room anyway.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NET]: Speed up __alloc_skb()

2006-01-03T22:06:50+00:00

From: Benjamin LaHaise 

In __alloc_skb(), the use of skb_shinfo() which casts a u8 * to the 
shared info structure results in gcc being forced to do a reload of the 
pointer since it has no information on possible aliasing.  Fix this by 
using a pointer to refer to skb_shared_info.

By initializing skb_shared_info sequentially, the write combining buffers 
can reduce the number of memory transactions to a single write.  Reorder 
the initialization in __alloc_skb() to match the structure definition.  
There is also an alignment issue on 64 bit systems with skb_shared_info 
by converting nr_frags to a short everything packs up nicely.

Also, pass the slab cache pointer according to the fclone flag instead 
of using two almost identical function calls.

This raises bw_unix performance up to a peak of 707KB/s when combined 
with the spinlock patch.  It should help other networking protocols, too.

Signed-off-by: David S. Miller

[NET]: Small cleanup to socket initialization

2006-01-03T21:11:14+00:00

sock_init can be done as a core_initcall instead of calling
it directly in init/main.c

Also I removed an out of date #ifdef.

Signed-off-by: Andi Kleen 
Signed-off-by: David S. Miller

[IP]: Simplify and consolidate MSG_PEEK error handling

2006-01-03T21:10:41+00:00

When a packet is obtained from skb_recv_datagram with MSG_PEEK enabled
it is left on the socket receive queue.  This means that when we detect
a checksum error we have to be careful when trying to free the packet
as someone could have dequeued it in the time being.

Currently this delicate logic is duplicated three times between UDPv4,
UDPv6 and RAWv6.  This patch moves them into a one place and simplifies
the code somewhat.

This is based on a suggestion by Eric Dumazet.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NET]: kernel-doc fixes

2005-11-21T05:25:15+00:00

Fix kernel-doc warnings in network files.

Signed-off-by: Randy Dunlap 
Signed-off-by: David S. Miller