linux-toradex.git/net, branch v2.6.32.8

mac80211: fix NULL pointer dereference when ftrace is enabled

2010-02-09T12:51:00+00:00

commit 3092ad054406f069991ca561adc74f2d9fbb6867 upstream.

I got below kernel oops when I try to bring down the network interface if
ftrace is enabled. The root cause is drv_ampdu_action() is passed with a
NULL ssn pointer in the BA session tear down case. We need to check and
avoid dereferencing it in trace entry assignment.

BUG: unable to handle kernel NULL pointer dereference
Modules linked in: at (null)
IP: [] ftrace_raw_event_drv_ampdu_action+0x10a/0x160 [mac80211]
*pde = 00000000
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[...]
Call Trace:
 [] ? ftrace_raw_event_drv_ampdu_action+0x0/0x160 [mac80211]
 [] ? __ieee80211_stop_rx_ba_session+0xfc/0x220 [mac80211]
 [] ? ieee80211_sta_tear_down_BA_sessions+0x3b/0x50 [mac80211]
 [] ? ieee80211_set_disassoc+0xe6/0x230 [mac80211]
 [] ? ieee80211_set_disassoc+0x9c/0x230 [mac80211]
 [] ? ieee80211_mgd_deauth+0x158/0x170 [mac80211]
 [] ? ieee80211_deauth+0x1b/0x20 [mac80211]
 [] ? __cfg80211_mlme_deauth+0xe9/0x120 [cfg80211]
 [] ? __cfg80211_disconnect+0x170/0x1d0 [cfg80211]

Cc: Johannes Berg 
Signed-off-by: Zhu Yi 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ax25: netrom: rose: Fix timer oopses

2010-02-09T12:50:56+00:00

[ Upstream commit d00c362f1b0ff54161e0a42b4554ac621a9ef92d ]

Wrong ax25_cb refcounting in ax25_send_frame() and by its callers can
cause timer oopses (first reported with 2.6.29.6 kernel).

Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=14905

Reported-by: Bernard Pidoux 
Tested-by: Bernard Pidoux 
Signed-off-by: Jarek Poplawski 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

af_packet: Don't use skb after dev_queue_xmit()

2010-02-09T12:50:56+00:00

[ Upstream commit eb70df13ee52dbc0f2c0ffd8ed34a8cd27440baf ]

tpacket_snd() can change and kfree an skb after dev_queue_xmit(),
which is illegal.

With debugging by: Stephen Hemminger 

Reported-by: Michael Breuer 
With help from: David S. Miller 
Signed-off-by: Jarek Poplawski 
Tested-by: Michael Breuer
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: restore ip source validation

2010-02-09T12:50:55+00:00

[ Upstream commit 28f6aeea3f12d37bd258b2c0d5ba891bff4ec479 ]

when using policy routing and the skb mark:
there are cases where a back path validation requires us
to use a different routing table for src ip validation than
the one used for mapping ingress dst ip.
One such a case is transparent proxying where we pretend to be
the destination system and therefore the local table
is used for incoming packets but possibly a main table would
be used on outbound.
Make the default behavior to allow the above and if users
need to turn on the symmetry via sysctl src_valid_mark

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: update the netstamp_needed counter when cloning sockets

2010-02-09T12:50:55+00:00

[ Upstream commit 704da560c0a0120d8869187f511491a00951a1d3 ]

This fixes a netstamp_needed accounting issue when the listen socket
has SO_TIMESTAMP set:

    s = socket(AF_INET, SOCK_STREAM, 0);
    setsockopt(s, SOL_SOCKET, SO_TIMESTAMP, 1); -> netstamp_needed = 1
    bind(s, ...);
    listen(s, ...);
    s2 = accept(s, ...); -> netstamp_needed = 1
    close(s2); -> netstamp_needed = 0
    close(s); -> netstamp_needed = -1

Signed-off-by: Octavian Purdila 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

cfg80211: fix channel setting for wext

2010-01-28T23:02:38+00:00

commit 5f6120335c701ba07d5151206071f4d6ccaa684f upstream.

Patch fixes the bug at
http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2139

Currently we cannot set the channel using wext extension
if we have already associated and disconnected. As
cfg80211_mgd_wext_siwfreq will not switch the channel if ssid is set.
This fixes it by clearing the ssid.
Following is the sequence which it tries to fix.
modprobe iwlagn
iwconfig wlan0 essid ""
ifconfig wlan0 down
iwconfig wlan0 chan X

wext is marked as deprecate.If we use nl80211 we can easily play with
setting the channel.

Signed-off-by: Abhijeet Kolekar 
Acked-by: Samuel Ortiz 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

mac80211: check that ieee80211_set_power_mgmt only handles STA interfaces.

2010-01-28T23:02:37+00:00

commit e5de30c9bf4a39db9f54c4a373470ce65881ade0 upstream.

ieee80211_set_power_mgmt is meant for STA interfaces only. Moreover,
since sdata->u.mgd.mtx is only initialized for STA interfaces, using
this code for any other type of interface (like creating a monitor
interface) will result in a oops.

Signed-off-by: Benoit Papillault 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

netfilter: xtables: fix conntrack match v1 ipt-save output

2010-01-28T23:01:04+00:00

commit 3a0429292daa0e1ec848bd26479f5e48b0d54a42 upstream.

commit d6d3f08b0fd998b647a05540cedd11a067b72867
(netfilter: xtables: conntrack match revision 2) does break the
v1 conntrack match iptables-save output in a subtle way.

Problem is as follows:

    up = kmalloc(sizeof(*up), GFP_KERNEL);
[..]
   /*
    * The strategy here is to minimize the overhead of v1 matching,
    * by prebuilding a v2 struct and putting the pointer into the
    * v1 dataspace.
    */
    memcpy(up, info, offsetof(typeof(*info), state_mask));
[..]
    *(void **)info  = up;

As the v2 struct pointer is saved in the match data space,
it clobbers the first structure member (->origsrc_addr).

Because the _v1 match function grabs this pointer and does not actually
look at the v1 origsrc, run time functionality does not break.
But iptables -nvL (or iptables-save) cannot know that v1 origsrc_addr
has been overloaded in this way:

$ iptables -p tcp -A OUTPUT -m conntrack --ctorigsrc 10.0.0.1 -j ACCEPT
$ iptables-save
-A OUTPUT -p tcp -m conntrack --ctorigsrc 128.173.134.206 -j ACCEPT

(128.173... is the address to the v2 match structure).

To fix this, we take advantage of the fact that the v1 and v2 structures
are identical with exception of the last two structure members (u8 in v1,
u16 in v2).

We extract them as early as possible and prevent the v2 matching function
from looking at those two members directly.

Previously reported by Michel Messerschmidt via Ben Hutchings, also
see Debian Bug tracker #556587.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().

2010-01-18T18:19:52+00:00

commit 2570a4f5428bcdb1077622342181755741e7fa60 upstream.

This fixes CERT-FI FICORA #341748

Discovered by Olli Jarva and Tuomo Untinen from the CROSS
project at Codenomicon Ltd.

Just like in CVE-2007-4567, we can't rely upon skb_dst() being
non-NULL at this point.  We fixed that in commit
e76b2b2567b83448c2ee85a896433b96150c92e6 ("[IPV6]: Do no rely on
skb->dst before it is assigned.")

However commit 483a47d2fe794328d29950fe00ce26dd405d9437 ("ipv6: added
net argument to IP6_INC_STATS_BH") put a new version of the same bug
into this function.

Complicating analysis further, this bug can only trigger when network
namespaces are enabled in the build.  When namespaces are turned off,
the dev_net() does not evaluate it's argument, so the dereference
would not occur.

So, for a long time, namespaces couldn't be turned on unless SYSFS was
disabled.  Therefore, this code has largely been disabled except by
people turning it on explicitly for namespace development.

With help from Eugene Teo 

Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix skb buffering issue (and fixes to that)

2010-01-18T18:19:49+00:00

This is a backport of the mainline patches

 cf0277e714a0db302a8f80e1b85fd61c32cf00b3
 045cfb71a3901005bf6dcedae98cecb3360a0bfc
 b49bb574e44226b332c28439999d196ddec2f643

Here is the description of the first of
those patches (the other two just fixed
bugs added by that patch):

Since I removed the master netdev, we've been
keeping internal queues only, and even before
that we never told the networking stack above
the virtual interfaces about congestion. This
means that packets are queued in mac80211 and
the upper layers never know, possibly leading
to memory exhaustion and other problems.

This patch makes all interfaces multiqueue and
uses ndo_select_queue to put the packets into
queues per AC. Additionally, when the driver
stops a queue, we now stop all corresponding
queues for the virtual interfaces as well.

The injection case will use VO by default for
non-data frames, and BE for data frames, but
downgrade any data frames according to ACM. It
needs to be fleshed out in the future to allow
chosing the queue/AC in radiotap.

Signed-off-by: Johannes Berg 
Cc: John W. Linville 
Signed-off-by: Greg Kroah-Hartman