linux-toradex.git/net/dccp, branch v2.6.32.50

net: Compute protocol sequence numbers and fragment IDs using MD5.

2011-08-16T01:57:20+00:00

Computers have become a lot faster since we compromised on the
partial MD4 hash which we use currently for performance reasons.

MD5 is a much safer choice, and is inline with both RFC1948 and
other ISS generators (OpenBSD, Solaris, etc.)

Furthermore, only having 24-bits of the sequence number be truly
unpredictable is a very serious limitation.  So the periodic
regeneration and 8-bit counter have been removed.  We compute and
use a full 32-bit sequence number.

For ipv6, DCCP was found to use a 32-bit truncated initial sequence
number (it needs 43-bits) and that is fixed here as well.

Reported-by: Dan Kaminsky 
Tested-by: Willy Tarreau 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

dccp: handle invalid feature options length

2011-05-23T18:20:15+00:00

commit a294865978b701e4d0d90135672749531b9a900d upstream.

A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction.  The subsequent code may read past the end of the
options value buffer when parsing.  I'm unsure of what the consequences
of this might be, but it's probably not good.

Signed-off-by: Dan Rosenberg 
Acked-by: Gerrit Renker 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

dccp: fix oops on Reset after close

2011-03-07T23:17:57+00:00

commit 720dc34bbbe9493c7bd48b2243058b4e447a929d upstream.

This fixes a bug in the order of dccp_rcv_state_process() that still permitted
reception even after closing the socket. A Reset after close thus causes a NULL
pointer dereference by not preventing operations on an already torn-down socket.

 dccp_v4_do_rcv()
	|
	| state other than OPEN
	v
 dccp_rcv_state_process()
	|
	| DCCP_PKT_RESET
	v
 dccp_rcv_reset()
	|
	v
 dccp_time_wait()

 WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128()
 Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah
 [] (unwind_backtrace+0x0/0xec) from [] (warn_slowpath_common)
 [] (warn_slowpath_common+0x4c/0x64) from [] (warn_slowpath_n)
 [] (warn_slowpath_null+0x1c/0x24) from [] (__inet_twsk_hashd)
 [] (__inet_twsk_hashdance+0x48/0x128) from [] (dccp_time_wai)
 [] (dccp_time_wait+0x40/0xc8) from [] (dccp_rcv_state_proces)
 [] (dccp_rcv_state_process+0x120/0x538) from [] (dccp_v4_do_)
 [] (dccp_v4_do_rcv+0x11c/0x14c) from [] (release_sock+0xac/0)
 [] (release_sock+0xac/0x110) from [] (dccp_close+0x28c/0x380)
 [] (dccp_close+0x28c/0x380) from [] (inet_release+0x64/0x70)

The fix is by testing the socket state first. Receiving a packet in Closed state
now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1.

Reported-and-tested-by: Johan Hovold 
Signed-off-by: Gerrit Renker 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

dccp_probe: Fix module load dependencies between dccp and dccp_probe

2010-05-12T21:57:11+00:00

commit 38ff3e6bb987ec583268da8eb22628293095d43b upstream.

This was just recently reported to me.  When built as modules, the
dccp_probe module has a silent dependency on the dccp module.  This
stems from the fact that the module_init routine of dccp_probe
registers a jprobe on the dccp_sendmsg symbol.  Since the symbol is
only referenced as a text string (the .symbol_name field in the jprobe
struct) rather than the address of the symbol itself, depmod never
picks this dependency up, and so if you load the dccp_probe module
without the dccp module loaded, the register_jprobe call fails with an
-EINVAL, and the whole module load fails.

The fix is pretty easy, we can just wrap the register_jprobe call in a
try_then_request_module call, which forces the dependency to get
satisfied prior to the probe registration.

Signed-off-by: Neil Horman 
Acked-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller 
Cc: maximilian attems 
Signed-off-by: Greg Kroah-Hartman

net: Make setsockopt() optlen be unsigned.

2009-09-30T23:12:20+00:00

This provides safety against negative optlen at the type
level instead of depending upon (sometimes non-trivial)
checks against this sprinkled all over the the place, in
each and every implementation.

Based upon work done by Arjan van de Ven and feedback
from Linus Torvalds.

Signed-off-by: David S. Miller

mm: replace various uses of num_physpages by totalram_pages

2009-09-22T14:17:38+00:00

Sizing of memory allocations shouldn't depend on the number of physical
pages found in a system, as that generally includes (perhaps a huge amount
of) non-RAM pages.  The amount of what actually is usable as storage
should instead be used as a basis here.

Some of the calculations (i.e.  those not intending to use high memory)
should likely even use (totalram_pages - totalhigh_pages).

Signed-off-by: Jan Beulich 
Acked-by: Rusty Russell 
Acked-by: Ingo Molnar 
Cc: Dave Airlie 
Cc: Kyle McMartin 
Cc: Jeremy Fitzhardinge 
Cc: Pekka Enberg 
Cc: Hugh Dickins 
Cc: "David S. Miller" 
Cc: Patrick McHardy 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

net: constify remaining proto_ops

2009-09-15T00:03:09+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

net: constify struct inet6_protocol

2009-09-15T00:03:05+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

net: constify struct net_protocol

2009-09-15T00:03:01+00:00

Remove long removed "inet_protocol_base" declaration.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

net-next-2.6 [PATCH 1/1] dccp: ccids whitespace-cleanup / CodingStyle

2009-09-15T00:02:54+00:00

No code change, cosmetical changes only:

 * whitespace cleanup via scripts/cleanfile,
 * remove self-references to filename at top of files,
 * fix coding style (extraneous brackets),
 * fix documentation style (kernel-doc-nano-HOWTO).

Thanks are due to Ivo Augusto Calado who raised these issues by
submitting good-quality patches.

Signed-off-by: Gerrit Renker 
Signed-off-by: David S. Miller