linux-toradex.git/net/l2tp, branch v3.4.1

net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg

2012-05-03T01:04:33+00:00

l2tp_ip_sendmsg could return without releasing socket lock, making it all the
way to userspace, and generating the following warning:

[  130.891594] ================================================
[  130.894569] [ BUG: lock held when returning to user space! ]
[  130.897257] 3.4.0-rc5-next-20120501-sasha #104 Tainted: G        W
[  130.900336] ------------------------------------------------
[  130.902996] trinity/8384 is leaving the kernel with locks still held!
[  130.906106] 1 lock held by trinity/8384:
[  130.907924]  #0:  (sk_lock-AF_INET){+.+.+.}, at: [] l2tp_ip_sendmsg+0x2f/0x550

Introduced by commit 2f16270 ("l2tp: Fix locking in l2tp_ip.c").

Signed-off-by: Sasha Levin 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

l2tp: don't overwrite source address in l2tp_ip_bind()

2012-04-13T15:01:44+00:00

Applications using L2TP/IP sockets want to be able to bind() an L2TP/IP
socket to set the local tunnel id while leaving the auto-assigned source
address alone. So if no source address is supplied, don't overwrite
the address already stored in the socket.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: fix refcount leak in l2tp_ip sockets

2012-04-13T15:01:44+00:00

The l2tp_ip socket close handler does not update the module refcount
correctly which prevents module unload after the first bind() call on
an L2TPv3 IP encapulation socket.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: enable automatic module loading for l2tp_ppp

2012-03-22T02:14:56+00:00

When L2TP is configured as a module, requests for L2TP sockets do not result
in the l2tp_ppp module being loaded.  Fix this by adding the appropriate
MODULE_ALIAS to be recognized by pppox's request_module() call.

Signed-off-by: Benjamin LaHaise 
Signed-off-by: David S. Miller

Fix pppol2tp getsockname()

2012-03-20T20:12:11+00:00

While testing L2TP functionality, I came across a bug in getsockname().  The
IP address returned within the pppol2tp_addr's addr memember was not being
set to the IP  address in use.  This bug is caused by using inet_sk() on the
wrong socket (the L2TP socket rather than the underlying UDP socket), and was
likely introduced during the addition of L2TPv3 support.

Signed-off-by: Benjamin LaHaise 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

ppp: Replace uses of with

2012-03-05T01:41:38+00:00

Since all that include/linux/if_ppp.h does is #include ,
this replaces the occurrences of #include  with
#include .

It also corrects an error in Documentation/networking/l2tp.txt, where
it referenced include/linux/if_ppp.h as the source of some definitions
that are actually now defined in include/linux/if_pppol2tp.h.

Signed-off-by: Paul Mackerras 
Signed-off-by: David S. Miller

net: replace random_ether_addr() with eth_hw_addr_random()

2012-02-15T20:34:16+00:00

Replace usage of random_ether_addr() with eth_hw_addr_random()
to set addr_assign_type correctly to NET_ADDR_RANDOM.

Change the trivial cases.

v2: adapt to renamed eth_hw_addr_random()

Signed-off-by: Danny Kukawka 
Signed-off-by: David S. Miller

l2tp: l2tp_ip - fix possible oops on packet receive

2012-01-26T02:45:00+00:00

When a packet is received on an L2TP IP socket (L2TPv3 IP link
encapsulation), the l2tpip socket's backlog_rcv function calls
xfrm4_policy_check(). This is not necessary, since it was called
before the skb was added to the backlog. With CONFIG_NET_NS enabled,
xfrm4_policy_check() will oops if skb->dev is null, so this trivial
patch removes the call.

This bug has always been present, but only when CONFIG_NET_NS is
enabled does it cause problems. Most users are probably using UDP
encapsulation for L2TP, hence the problem has only recently
surfaced.

EIP: 0060:[] EFLAGS: 00210246 CPU: 0
EIP is at l2tp_ip_recvmsg+0xd4/0x2a7
EAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246
ESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [] sock_common_recvmsg+0x31/0x46
 [] __sock_recvmsg_nosec+0x45/0x4d
 [] __sock_recvmsg+0x31/0x3b
 [] sock_recvmsg+0x96/0xab
 [] ? might_fault+0x47/0x81
 [] ? might_fault+0x47/0x81
 [] ? _copy_from_user+0x31/0x115
 [] ? copy_from_user+0x8/0xa
 [] ? verify_iovec+0x3e/0x78
 [] __sys_recvmsg+0x10a/0x1aa
 [] ? sock_recvmsg+0x0/0xab
 [] ? __lock_acquire+0xbdf/0xbee
 [] ? do_page_fault+0x193/0x375
 [] ? fcheck_files+0x9b/0xca
 [] ? fget_light+0x2a/0x9c
 [] sys_recvmsg+0x2b/0x43
 [] sys_socketcall+0x16d/0x1a5
 [] ? trace_hardirqs_on_thunk+0xc/0x10
 [] sysenter_do_call+0x12/0x38
Code: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff  76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c

Signed-off-by: James Chapman 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

l2tp: ensure sk->dst is still valid

2011-11-26T20:57:36+00:00

When using l2tp over ipsec, the tunnel will hang when rekeying
occurs. Reason is that the transformer bundle attached to the dst entry
is now in STATE_DEAD and thus xfrm_output_one() drops all packets
(XfrmOutStateExpired increases).

Fix this by calling __sk_dst_check (which drops the stale dst
if xfrm dst->check callback finds that the bundle is no longer valid).

Cc: James Chapman 
Signed-off-by: Florian Westphal 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

l2tp: fix l2tp_udp_recv_core()

2011-11-08T18:59:44+00:00

pskb_may_pull() can change skb->data, so we have to load ptr/optr at the
right place.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller