linux-toradex.git/net, branch v2.6.32.5

ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().

2010-01-18T18:19:52+00:00

commit 2570a4f5428bcdb1077622342181755741e7fa60 upstream.

This fixes CERT-FI FICORA #341748

Discovered by Olli Jarva and Tuomo Untinen from the CROSS
project at Codenomicon Ltd.

Just like in CVE-2007-4567, we can't rely upon skb_dst() being
non-NULL at this point.  We fixed that in commit
e76b2b2567b83448c2ee85a896433b96150c92e6 ("[IPV6]: Do no rely on
skb->dst before it is assigned.")

However commit 483a47d2fe794328d29950fe00ce26dd405d9437 ("ipv6: added
net argument to IP6_INC_STATS_BH") put a new version of the same bug
into this function.

Complicating analysis further, this bug can only trigger when network
namespaces are enabled in the build.  When namespaces are turned off,
the dev_net() does not evaluate it's argument, so the dereference
would not occur.

So, for a long time, namespaces couldn't be turned on unless SYSFS was
disabled.  Therefore, this code has largely been disabled except by
people turning it on explicitly for namespace development.

With help from Eugene Teo 

Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix skb buffering issue (and fixes to that)

2010-01-18T18:19:49+00:00

This is a backport of the mainline patches

 cf0277e714a0db302a8f80e1b85fd61c32cf00b3
 045cfb71a3901005bf6dcedae98cecb3360a0bfc
 b49bb574e44226b332c28439999d196ddec2f643

Here is the description of the first of
those patches (the other two just fixed
bugs added by that patch):

Since I removed the master netdev, we've been
keeping internal queues only, and even before
that we never told the networking stack above
the virtual interfaces about congestion. This
means that packets are queued in mac80211 and
the upper layers never know, possibly leading
to memory exhaustion and other problems.

This patch makes all interfaces multiqueue and
uses ndo_select_queue to put the packets into
queues per AC. Additionally, when the driver
stops a queue, we now stop all corresponding
queues for the virtual interfaces as well.

The injection case will use VO by default for
non-data frames, and BE for data frames, but
downgrade any data frames according to ACM. It
needs to be fleshed out in the future to allow
chosing the queue/AC in radiotap.

Signed-off-by: Johannes Berg 
Cc: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: add missing sanity checks for action frames

2010-01-18T18:19:47+00:00

commit d79074488083ec0d7ecd15352192dc1631f25643 upstream.

Various missing sanity checks caused rejected action frames to be
interpreted as channel switch announcements, which can cause a client
mode interface to switch away from its operating channel, thereby losing
connectivity. This patch ensures that only spectrum management action
frames are processed by the CSA handling function and prevents rejected
action frames from getting processed by the MLME code.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: fix syntax error on user regulatory hints

2010-01-18T18:19:45+00:00

commit e12822e1d3fface0d9e1095c5177e10141bd6bd6 upstream.

This fixes a syntax error when setting up the user regulatory
hint. This change yields the same exact binary object though
so it ends up just being a syntax typo fix, fortunately.

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_ct_ftp: fix out of bounds read in update_nl_seq()

2010-01-18T18:19:41+00:00

commit aaff23a95aea5f000895f50d90e91f1e2f727002 upstream.

As noticed by Dan Carpenter , update_nl_seq()
currently contains an out of bounds read of the seq_aft_nl array
when looking for the oldest sequence number position.

Fix it to only compare valid positions.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: ebtables: enforce CAP_NET_ADMIN

2010-01-18T18:19:40+00:00

commit dce766af541f6605fa9889892c0280bab31c66ab upstream.

normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

sunrpc: on successful gss error pipe write, don't return error

2010-01-18T18:19:21+00:00

commit 486bad2e40e938cd68fd853b7a9fa3115a9d3a4a upstream.

When handling the gssd downcall, the kernel should distinguish between a
successful downcall that contains an error code and a failed downcall
(i.e. where the parsing failed or some other sort of problem occurred).

In the former case, gss_pipe_downcall should be returning the number of
bytes written to the pipe instead of an error. In the event of other
errors, we generally want the initiating task to retry the upcall so
we set msg.errno to -EAGAIN. An unexpected error code here is a bug
however, so BUG() in that case.

Signed-off-by: Jeff Layton 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Fix the return value in gss_import_sec_context()

2010-01-18T18:19:20+00:00

commit b891e4a05ef6beac85465295a032431577c66b16 upstream.

If the context allocation fails, it will return GSS_S_FAILURE, which is
neither a valid error code, nor is it even negative.

Return ENOMEM instead...

Reported-by: Jeff Layton 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Fix up an error return value in gss_import_sec_context_kerberos()

2010-01-18T18:19:19+00:00

commit 14ace024b1e16d2bb9445c8387494fbbd820a738 upstream.

If the context allocation fails, the function currently returns a random
error code, since the variable 'p' still points to a valid memory location.

Ensure that it returns ENOMEM...

Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

sunrpc: fix peername failed on closed listener

2010-01-18T18:19:18+00:00

commit b292cf9ce70d221c3f04ff62db5ab13d9a249ca8 upstream.

There're some warnings of "nfsd: peername failed (err 107)!"
socket error -107 means Transport endpoint is not connected.
This warning message was outputed by svc_tcp_accept() [net/sunrpc/svcsock.c],
when kernel_getpeername returns -107. This means socket might be CLOSED.

And svc_tcp_accept was called by svc_recv() [net/sunrpc/svc_xprt.c]

        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
        
                newxpt = xprt->xpt_ops->xpo_accept(xprt);
        

So this might happen when xprt->xpt_flags has both XPT_LISTENER and XPT_CLOSE.

Let's take a look at commit b0401d72, this commit has moved the close
processing after do recvfrom method, but this commit also introduces this
warnings, if the xpt_flags has both XPT_LISTENER and XPT_CLOSED, we should
close it, not accpet then close.

Signed-off-by: Xiaotian Feng 
Cc: J. Bruce Fields 
Cc: Neil Brown 
Cc: Trond Myklebust 
Cc: David S. Miller 
Cc: Nikola Ciprich 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman