linux-toradex.git/net/ipv4, branch v2.6.27.6

tcp: Restore ordering of TCP options for the sake of inter-operability

2008-11-07T03:05:41+00:00

[ Upstream commit fd6149d332973bafa50f03ddb0ea9513e67f4517 ]

This is not our bug! Sadly some devices cannot cope with the change
of TCP option ordering which was a result of the recent rewrite of
the option code (not that there was some particular reason steming
from the rewrite for the reordering) though any ordering of TCP
options is perfectly legal. Thus we restore the original ordering
to allow interoperability with/through such broken devices and add
some warning about this trap. Since the reordering just happened
without any particular reason, this change shouldn't cost us
anything.

There are already couple of known failure reports (within close
proximity of the last release), so the problem might be more
wide-spread than a single device. And other reports which may
be due to the same problem though the symptoms were less obvious.
Analysis of one of the case revealed (with very high probability)
that sack capability cannot be negotiated as the first option
(SYN never got a response).

Signed-off-by: Ilpo Järvinen 
Reported-by: Aldo Maggi 
Tested-by: Aldo Maggi 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

syncookies: fix inclusion of tcp options in syn-ack

2008-11-07T03:05:41+00:00

[ Upstream commit 8b5f12d04b2e93842f3dda01f029842047bf3f81 ]

David Miller noticed that commit
33ad798c924b4a1afad3593f2796d465040aadd5 '(tcp: options clean up')
did not move the req->cookie_ts check.
This essentially disabled commit 4dfc2817025965a2fc78a18c50f540736a6b5c24
'[Syncookies]: Add support for TCP options via timestamps.'.

This restores the original logic.

Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

netfilter: restore lost ifdef guarding defrag exception

2008-10-25T21:32:41+00:00

netfilter: restore lost #ifdef guarding defrag exception

Upstream commit 38f7ac3eb:

Nir Tzachar  reported a warning when sending
fragments over loopback with NAT:

[ 6658.338121] WARNING: at net/ipv4/netfilter/nf_nat_standalone.c:89 nf_nat_fn+0x33/0x155()

The reason is that defragmentation is skipped for already tracked connections.
This is wrong in combination with NAT and ip_conntrack actually had some ifdefs
to avoid this behaviour when NAT is compiled in.

The entire "optimization" may seem a bit silly, for now simply restoring the
lost #ifdef is the easiest solution until we can come up with something better.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: snmp nat leaks memory in case of failure

2008-10-25T21:32:41+00:00

netfilter: snmp nat leaks memory in case of failure

Upstream commit 311670f3e:

Signed-off-by: Ilpo Jarvinen 
Signed-off-by: Patrick McHardy

tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd.

2008-10-07T22:58:17+00:00

Because of rounding, in certain conditions, i.e. when in congestion
avoidance state rho is smaller than 1/128 of the current cwnd, TCP
Hybla congestion control starves and the cwnd is kept constant
forever.

This patch forces an increment by one segment after #send_cwnd calls
without increments(newreno behavior).

Signed-off-by: Daniele Lacamera 
Signed-off-by: David S. Miller

tcp: Fix possible double-ack w/ user dma

2008-10-07T22:31:19+00:00

From: Ali Saidi 

When TCP receive copy offload is enabled it's possible that
tcp_rcv_established() will cause two acks to be sent for a single
packet. In the case that a tcp_dma_early_copy() is successful,
copied_early is set to true which causes tcp_cleanup_rbuf() to be
called early which can send an ack. Further along in
tcp_rcv_established(), __tcp_ack_snd_check() is called and will
schedule a delayed ACK. If no packets are processed before the delayed
ack timer expires the packet will be acked twice.

Signed-off-by: David S. Miller

tcp: Fix NULL dereference in tcp_4_send_ack()

2008-10-01T08:51:39+00:00

Fix NULL dereference in tcp_4_send_ack().

As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs:

BUG: unable to handle kernel NULL pointer dereference at 00000000000004d0
IP: [] tcp_v4_send_ack+0x203/0x250

Stack:  ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d
 0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8
 0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020
Call Trace:
   [] tcp_v4_reqsk_send_ack+0x20/0x22
 [] tcp_check_req+0x108/0x14c
 [] ? rt_intern_hash+0x322/0x33c
 [] tcp_v4_do_rcv+0x399/0x4ec
 [] ? skb_checksum+0x4f/0x272
 [] ? __inet_lookup_listener+0x14a/0x15c
 [] tcp_v4_rcv+0x6a1/0x701
 [] ip_local_deliver_finish+0x157/0x24a
 [] ip_local_deliver+0x72/0x7c
 [] ip_rcv_finish+0x38d/0x3b2
 [] ? scsi_io_completion+0x19d/0x39e
 [] ip_rcv+0x2a2/0x2e5
 [] netif_receive_skb+0x293/0x303
 [] process_backlog+0x80/0xd0
 [] ? __rcu_process_callbacks+0x125/0x1b4
 [] net_rx_action+0xb9/0x17f
 [] __do_softirq+0xa3/0x164
 [] call_softirq+0x1c/0x28
   [] do_softirq+0x34/0x72
 [] local_bh_enable_ip+0x3f/0x50
 [] _spin_unlock_bh+0x12/0x14
 [] release_sock+0xb8/0xc1
 [] inet_stream_connect+0x146/0x25c
 [] ? autoremove_wake_function+0x0/0x38
 [] sys_connect+0x68/0x8e
 [] ? fd_install+0x5f/0x68
 [] ? sock_map_fd+0x55/0x62
 [] system_call_after_swapgs+0x7b/0x80

Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de <48> 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48
RIP  [] tcp_v4_send_ack+0x203/0x250
 RSP 
CR2: 00000000000004d0

Signed-off-by: Vitaliy Gusev 
Signed-off-by: David S. Miller

udp: Fix rcv socket locking

2008-09-15T18:48:46+00:00

The previous patch in response to the recursive locking on IPsec
reception is broken as it tries to drop the BH socket lock while in
user context.

This patch fixes it by shrinking the section protected by the
socket lock to sock_queue_rcv_skb only.  The only reason we added
the lock is for the accounting which happens in that function.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

netns : fix kernel panic in timewait socket destruction

2008-09-08T20:17:27+00:00

How to reproduce ?
 - create a network namespace
 - use tcp protocol and get timewait socket
 - exit the network namespace
 - after a moment (when the timewait socket is destroyed), the kernel
   panics.

# BUG: unable to handle kernel NULL pointer dereference at
0000000000000007
IP: [] inet_twdr_do_twkill_work+0x6e/0xb8
PGD 119985067 PUD 11c5c0067 PMD 0
Oops: 0000 [1] SMP
CPU 1
Modules linked in: ipv6 button battery ac loop dm_mod tg3 libphy ext3 jbd
edd fan thermal processor thermal_sys sg sata_svw libata dock serverworks
sd_mod scsi_mod ide_disk ide_core [last unloaded: freq_table]
Pid: 0, comm: swapper Not tainted 2.6.27-rc2 #3
RIP: 0010:[] []
inet_twdr_do_twkill_work+0x6e/0xb8
RSP: 0018:ffff88011ff7fed0 EFLAGS: 00010246
RAX: ffffffffffffffff RBX: ffffffff82339420 RCX: ffff88011ff7ff30
RDX: 0000000000000001 RSI: ffff88011a4d03c0 RDI: ffff88011ac2fc00
RBP: ffffffff823392e0 R08: 0000000000000000 R09: ffff88002802a200
R10: ffff8800a5c4b000 R11: ffffffff823e4080 R12: ffff88011ac2fc00
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000041cbd940(0000) GS:ffff8800bff839c0(0000)
knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000007 CR3: 00000000bd87c000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff8800bff9e000, task
ffff88011ff76690)
Stack: ffffffff823392e0 0000000000000100 ffffffff821e3a3a
0000000000000008
0000000000000000 ffffffff821e3a61 ffff8800bff7c000 ffffffff8203c7e7
ffff88011ff7ff10 ffff88011ff7ff10 0000000000000021 ffffffff82351108
Call Trace:
 [] ? inet_twdr_hangman+0x0/0x9e
[] ? inet_twdr_hangman+0x27/0x9e
[] ? run_timer_softirq+0x12c/0x193
[] ? __do_softirq+0x5e/0xcd
[] ? call_softirq+0x1c/0x28
[] ? do_softirq+0x2c/0x68
[] ? smp_apic_timer_interrupt+0x8e/0xa9
[] ? apic_timer_interrupt+0x66/0x70
 [] ? default_idle+0x27/0x3b
[] ? cpu_idle+0x5f/0x7d


Code: e8 01 00 00 4c 89 e7 41 ff c5 e8 8d fd ff ff 49 8b 44 24 38 4c 89 e7
65 8b 14 25 24 00 00 00 89 d2 48 8b 80 e8 00 00 00 48 f7 d0 <48> 8b 04 d0
48 ff 40 58 e8 fc fc ff ff 48 89 df e8 c0 5f 04 00
RIP [] inet_twdr_do_twkill_work+0x6e/0xb8
RSP 
CR2: 0000000000000007

This patch provides a function to purge all timewait sockets related
to a network namespace. The timewait sockets life cycle is not tied with
the network namespace, that means the timewait sockets stay alive while
the network namespace dies. The timewait sockets are for avoiding to
receive a duplicate packet from the network, if the network namespace is
freed, the network stack is removed, so no chance to receive any packets
from the outside world. Furthermore, having a pending destruction timer
on these sockets with a network namespace freed is not safe and will lead
to an oops if the timer callback which try to access data belonging to 
the namespace like for example in:
	inet_twdr_do_twkill_work
		-> NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITED);

Purging the timewait sockets at the network namespace destruction will:
 1) speed up memory freeing for the namespace
 2) fix kernel panic on asynchronous timewait destruction

Signed-off-by: Daniel Lezcano 
Acked-by: Denis V. Lunev 
Acked-by: Eric W. Biederman 
Signed-off-by: David S. Miller

ipv: Re-enable IP when MTU > 68

2008-09-03T00:28:58+00:00

Re-enable IP when the MTU gets back to a valid size. 

This patch just checks if the in_dev is NULL on a NETDEV_CHANGEMTU event
and if MTU is valid (bigger than 68), then re-enable in_dev. 

Also a function that checks valid MTU size was created.

Signed-off-by: Breno Leitao 
Signed-off-by: David S. Miller