linux-toradex.git/net/netfilter, branch v2.6.32.2

ipvs: zero usvc and udest

2009-12-18T22:05:51+00:00

commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream.

Make sure that any otherwise uninitialised fields of usvc are zero.

This has been obvserved to cause a problem whereby the port of
fwmark services may end up as a non-zero value which causes
scheduling of a destination server to fail for persisitent services.

As observed by Deon van der Merwe .
This fix suggested by Julian Anastasov .

For good measure also zero udest.

Cc: Deon van der Merwe 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6

2009-11-23T17:52:51+00:00

netfilter: xt_limit: fix invalid return code in limit_mt_check()

2009-11-23T12:37:23+00:00

Commit acc738fe (netfilter: xtables: avoid pointer to self) introduced
an invalid return value in limit_mt_check().

Signed-off-by: Patrick McHardy

netfilter: nf_log: fix sleeping function called from invalid context in seq_show()

2009-11-19T21:16:31+00:00

[  171.925285] BUG: sleeping function called from invalid context at kernel/mutex.c:280
[  171.925296] in_atomic(): 1, irqs_disabled(): 0, pid: 671, name: grep
[  171.925306] 2 locks held by grep/671:
[  171.925312]  #0:  (&p->lock){+.+.+.}, at: [] seq_read+0x25/0x36c
[  171.925340]  #1:  (rcu_read_lock){.+.+..}, at: [] seq_start+0x0/0x44
[  171.925372] Pid: 671, comm: grep Not tainted 2.6.31.6-4-netbook #3
[  171.925380] Call Trace:
[  171.925398]  [] ? __debug_show_held_locks+0x1e/0x20
[  171.925414]  [] __might_sleep+0xfb/0x102
[  171.925430]  [] mutex_lock_nested+0x1c/0x2ad
[  171.925444]  [] seq_show+0x74/0x127
[  171.925456]  [] seq_read+0x1b4/0x36c
[  171.925469]  [] ? seq_read+0x0/0x36c
[  171.925483]  [] proc_reg_read+0x60/0x74
[  171.925496]  [] ? proc_reg_read+0x0/0x74
[  171.925510]  [] vfs_read+0x87/0x110
[  171.925523]  [] sys_read+0x3b/0x60
[  171.925538]  [] syscall_call+0x7/0xb

Fix it by replacing RCU with nf_log_mutex.

Reported-by: "Yin, Kangkai" 
Signed-off-by: Wu Fengguang 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: xt_osf: fix xt_osf_remove_callback() return value

2009-11-19T21:16:26+00:00

Return a negative error value.

Signed-off-by: Roel Kluin 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_log: fix sleeping function called from invalid context in seq_show()

2009-11-13T08:34:44+00:00

[  171.925285] BUG: sleeping function called from invalid context at kernel/mutex.c:280
[  171.925296] in_atomic(): 1, irqs_disabled(): 0, pid: 671, name: grep
[  171.925306] 2 locks held by grep/671:
[  171.925312]  #0:  (&p->lock){+.+.+.}, at: [] seq_read+0x25/0x36c
[  171.925340]  #1:  (rcu_read_lock){.+.+..}, at: [] seq_start+0x0/0x44
[  171.925372] Pid: 671, comm: grep Not tainted 2.6.31.6-4-netbook #3
[  171.925380] Call Trace:
[  171.925398]  [] ? __debug_show_held_locks+0x1e/0x20
[  171.925414]  [] __might_sleep+0xfb/0x102
[  171.925430]  [] mutex_lock_nested+0x1c/0x2ad
[  171.925444]  [] seq_show+0x74/0x127
[  171.925456]  [] seq_read+0x1b4/0x36c
[  171.925469]  [] ? seq_read+0x0/0x36c
[  171.925483]  [] proc_reg_read+0x60/0x74
[  171.925496]  [] ? proc_reg_read+0x0/0x74
[  171.925510]  [] vfs_read+0x87/0x110
[  171.925523]  [] sys_read+0x3b/0x60
[  171.925538]  [] syscall_call+0x7/0xb

Fix it by replacing RCU with nf_log_mutex.

Reported-by: "Yin, Kangkai" 
Signed-off-by: Wu Fengguang 
Signed-off-by: Patrick McHardy

netfilter: xt_osf: fix xt_osf_remove_callback() return value

2009-11-13T08:31:35+00:00

Return a negative error value.

Signed-off-by: Roel Kluin 
Signed-off-by: Patrick McHardy

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2009-11-09T17:51:42+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits)
  net/fsl_pq_mdio: add module license GPL
  can: fix WARN_ON dump in net/core/rtnetlink.c:rtmsg_ifinfo()
  can: should not use __dev_get_by_index() without locks
  hisax: remove bad udelay call to fix build error on ARM
  ipip: Fix handling of DF packets when pmtudisc is OFF
  qlge: Set PCIe reset type for EEH to fundamental.
  qlge: Fix early exit from mbox cmd complete wait.
  ixgbe: fix traffic hangs on Tx with ioatdma loaded
  ixgbe: Fix checking TFCS register for TXOFF status when DCB is enabled
  ixgbe: Fix gso_max_size for 82599 when DCB is enabled
  macsonic: fix crash on PowerBook 520
  NET: cassini, fix lock imbalance
  ems_usb: Fix byte order issues on big endian machines
  be2net: Bug fix to send config commands to hardware after netdev_register
  be2net: fix to set proper flow control on resume
  netfilter: xt_connlimit: fix regression caused by zero family value
  rt2x00: Don't queue ieee80211 work after USB removal
  Revert "ipw2200: fix oops on missing firmware"
  decnet: netdevice refcount leak
  netfilter: nf_nat: fix NAT issue in 2.6.30.4+
  ...

netfilter: xt_connlimit: fix regression caused by zero family value

2009-11-07T02:08:32+00:00

Commit v2.6.28-rc1~717^2~109^2~2 was slightly incomplete; not all
instances of par->match->family were changed to par->family.

References: http://bugzilla.netfilter.org/show_bug.cgi?id=610
Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_nat: fix NAT issue in 2.6.30.4+

2009-11-06T08:43:42+00:00

Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work
over NAT. The "cause" of the problem was a fix of unacknowledged data
detection with NAT (commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272).
However, actually, that fix uncovered a long standing bug in TCP conntrack:
when NAT was enabled, we simply updated the max of the right edge of
the segments we have seen (td_end), by the offset NAT produced with
changing IP/port in the data. However, we did not update the other parameter
(td_maxend) which is affected by the NAT offset. Thus that could drift
away from the correct value and thus resulted breaking active FTP.

The patch below fixes the issue by *not* updating the conntrack parameters
from NAT, but instead taking into account the NAT offsets in conntrack in a
consistent way. (Updating from NAT would be more harder and expensive because
it'd need to re-calculate parameters we already calculated in conntrack.)

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller