linux-toradex.git/net/ipv4, branch v2.6.29.2

netfilter: {ip, ip6, arp}_tables: fix incorrect loop detection

2009-04-27T17:36:58+00:00

upstream commit: 1f9352ae2253a97b07b34dcf16ffa3b4ca12c558

Commit e1b4b9f ([NETFILTER]: {ip,ip6,arp}_tables: fix exponential worst-case
search for loops) introduced a regression in the loop detection algorithm,
causing sporadic incorrectly detected loops.

When a chain has already been visited during the check, it is treated as
having a standard target containing a RETURN verdict directly at the
beginning in order to not check it again. The real target of the first
rule is then incorrectly treated as STANDARD target and checked not to
contain invalid verdicts.

Fix by making sure the rule does actually contain a standard target.

Based on patch by Francis Dupont 
Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

udp: Wrong locking code in udp seq_file infrastructure

2009-04-02T20:55:14+00:00

[ Upstream commit 30842f2989aacfaba3ccb39829b3417be9313dbe ]

Reading zero bytes from /proc/net/udp or other similar files which use
the same seq_file udp infrastructure panics kernel in that way:

=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
read/1985 is trying to release lock (&table->hash[i].lock) at:
[] udp_seq_stop+0x27/0x29
but there are no more locks to release!

other info that might help us debug this:
1 lock held by read/1985:
 #0:  (&p->lock){--..}, at: [] seq_read+0x38/0x348

stack backtrace:
Pid: 1985, comm: read Not tainted 2.6.29-rc8 #9
Call Trace:
 [] ? udp_seq_stop+0x27/0x29
 [] print_unlock_inbalance_bug+0xd6/0xe1
 [] lock_release_non_nested+0x9e/0x1c6
 [] ? seq_read+0xb2/0x348
 [] ? mark_held_locks+0x68/0x86
 [] ? udp_seq_stop+0x27/0x29
 [] lock_release+0x15d/0x189
 [] _spin_unlock_bh+0x1e/0x34
 [] udp_seq_stop+0x27/0x29
 [] seq_read+0x2bb/0x348
 [] ? seq_read+0x0/0x348
 [] proc_reg_read+0x90/0xaf
 [] vfs_read+0xa6/0x103
 [] ? trace_hardirqs_on_caller+0x12f/0x153
 [] sys_read+0x45/0x69
 [] system_call_fastpath+0x16/0x1b
BUG: scheduling while atomic: read/1985/0xffffff00
INFO: lockdep is turned off.
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table dm_multipath kvm ppdev snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event arc4 snd_s
eq ecb thinkpad_acpi snd_seq_device iwl3945 hwmon sdhci_pci snd_pcm_oss sdhci rfkill mmc_core snd_mixer_oss i2c_i801 mac80211 yenta_socket ricoh_mmc i2c_core iTCO_wdt snd_pcm iTCO_vendor_support rs
rc_nonstatic snd_timer snd lib80211 cfg80211 soundcore snd_page_alloc video parport_pc output parport e1000e [last unloaded: scsi_wait_scan]
Pid: 1985, comm: read Not tainted 2.6.29-rc8 #9
Call Trace:
 [] ? __debug_show_held_locks+0x1b/0x24
 [] __schedule_bug+0x7e/0x83
 [] schedule+0xce/0x838
 [] ? fsnotify_access+0x5f/0x67
 [] ? sysret_careful+0xb/0x37
 [] ? trace_hardirqs_on_caller+0x1f/0x153
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] sysret_careful+0x31/0x37
read[1985]: segfault at 7fffc479bfe8 ip 0000003e7420a180 sp 00007fffc479bfa0 error 6
Kernel panic - not syncing: Aiee, killing interrupt handler!

udp_seq_stop() tries to unlock not yet locked spinlock. The lock was lost
during splitting global udp_hash_lock to subsequent spinlocks.

Signed-off by: Vitaly Mayatskikh 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

netns: oops in ip[6]_frag_reasm incrementing stats

2009-03-19T06:26:11+00:00

dev can be NULL in ip[6]_frag_reasm for skb's coming from RAW sockets.

Quagga's OSPFD sends fragmented packets on a RAW socket, when netfilter
conntrack reassembles them on the OUTPUT path you hit this code path.

You can test it with something like "hping2 -0 -d 2000 -f AA.BB.CC.DD"

With help from Jarek Poplawski.

Signed-off-by: Jorge Boncompte [DTI2] 
Signed-off-by: David S. Miller

tcp: Like icmp use register_pernet_subsys

2009-03-03T09:14:21+00:00

To remove the possibility of packets flying around when network
devices are being cleaned up use reisger_pernet_subsys instead of
register_pernet_device.

Signed-off-by: Eric W. Biederman 
Acked-by: Denis V. Lunev 
Signed-off-by: David S. Miller

netns: Fix icmp shutdown.

2009-03-03T09:14:15+00:00

Recently I had a kernel panic in icmp_send during a network namespace
cleanup.  There were packets in the arp queue that failed to be sent
and we attempted to generate an ICMP host unreachable message, but
failed because icmp_sk_exit had already been called.

The network devices are removed from a network namespace and their
arp queues are flushed before we do attempt to shutdown subsystems
so this error should have been impossible.

It turns out icmp_init is using register_pernet_device instead
of register_pernet_subsys.  Which resulted in icmp being shut down
while we still had the possibility of packets in flight, making
a nasty NULL pointer deference in interrupt context possible.

Changing this to register_pernet_subsys fixes the problem in
my testing.

Signed-off-by: Eric W. Biederman 
Acked-by: Denis V. Lunev 
Signed-off-by: David S. Miller

tcp: fix retrans_out leaks

2009-03-01T08:21:36+00:00

There's conflicting assumptions in shifting, the caller assumes
that dupsack results in S'ed skbs (or a part of it) for sure but
never gave a hint to tcp_sacktag_one when dsack is actually in
use. Thus DSACK retrans_out -= pcount was not taken and the
counter became out of sync. Remove obstacle from that information
flow to get DSACKs accounted in tcp_sacktag_one as expected.

Signed-off-by: Ilpo Järvinen 
Tested-by: Denys Fedoryshchenko 
Signed-off-by: David S. Miller

tcp_scalable: Update malformed & dead url

2009-02-25T00:40:16+00:00

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2009-02-23T22:36:05+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  netns: fix double free at netns creation
  veth : add the set_mac_address capability
  sunlance: Beyond ARRAY_SIZE of ib->btx_ring
  sungem: another error printed one too early
  ISDN: fix sc/shmem printk format warning
  SMSC: timeout reaches -1
  smsc9420: handle magic field of ethtool_eeprom
  sundance: missing parentheses?
  smsc9420: fix another postfixed timeout
  wimax/i2400m: driver loads firmware v1.4 instead of v1.3
  vlan: Update skb->mac_header in __vlan_put_tag().
  cxgb3: Add support for PCI ID 0x35.
  tcp: remove obsoleted comment about different passes
  TG3: &&/|| confusion
  ATM: misplaced parentheses?
  net/mv643xx: don't disable the mib timer too early and lock properly
  net/mv643xx: use GFP_ATOMIC while atomic
  atl1c: Atheros L1C Gigabit Ethernet driver
  net: Kill skb_truesize_check(), it only catches false-positives.
  net: forcedeth: Fix wake-on-lan regression

cipso: Fix documentation comment

2009-02-22T23:05:54+00:00

The CIPSO protocol engine incorrectly stated that the FIPS-188 specification
could be found in the kernel's Documentation directory.  This patch corrects
that by removing the comment and directing users to the FIPS-188 documented
hosted online.  For the sake of completeness I've also included a link to the
CIPSO draft specification on the NetLabel website.

Thanks to Randy Dunlap for spotting the error and letting me know.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

tcp: remove obsoleted comment about different passes

2009-02-19T01:45:44+00:00

This is obsolete since the passes got combined.

Signed-off-by: Ilpo Järvinen 
Signed-off-by: David S. Miller