linux-toradex.git/net, branch v2.6.16.11

[PATCH] IPV6: XFRM: Fix decoding session with preceding extension header(s).

2006-04-24T16:56:04+00:00

[IPV6] XFRM: Fix decoding session with preceding extension header(s).

We did not correctly decode session with preceding extension
header(s).  This was because we had already pulled preceding
headers, skb->nh.raw + 40 + 1 - skb->data was minus, and
pskb_may_pull() failed.

We now have IP6CB(skb)->nhoff and skb->h.raw, and we can
start parsing / decoding upper layer protocol from current
position.

Tracked down by Noriaki TAKAMIYA 
and tested by Kazunori Miyazawa .

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Greg Kroah-Hartman

[PATCH] IPV6: XFRM: Don't use old copy of pointer after pskb_may_pull().

2006-04-24T16:56:04+00:00

[IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull().

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Greg Kroah-Hartman

[PATCH] IPV6: Ensure to have hop-by-hop options in our header of &sk_buff.

2006-04-24T16:56:04+00:00

[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix hotplug race during device registration

2006-04-24T16:56:03+00:00

On Sun, 9 Apr 2006 21:56:59 +0400,
Sergey Vlasov  wrote:
> However, show_address() does not output anything unless
> dev->reg_state == NETREG_REGISTERED - and this state is set by
> netdev_run_todo() only after netdev_register_sysfs() returns, so in
> the meantime (while netdev_register_sysfs() is busy adding the
> "statistics" attribute group) some process may see an empty "address"
> attribute.

I've tried the attached patch, suggested by Sergey Vlasov on
hotplug-devel@, and as far as i can test it works just fine.

Signed-off-by: Alexander Patrakov 
Signed-off-by: David Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix truesize underflow

2006-04-24T16:56:03+00:00

[TCP]: Fix truesize underflow

There is a problem with the TSO packet trimming code.  The cause of
this lies in the tcp_fragment() function.

When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero.  This means that
truesize could in fact be less than the real payload length.

When that happens the TSO packet trimming can cause truesize to become
negative.  This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.

I've copied the code DaveM used in tso_fragment which should work here.

Signed-off-by: Herbert Xu 
Signed-off-by: David Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] ip_route_input panic fix (CVE-2006-1525)

2006-04-18T21:31:47+00:00

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=6388
The bug is caused by ip_route_input dereferencing skb->nh.protocol of
the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing
it). It only happens if the route requested is for a multicast IP
address.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] atm: clip causes unregister hang

2006-04-17T20:16:06+00:00

If Classical IP over ATM module is loaded, its neighbor table gets
populated when permanent neighbor entries are created; but these entries
are not flushed when the device is removed. Since the entry never gets
flushed the unregister of the network device never completes.

This version of the patch also adds locking around the reference to
the atm arp daemon to avoid races with events and daemon state changes.
(Note: barrier() was never really safe)

Bug-reference: http://bugzilla.kernel.org/show_bug.cgi?id=6295

Signed-off-by: Stephen Hemminger 
Signed-off-by: Greg Kroah-Hartman

[PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter

2006-04-17T20:16:04+00:00

[NETFILTER]: Fix fragmentation issues with bridge netfilter

The conntrack code doesn't do re-fragmentation of defragmented packets
anymore but relies on fragmentation in the IP layer. Purely bridged
packets don't pass through the IP layer, so the bridge netfilter code
needs to take care of fragmentation itself.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

[PATCH] fib_trie.c node freeing fix

2006-04-07T16:44:29+00:00

Please apply to 2.6.{14,15,16} -stable, thanks a lot.

From: Robert Olsson 

[FIB_TRIE]: Fix leaf freeing.

Seems like leaf (end-nodes) has been freed by __tnode_free_rcu and not
by __leaf_free_rcu. This fixes the problem. Only tnode_free is now
used which checks for appropriate node type. free_leaf can be removed.

Signed-off-by: Robert Olsson 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] {ip, nf}_conntrack_netlink: fix expectation notifier unregistration

2006-04-07T16:44:28+00:00

[NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration

This patch fixes expectation notifier unregistration on module unload to
use ip_conntrack_expect_unregister_notifier(). This bug causes a soft
lockup at the first expectation created after a rmmod ; insmod of this
module.

Should go into -stable as well.

Signed-off-by: Martin Josefsson 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman