linux-toradex.git/net, branch v2.6.32.31

x25: Do not reference freed memory.

2011-03-02T14:47:07+00:00

commit 96642d42f076101ba98866363d908cab706d156c upstream.

In x25_link_free(), we destroy 'nb' before dereferencing
'nb->dev'.  Don't do this, because 'nb' might be freed
by then.

Reported-by: Randy Dunlap 
Tested-by: Randy Dunlap 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: Make TCP_MAXSEG minimum more correct.

2011-03-02T14:46:46+00:00

commit c39508d6f118308355468314ff414644115a07f3 upstream.

Use TCP_MIN_MSS instead of constant 64.

Reported-by: Min Zhang 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman

tcp: Increase TCP_MAXSEG socket option minimum.

2011-03-02T14:46:45+00:00

commit 7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2 upstream.

As noted by Steve Chen, since commit
f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS
requested by user") we can end up with a situation where
tcp_select_initial_window() does a divide by a zero (or
even negative) mss value.

The problem is that sometimes we effectively subtract
TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss.

Fix this by increasing the minimum from 8 to 64.

Reported-by: Steve Chen 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman

sunrpc/cache: fix module refcnt leak in a failure path

2011-03-02T14:46:44+00:00

commit a5990ea1254cd186b38744507aeec3136a0c1c95 upstream.

Don't forget to release the module refcnt if seq_open() returns failure.

Signed-off-by: Li Zefan 
Cc: J. Bruce Fields 
Cc: Neil Brown 
Cc: Trond Myklebust 
Signed-off-by: Andrew Morton 
Signed-off-by: J. Bruce Fields 
Cc: maximilian attems 
Signed-off-by: Greg Kroah-Hartman

x25: decrement netdev reference counts on unload

2011-03-02T14:46:35+00:00

commit 171995e5d82dcc92bea37a7d2a2ecc21068a0f19 upstream.

x25 does not decrement the network device reference counts on module unload.
Thus unregistering any pre-existing interface after unloading the x25 module
hangs and results in

 unregister_netdevice: waiting for tap0 to become free. Usage count = 1

This patch decrements the reference counts of all interfaces in x25_link_free,
the way it is already done in x25_link_device_down for NETDEV_DOWN events.

Signed-off-by: Apollon Oikonomopoulos 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

filter: make sure filters dont read uninitialized memory

2011-03-02T14:46:35+00:00

commit 57fe93b374a6b8711995c2d466c502af9f3a08bb upstream.

There is a possibility malicious users can get limited information about
uninitialized stack mem array. Even if sk_run_filter() result is bound
to packet length (0 .. 65535), we could imagine this can be used by
hostile user.

Initializing mem[] array, like Dan Rosenberg suggested in his patch is
expensive since most filters dont even use this array.

Its hard to make the filter validation in sk_chk_filter(), because of
the jumps. This might be done later.

In this patch, I use a bitmap (a single long var) so that only filters
using mem[] loads/stores pay the price of added security checks.

For other filters, additional cost is a single instruction.

[ Since we access fentry->k a lot now, cache it in a local variable
  and mark filter entry pointer as const. -DaveM ]

Reported-by: Dan Rosenberg 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
[Backported by dann frazier ]
Signed-off-by: Greg Kroah-Hartman

sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()

2011-03-02T14:46:33+00:00

commit 51e97a12bef19b7e43199fc153cf9bd5f2140362 upstream.

The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids
array and attempts to ensure that only a supported hmac entry is
returned.  The current code fails to do this properly - if the last id
in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the
id integer remains set after exiting the loop, and the address of an
out-of-bounds entry will be returned and subsequently used in the parent
function, causing potentially ugly memory corruption.  This patch resets
the id integer to 0 on encountering an invalid id so that NULL will be
returned after finishing the loop if no valid ids are found.

Signed-off-by: Dan Rosenberg 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sched: Fix softirq time accounting

2011-02-17T23:37:24+00:00

Commit: 75e1056f5c57050415b64cb761a3acc35d91f013 upstream

Peter Zijlstra found a bug in the way softirq time is accounted in
VIRT_CPU_ACCOUNTING on this thread:

   http://lkml.indiana.edu/hypermail//linux/kernel/1009.2/01366.html

The problem is, softirq processing uses local_bh_disable internally. There
is no way, later in the flow, to differentiate between whether softirq is
being processed or is it just that bh has been disabled. So, a hardirq when bh
is disabled results in time being wrongly accounted as softirq.

Looking at the code a bit more, the problem exists in !VIRT_CPU_ACCOUNTING
as well. As account_system_time() in normal tick based accouting also uses
softirq_count, which will be set even when not in softirq with bh disabled.

Peter also suggested solution of using 2*SOFTIRQ_OFFSET as irq count
for local_bh_{disable,enable} and using just SOFTIRQ_OFFSET while softirq
processing. The patch below does that and adds API in_serving_softirq() which
returns whether we are currently processing softirq or not.

Also changes one of the usages of softirq_count in net/sched/cls_cgroup.c
to in_serving_softirq.

Looks like many usages of in_softirq really want in_serving_softirq. Those
changes can be made individually on a case by case basis.

Signed-off-by: Venkatesh Pallipadi 
Signed-off-by: Peter Zijlstra 
LKML-Reference: <1286237003-12406-2-git-send-email-venki@google.com>
Signed-off-by: Ingo Molnar 
Signed-off-by: Mike Galbraith 
Acked-by: Peter Zijlstra 
Signed-off-by: Greg Kroah-Hartman

sctp: Fix a race between ICMP protocol unreachable and connect()

2011-01-07T22:43:18+00:00

commit 50b5d6ad63821cea324a5a7a19854d4de1a0a819 upstream.

ICMP protocol unreachable handling completely disregarded
the fact that the user may have locked the socket.  It proceeded
to destroy the association, even though the user may have
held the lock and had a ref on the association.  This resulted
in the following:

Attempt to release alive inet socket f6afcc00

=========================
[ BUG: held lock freed! ]
-------------------------
somenu/2672 is freeing memory f6afcc00-f6afcfff, with a lock still held
there!
 (sk_lock-AF_INET){+.+.+.}, at: [] sctp_connect+0x13/0x4c
1 lock held by somenu/2672:
 #0:  (sk_lock-AF_INET){+.+.+.}, at: [] sctp_connect+0x13/0x4c

stack backtrace:
Pid: 2672, comm: somenu Not tainted 2.6.32-telco #55
Call Trace:
 [] ? printk+0xf/0x11
 [] debug_check_no_locks_freed+0xce/0xff
 [] kmem_cache_free+0x21/0x66
 [] __sk_free+0x9d/0xab
 [] sk_free+0x1c/0x1e
 [] sctp_association_put+0x32/0x89
 [] __sctp_connect+0x36d/0x3f4
 [] ? sctp_connect+0x13/0x4c
 [] ? autoremove_wake_function+0x0/0x33
 [] sctp_connect+0x31/0x4c
 [] inet_dgram_connect+0x4b/0x55
 [] sys_connect+0x54/0x71
 [] ? lock_release_non_nested+0x88/0x239
 [] ? might_fault+0x42/0x7c
 [] ? might_fault+0x42/0x7c
 [] sys_socketcall+0x6d/0x178
 [] ? trace_hardirqs_on_thunk+0xc/0x10
 [] syscall_call+0x7/0xb

This was because the sctp_wait_for_connect() would aqcure the socket
lock and then proceed to release the last reference count on the
association, thus cause the fully destruction path to finish freeing
the socket.

The simplest solution is to start a very short timer in case the socket
is owned by user.  When the timer expires, we can do some verification
and be able to do the release properly.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: release dst entry while cache-hot for GSO case too

2011-01-07T22:43:14+00:00

commit 068a2de57ddf4f472e32e7af868613c574ad1d88 upstream.

Non-GSO code drops dst entry for performance reasons, but
the same is missing for GSO code. Drop dst while cache-hot
for GSO case too.

Signed-off-by: Krishna Kumar 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Andrey Vagin 
Signed-off-by: Greg Kroah-Hartman