linux-toradex.git/include/net, branch v2.6.16.46

[NET_SCHED]: Fix endless loops caused by inaccurate qlen counters

2007-03-28T19:31:36+00:00

There are multiple problems related to qlen adjustment that can lead
to an upper qdisc getting out of sync with the real number of packets
queued, leading to endless dequeueing attempts by the upper layer code.

All qdiscs must maintain an accurate q.qlen counter. There are basically
two groups of operations affecting the qlen: operations that propagate
down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the
root qdisc and operations only affecting a subtree or single qdisc
(change, graft, delete class). Since qlen changes during operations from
the second group don't propagate to ancestor qdiscs, their qlen values
become desynchronized.

This patch adds a function to propagate qlen changes up the qdisc tree,
optionally calling a callback function to perform qdisc-internal
maintenance when the child qdisc is deactivated, and converts all
qdiscs to use this where necessary.

Signed-off-by: Patrick McHardy 
Signed-off-by: Adrian Bunk

[INET]: twcal_jiffie should be unsigned long, not int

2007-03-08T07:19:00+00:00

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[Bluetooth] Handle command complete event for exit periodic inquiry

2007-01-26T19:49:22+00:00

The command complete event of the exit periodic inquiry command must
clear the HCI_INQUIRY flag and finish the HCI request.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Adrian Bunk

[IPX]: Annotate and fix IPX checksum

2006-11-24T02:03:34+00:00

Calculation of IPX checksum got buggered about 2.4.0.  The old variant
mangled the packet; that got fixed, but calculation itself got buggered.
Restored the correct logics, fixed a subtle breakage we used to have even
back then: if the sum is 0 mod 0xffff, we want to return 0, not 0xffff.
The latter has special meaning for IPX (cheksum disabled).  Observation
(and obvious fix) nicked from history of FreeBSD ipx_cksum.c...

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

SCTP: Reject sctp packets with broadcast addresses.

2006-08-26T00:39:03+00:00

Make SCTP handle broadcast properly

Signed-off-by: Vlad Yasevich 
Signed-off-by: Sridhar Samudrala 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

Fix sctp privilege elevation (CVE-2006-3745)

2006-08-23T16:01:55+00:00

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala 
Acked-by: David Miller 
Signed-off-by: Adrian Bunk

[PATCH] SCTP: Respect the real chunk length when walking parameters (CVE-2006-1858)

2006-05-20T22:00:34+00:00

When performing bound checks during the parameter processing, we
want to use the real chunk and paramter lengths for bounds instead
of the rounded ones.  This prevents us from potentially walking of
the end if the chunk length was miscalculated.  We still use rounded
lengths when advancing the pointer. This was found during a
conformance test that changed the chunk length without modifying
parameters.

(Vlad noted elsewhere: the most you'd overflow is 3 bytes, so problem
is parameter dependent).

Signed-off-by: Vlad Yasevich 
Signed-off-by: Sridhar Samudrala 
Signed-off-by: Chris Wright

[PATCH] SCTP: Allow spillover of receive buffer to avoid deadlock. (CVE-2006-2275)

2006-05-09T19:53:21+00:00

This patch fixes a deadlock situation in the receive path by allowing
temporary spillover of the receive buffer.

- If the chunk we receive has a tsn that immediately follows the ctsn,
  accept it even if we run out of receive buffer space and renege data with
  higher TSNs.
- Once we accept one chunk in a packet, accept all the remaining chunks
  even if we run out of receive buffer space.

Signed-off-by: Neil Horman 
Acked-by: Mark Butler 
Acked-by: Vlad Yasevich 
Signed-off-by: Sridhar Samudrala 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter

2006-04-17T20:16:04+00:00

[NETFILTER]: Fix fragmentation issues with bridge netfilter

The conntrack code doesn't do re-fragmentation of defragmented packets
anymore but relies on fragmentation in the IP layer. Purely bridged
packets don't pass through the IP layer, so the bridge netfilter code
needs to take care of fragmentation itself.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

[AX.25]: Fix potencial memory hole.

2006-03-19T21:20:06+00:00

If the AX.25 dialect chosen by the sysadmin is set to DAMA master / 3
(or DAMA slave / 2, if CONFIG_AX25_DAMA_SLAVE=n) ax25_kick() will fall
through the switch statement without calling ax25_send_iframe() or any
other function that would eventually free skbn thus leaking the packet.

Fix by restricting the sysctl inferface to allow only actually supported
AX.25 dialects.

The system administration mistake needed for this to happen is rather
unlikely, so this is an uncritical hole.

Coverity #651.

Signed-off-by: Ralf Baechle DL5RB 
Signed-off-by: David S. Miller