linux-toradex.git/net/iucv, branch v3.19

net: introduce helper macro for_each_cmsghdr

2014-12-11T03:41:55+00:00

Introduce helper macro for_each_cmsghdr as a wrapper of the enumerating
cmsghdr from msghdr, just cleanup.

Signed-off-by: Gu Zheng 
Signed-off-by: David S. Miller

new helper: memcpy_from_msg()

2014-11-24T09:28:48+00:00

Signed-off-by: Al Viro

net: Add and use skb_copy_datagram_msg() helper.

2014-11-05T21:46:40+00:00

This encapsulates all of the skb_copy_datagram_iovec() callers
with call argument signature "skb, offset, msghdr->msg_iov, length".

When we move to iov_iters in the networking, the iov_iter object will
sit in the msghdr.

Having a helper like this means there will be less places to touch
during that transformation.

Based upon descriptions and patch from Al Viro.

Signed-off-by: David S. Miller

iucv: Convert pr_warning to pr_warn

2014-09-10T19:40:10+00:00

Use the more common pr_warn.
Coalesce formats.
Realign arguments.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

af_iucv: avoid path quiesce of severed path in shutdown()

2014-07-22T03:21:40+00:00

An af_iucv stress test showed -EPIPE results for sendmsg()
calls. They are caused by quiescing a path even though it has
been already severed by peer. For IUCV transport shutdown()
consists of 2 steps:
(1) sending the shutdown message to peer
(2) quiescing the iucv path
If the iucv path between these 2 steps is severed due to peer
closing the path, the quiesce step is no longer needed.

Signed-off-by: Ursula Braun 
Signed-off-by: Frank Blaschka 
Reported-by: Philipp Hachtmann 
Signed-off-by: David S. Miller

af_iucv: remove unnecessary break after goto

2014-07-15T23:27:00+00:00

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller

af_iucv: correct cleanup if listen backlog is full

2014-05-31T00:35:23+00:00

In case of transport HIPER a sock struct is allocated for an incoming
connect request. If the backlog queue is full this socket is not
needed, but is left in the list of af_iucv sockets. Final socket
release posts console message "Attempt to release alive iucv socket".
This patch makes sure the new created socket is cleaned up correctly
if the backlog queue is full.

Signed-off-by: Ursula Braun 
Signed-off-by: Frank Blaschka 
Reported-by: Philipp Hachtmann 
Signed-off-by: David S. Miller

af_iucv: Add automatic (source) iucv_name to bind

2014-05-31T00:35:23+00:00

If a socket is bound to an address using before calling connect
it is usual to leave it to the network system to choose an appropriate
outgoing application name respective port address.
af_iucv on VM uses a counter and uses simple numbers as unique identifiers.
This behaviour was missing when af_iucv is used with HiperSockets.

This patch contains a simple approach to harmonize af_iucv's behaviour.

Signed-off-by: Philipp Hachtmann 
Signed-off-by: Frank Blaschka 
Signed-off-by: David S. Miller

af_iucv: wrong mapping of sent and confirmed skbs

2014-05-14T19:38:39+00:00

When sending data through IUCV a MESSAGE COMPLETE interrupt
signals that sent data memory can be freed or reused again.
With commit f9c41a62bba3f3f7ef3541b2a025e3371bcbba97
"af_iucv: fix recvmsg by replacing skb_pull() function" the
MESSAGE COMPLETE callback iucv_callback_txdone() identifies
the wrong skb as being confirmed, which leads to data corruption.
This patch fixes the skb mapping logic in iucv_callback_txdone().

Signed-off-by: Ursula Braun 
Signed-off-by: Frank Blaschka 
Cc: 
Signed-off-by: David S. Miller

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11T20:15:36+00:00

Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller