linux-toradex.git/net/ipv4/fib_frontend.c, branch v2.6.16.61

[NETLINK]: Infinite recursion in netlink (CVE-2007-1861)

2007-04-30T23:11:29+00:00

Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel,
which resulted in infinite recursion and stack overflow.

The bug is present in all kernel versions since the feature appeared.

The patch also makes some minimal cleanup:

1. Return something consistent (-ENOENT) when fib table is missing
2. Do not crash when queue is empty (does not happen, but yet)
3. Put result of lookup

Sergey Vlasov:
Oops fix

Signed-off-by: Alexey Kuznetsov 
Signed-off-by: Sergey Vlasov 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

x86: Work around compiler code generation bug with -Os

2006-01-15T06:08:28+00:00

Some versions of gcc generate incorrect code for the inet_check_attr()
function, apparently due to a totally bogus index -> pointer comparison
transformation.

At least "gcc version 4.0.1 20050727 (Red Hat 4.0.1-5)" from FC4 is
affected, possibly others too.

This changes the function subtly so that the buggy gcc transformation
doesn't trigger.

Signed-off-by: Linus Torvalds

[PATCH] capable/capability.h (net/)

2006-01-12T02:42:14+00:00

net: Use  where capable() is used.

Signed-off-by: Randy Dunlap 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h

2006-01-03T21:11:21+00:00

To help in reducing the number of include dependencies, several files were
touched as they were getting needed headers indirectly for stuff they use.

Thanks also to Alan Menegotto for pointing out that net/dccp/proto.c had
linux/dccp.h include twice.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

[NETLINK]: Fix processing of fib_lookup netlink messages

2005-12-01T22:30:00+00:00

The receive path for fib_lookup netlink messages is lacking sanity
checks for header and payload and is thus vulnerable to malformed
netlink messages causing illegal memory references.

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

[IPV4]: Fix secondary IP addresses after promotion

2005-11-22T22:47:37+00:00

This patch fixes the problem with promoting aliases when:
a) a single primary and > 1 secondary addresses
b) multiple primary addresses each with at least one secondary address

Based on earlier efforts from Brian Pomerantz ,
Patrick McHardy  and Thomas Graf 

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

[NET]: kfree cleanup

2005-11-08T17:41:34+00:00

From: Jesper Juhl 

This is the net/ part of the big kfree cleanup patch.

Remove pointless checks for NULL prior to calling kfree() in net/.

Signed-off-by: Jesper Juhl 
Cc: "David S. Miller" 
Cc: Arnaldo Carvalho de Melo 
Acked-by: Marcel Holtmann 
Acked-by: YOSHIFUJI Hideaki 
Signed-off-by: Andrew Morton

[IPV4]: Fix issue reported by Coverity in ipv4/fib_frontend.c

2005-10-29T04:53:39+00:00

fib_del_ifaddr() dereferences ifa->ifa_dev, so the code already assumes that
ifa->ifa_dev is non-NULL, the check is unnecessary.

Signed-off-by: Jayachandran C. 
Signed-off-by: Arnaldo Carvalho de Melo

[IPV4]: Replace __in_dev_get with __in_dev_get_rcu/rtnl

2005-10-03T21:35:55+00:00

The following patch renames __in_dev_get() to __in_dev_get_rtnl() and
introduces __in_dev_get_rcu() to cover the second case.

1) RCU with refcnt should use in_dev_get().
2) RCU without refcnt should use __in_dev_get_rcu().
3) All others must hold RTNL and use __in_dev_get_rtnl().

There is one exception in net/ipv4/route.c which is in fact a pre-existing
race condition.  I've marked it as such so that we remember to fix it.

This patch is based on suggestions and prior work by Suzanne Wood and
Paul McKenney.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NETLINK]: Add "groups" argument to netlink_kernel_create

2005-08-29T23:01:11+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller