summaryrefslogtreecommitdiffstats
path: root/net
Commit message (Collapse)AuthorAgeFilesLines
* [TCP]: DSACK signals data receival, be conservativeIlpo Järvinen2007-08-021-1/+4
| | | | | | | | In case a DSACK is received, it's better to lower cwnd as it's a sign of data receival. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* [TCP]: Also handle snd_una changes in tcp_cwnd_downIlpo Järvinen2007-08-021-16/+18
| | | | | | | | | | | | | | | | | | | | | | tcp_cwnd_down must check for it too as it should be conservative in case of collapse stuff and also when receiver is trying to lie (though that wouldn't be very successful/useful anyway). Note: - Separated also is_dupack and do_lost in fast_retransalert * Much cleaner look-and-feel now * This time it really fixes cumulative ACK with many new SACK blocks recovery entry (I claimed this fixes with last patch but it wasn't). TCP will now call tcp_update_scoreboard regardless of is_dupack when in recovery as long as there is enough fackets_out. - Introduce FLAG_SND_UNA_ADVANCED * Some prior_snd_una arguments are unnecessary after it - Added helper FLAG_ANY_PROGRESS to avoid long FLAG...|FLAG... constructs Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge davem@master.kernel.org:/pub/scm/linux/kernel/git/vxy/lksctp-devDavid S. Miller2007-08-026-59/+113
|\
| * SCTP: remove useless code in function sctp_init_causeWei Yongjun2007-08-021-3/+0
| | | | | | | | | | | | | | | | Some code in function sctp_init_cause() seem useless, this patch remove them. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * SCTP: drop SACK if ctsn is not less than the next tsn of assocWei Yongjun2007-08-021-25/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to drop the SACK if the peer is attempting to acknowledge unset data, i.e. the CTSN in the SACK is greater or equal to the next TSN we will send. Example: Endpoint A Endpoint B <--------------- DATA (TSN=1) SACK(TSN=1) ---------------> <--------------- DATA (TSN=2) <--------------- DATA (TSN=3) <--------------- DATA (TSN=4) <--------------- DATA (TSN=5) SACK(TSN=1000) ---------------> <--------------- DATA (TSN=6) <--------------- DATA (TSN=7) Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * SCTP: IPv4 mapped addr not returned in SCTPv6 accept()Vlad Yasevich2007-08-011-9/+11
| | | | | | | | | | | | | | | | When issuing a connect call on an AF_INET6 sctp socket with a IPv4-mapped destination, the peer address that is returned by getpeeraddr() should be v4-mapped as well. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * SCTP: IPv4 mapped addr not returned in SCTPv6 accept()Dave Johnson2007-08-011-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | An accept() call on a SCTPv6 socket that returns due to connection of a IPv4 mapped peer will fill out the 'struct sockaddr' with a zero IPv6 address instead of the IPv4 mapped address of the peer. This is due to the v4mapped flag not getting copied into the new socket on accept() as well as a missing check for INET6 socket type in sctp_v4_to_sk_*addr(). Signed-off-by: Dave Johnson <djohnson@sw.starentnetworks.com> Cc: Srinivas Akkipeddi <sakkiped@starentnetworks.com> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * sctp: fix shadow symbol in net/sctp/tsnmap.cSebastian Siewior2007-08-011-7/+7
| | | | | | | | | | | | | | | | | | | | net/sctp/tsnmap.c:164:16: warning: symbol '_end' shadows an earlier one include/asm-generic/sections.h:13:13: originally declared here Renamed renamed _end to end_ and _start (for consistence). Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * sctp: try to fix readlockSebastian Siewior2007-08-011-5/+11
| | | | | | | | | | | | | | unlock the reader lock in error case. Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * sctp: remove shadowed symbolssebastian@breakpoint.cc2007-08-012-2/+0
| | | | | | | | | | | | | | | | | | | | | | Fixes the following sparse warnings: net/sctp/sm_make_chunk.c:1457:9: warning: symbol 'len' shadows an earlier one net/sctp/sm_make_chunk.c:1356:23: originally declared here net/sctp/socket.c:1534:22: warning: symbol 'chunk' shadows an earlier one net/sctp/socket.c:1387:20: originally declared here Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * sctp: move global declaration to header file.sebastian@breakpoint.cc2007-08-012-4/+0
| | | | | | | | | | | | | | | | sctp_chunk_cachep & sctp_bucket_cachep is used module global, so move it to a header file. Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
| * sctp: make locally used function staticsebastian@breakpoint.cc2007-08-012-4/+4
| | | | | | | | | | | | | | | | Forward declarion is static, the function itself is not. Make it consistent. Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
* | [TIPC]: Fix two minor sparse warnings.Florian Westphal2007-08-022-3/+1
| | | | | | | | | | | | | | | | | | | | fix two warnings generated by sparse: link.c:2386 symbol 'msgcount' shadows an earlier one node.c:244 symbol 'addr_string' shadows an earlier one Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [TIPC]: Make function tipc_nameseq_subscribe static.Florian Westphal2007-08-021-1/+1
| | | | | | | | | | | | | | make needlessly global function tipc_nameseq_subscribe static. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10Joy Latten2007-08-021-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although an ipsec SA was established, kernel couldn't seem to find it. I think since we are now using "x->sel.family" instead of "family" in the xfrm_selector_match() called in xfrm_state_find(), af_key needs to set this field too, just as xfrm_user. In af_key.c, x->sel.family only gets set when there's an ext_hdrs[SADB_EXT_ADDRESS_PROXY-1] which I think is for tunnel. I think pfkey needs to also set the x->sel.family field when it is 0. Tested with below patch, and ipsec worked when using pfkey. Signed-off-by: David S. Miller <davem@davemloft.net>
* | [TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg().David S. Miller2007-08-025-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As discovered by Evegniy Polyakov, if we try to sendmsg after a connection reset, we can do incredibly stupid things. The core issue is that inet_sendmsg() tries to autobind the socket, but we should never do that for TCP. Instead we should just go straight into TCP's sendmsg() code which will do all of the necessary state and pending socket error checks. TCP's sendpage already directly vectors to tcp_sendpage(), so this merely brings sendmsg() in line with that. Signed-off-by: David S. Miller <davem@davemloft.net>
* | [IPV4] route.c: mostly kmalloc + memset conversion to k[cz]allocMariusz Kozlowski2007-08-021-2/+2
| | | | | | | | | | Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [IPV4] raw.c: kmalloc + memset conversion to kzallocMariusz Kozlowski2007-08-021-2/+2
| | | | | | | | | | Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [NETFILTER] nf_conntrack_l3proto_ipv4_compat.c: kmalloc + memset conversion ↵Mariusz Kozlowski2007-08-021-3/+2
| | | | | | | | | | | | | | to kzalloc Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [NETFILTER] nf_conntrack_expect.c: kmalloc + memset conversion to kzallocMariusz Kozlowski2007-08-021-3/+2
| | | | | | | | | | Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [NET]: Removal of duplicated include net/wanrouter/wanmain.cMichal Piotrowski2007-08-021-1/+0
| | | | | | | | | | Signed-off-by: Michal Piotrowski <michal.k.k.piotrowski@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Net/Security: fix memory leaks from security_secid_to_secctx()Paul Moore2007-08-022-3/+6
|/ | | | | | | | | | | The security_secid_to_secctx() function returns memory that must be freed by a call to security_release_secctx() which was not always happening. This patch fixes two of these problems (all that I could find in the kernel source at present). Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
* Merge branch 'master' of ↵Linus Torvalds2007-07-3135-288/+363
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 * 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (41 commits) [RTNETLINK]: Fix warning for !CONFIG_KMOD [IPV4] ip_options.c: kmalloc + memset conversion to kzalloc [DECNET]: kmalloc + memset conversion to kzalloc [NET]: ethtool_perm_addr only has one implementation [NET]: ethtool ops are the only way [PPPOE]: Improve hashing function in hash_item(). [XFRM]: State selection update to use inner addresses. [IPSEC]: Ensure that state inner family is set [TCP]: Bidir flow must not disregard SACK blocks for lost marking [TCP]: Fix ratehalving with bidirectional flows [PPPOL2TP]: Add CONFIG_INET Kconfig dependency. [NET]: Page offsets and lengths need to be __u32. [AF_UNIX]: Make code static. [NETFILTER]: Make nf_ct_ipv6_skip_exthdr() static. [PKTGEN]: make get_ipsec_sa() static and non-inline [PPPoE]: move lock_sock() in pppoe_sendmsg() to the right location [PPPoX/E]: return ENOTTY on unknown ioctl requests [IPV6]: ipv6_addr_type() doesn't know about RFC4193 addresses. [NET]: Fix prio_tune() handling of root qdisc. [NET]: Fix sch_api to properly set sch->parent on the root. ...
| * [RTNETLINK]: Fix warning for !CONFIG_KMODThomas Graf2007-07-311-0/+2
| | | | | | | | | | | | | | replay label is unused otherwise. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [IPV4] ip_options.c: kmalloc + memset conversion to kzallocMariusz Kozlowski2007-07-311-5/+2
| | | | | | | | | | Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [DECNET]: kmalloc + memset conversion to kzallocMariusz Kozlowski2007-07-311-2/+2
| | | | | | | | | | Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: ethtool_perm_addr only has one implementationMatthew Wilcox2007-07-311-35/+8
| | | | | | | | | | | | | | | | | | All drivers implement ethtool get_perm_addr the same way -- by calling the generic function. So we can inline the generic function into the caller and avoid going through the drivers. Signed-off-by: Matthew Wilcox <matthew@wil.cx> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: ethtool ops are the only wayMatthew Wilcox2007-07-313-43/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During the transition to the ethtool_ops way of doing things, we supported calling the device's ->do_ioctl method to allow unconverted drivers to continue working. Those days are long behind us, all in-tree drivers use the ethtool_ops way, and so we no longer need to support this. The bonding driver is the biggest beneficiary of this; it no longer needs to call ioctl() as a fallback if ethtool_ops aren't supported. Also put a proper copyright statement on ethtool.c. Signed-off-by: Matthew Wilcox <matthew@wil.cx> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [XFRM]: State selection update to use inner addresses.Joakim Koskela2007-07-312-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch modifies the xfrm state selection logic to use the inner addresses where the outer have been (incorrectly) used. This is required for beet mode in general and interfamily setups in both tunnel and beet mode. Signed-off-by: Joakim Koskela <jookos@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Diego Beltrami <diego.beltrami@gmail.com> Signed-off-by: Miika Komu <miika@iki.fi> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [IPSEC]: Ensure that state inner family is setHerbert Xu2007-07-311-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | Similar to the issue we had with template families which specified the inner families of policies, we need to set the inner families of states as the main xfrm user Openswan leaves it as zero. af_key is unaffected because the inner family is set by it and not the KM. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [TCP]: Bidir flow must not disregard SACK blocks for lost markingIlpo Järvinen2007-07-311-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's possible that new SACK blocks that should trigger new LOST markings arrive with new data (which previously made is_dupack false). In addition, I think this fixes a case where we get a cumulative ACK with enough SACK blocks to trigger the fast recovery (is_dupack would be false there too). I'm not completely pleased with this solution because readability of the code is somewhat questionable as 'is_dupack' in SACK case is no longer about dupacks only but would mean something like 'lost_marker_work_todo' too... But because of Eifel stuff done in CA_Recovery, the FLAG_DATA_SACKED check cannot be placed to the if statement which seems attractive solution. Nevertheless, I didn't like adding another variable just for that either... :-) Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [TCP]: Fix ratehalving with bidirectional flowsIlpo Järvinen2007-07-311-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | Actually, the ratehalving seems to work too well, as cwnd is reduced on every second ACK even though the packets in flight remains unchanged. Recoveries in a bidirectional flows suffer quite badly because of this, both NewReno and SACK are affected. After this patch, rate halving is performed for ACK only if packets in flight was supposedly changed too. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [AF_UNIX]: Make code static.Adrian Bunk2007-07-311-2/+28
| | | | | | | | | | | | | | | | | | The following code can now become static: - struct unix_socket_table - unix_table_lock Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NETFILTER]: Make nf_ct_ipv6_skip_exthdr() static.Adrian Bunk2007-07-311-2/+2
| | | | | | | | | | | | | | nf_ct_ipv6_skip_exthdr() can now become static. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [PKTGEN]: make get_ipsec_sa() static and non-inlineAdrian Bunk2007-07-311-2/+1
| | | | | | | | | | | | | | | | | | Non-static inline code usually doesn't makes sense. In this case making is static and non-inline is the correct solution. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [IPV6]: ipv6_addr_type() doesn't know about RFC4193 addresses.Dave Johnson2007-07-311-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipv6_addr_type() doesn't check for 'Unique Local IPv6 Unicast Addresses' (RFC4193) and returns IPV6_ADDR_RESERVED for that range. SCTP uses this function and will fail bind() and connect() calls that use RFC4193 addresses, SCTP will also ignore inbound connections from RFC4193 addresses if listening on IPV6_ADDR_ANY. There may be other users of ipv6_addr_type() that could also have problems. Signed-off-by: Dave Johnson <djohnson@sw.starentnetworks.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: Fix prio_tune() handling of root qdisc.Peter P Waskiewicz Jr2007-07-311-2/+4
| | | | | | | | | | | | | | | | | | Fix the check in prio_tune() to see if sch->parent is TC_H_ROOT instead of sch->handle to load or reject the qdisc for multiqueue devices. Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: Fix sch_api to properly set sch->parent on the root.Patrick McHardy2007-07-311-5/+12
| | | | | | | | | | | | | | | | | | Fix sch_api to correctly set sch->parent for both ingress and egress qdiscs in qdisc_create(). Signed-off-by: Patrick McHardy <trash@kaber.net> Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET_SCHED]: Fix prio/ingress classification logic errorPatrick McHardy2007-07-312-6/+4
| | | | | | | | | | | | | | | | | | | | | | Fix handling of empty or completely non-matching filter chains. In that case -1 is returned and tcf_result is uninitialized, the qdisc should fall back to default classification in that case. Noticed by PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [IPV4/IPV6]: Fail registration if inet device construction failsHerbert Xu2007-07-312-6/+7
| | | | | | | | | | | | | | | | | | | | Now that netdev notifications can fail, we can use this to signal errors during registration for IPv4/IPv6. In particular, if we fail to allocate memory for the inet device, we can fail the netdev registration. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: Allow netdev REGISTER/CHANGENAME events to failHerbert Xu2007-07-311-10/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds code to allow errors to be passed up from event handlers of NETDEV_REGISTER and NETDEV_CHANGENAME. It also adds the notifier_from_errno/notifier_to_errnor helpers to pass the errno value up to the notifier caller. If an error is detected when a device is registered, it causes that operation to fail. A NETDEV_UNREGISTER will be sent to all event handlers. Similarly if NETDEV_CHANGENAME fails the original name is restored and a new NETDEV_CHANGENAME event is sent. As such all event handlers must be idempotent with respect to these events. When an event handler is registered NETDEV_REGISTER events are sent for all devices currently registered. Should any of them fail, we will send NETDEV_GOING_DOWN/NETDEV_DOWN/NETDEV_UNREGISTER events to that handler for the devices which have already been registered with it. The handler registration itself will fail. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: Take dev_base_lock when moving device name hash list entryHerbert Xu2007-07-311-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When we added name-based hashing the dev_base_lock was designated as the lock to take when changing the name hash list. Unfortunately, because it was a preexisting lock that just happened to be taken in the right spots we neglected to take it in dev_change_name. The race can affect calles of __dev_get_by_name that do so without taking the RTNL. They may end up walking down the wrong hash chain and end up missing the device that they're looking for. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: Call uninit if necessary in register_netdeviceHerbert Xu2007-07-311-3/+8
| | | | | | | | | | | | | | | | | | | | This patch makes register_netdevice call dev->uninit if the regsitration fails after dev->init has completed successfully. Very few drivers use the init/uninit calls but at least one (drivers/net/wan/sealevel.c) may leak without this change. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [IPVS]: Use skb_forward_csumHerbert Xu2007-07-311-1/+1
| | | | | | | | | | | | | | | | | | As a path that forwards packets, IPVS should be using skb_forward_csum instead of directly setting ip_summed to CHECKSUM_NONE. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [PKTGEN]: Add missing KERN_* tags to printk()s.David S. Miller2007-07-311-46/+57
| | | | | | | | Signed-off-by: David S. Miller <davem@davemloft.net>
| * [BLUETOOTH] l2cap: don't mangle cmd.lenAl Viro2007-07-311-1/+0
| | | | | | | | | | | | | | | | | | Since nobody uses it after we convert it to host-endian, no need to do that at all. At that point l2cap is endian-clean. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [BLUETOOTH]: pass (host-endian) cmd length as explicit argument to ↵Al Viro2007-07-311-9/+11
| | | | | | | | | | | | | | | | l2cap_conf_req() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [BLUETOOTH] l2cap: endianness annotationsAl Viro2007-07-311-13/+14
| | | | | | | | | | | | | | | | no code changes, just documenting existing types Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [BLUETOOTH]: Fix endianness bug in l2cap_sock_listen()Al Viro2007-07-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We loop through psm values, calling __l2cap_get_sock_by_addr(psm, ...) until we get NULL; then we set ->psm of our socket to htobs(psm). IOW, we find unused psm value and put it into our socket. So far, so good, but... __l2cap_get_sock_by_addr() compares its argument with ->psm of sockets. IOW, the entire thing works correctly only on little-endian. On big-endian we'll get "no socket with such psm" on the first iteration, since we won't find a socket with ->psm == 0x1001. We will happily conclude that 0x1001 is unused and slap htobs(0x1001) (i.e. 0x110) into ->psm of our socket. Of course, the next time around the same thing will repeat and we'll just get a fsckload of sockets with the same ->psm assigned. Fix: pass htobs(psm) to __l2cap_get_sock_by_addr() there. All other callers are already passing little-endian values and all places that store something in ->psm are storing little-endian. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [IRDA]: Fix rfcomm use-after-freeMarcel Holtmann2007-07-311-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adrian Bunk wrote: > Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following > use-after-free in net/bluetooth/rfcomm/tty.c: > > <-- snip --> > > ... > static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc) > { > ... > if (IS_ERR(dev->tty_dev)) { > list_del(&dev->list); > kfree(dev); > return PTR_ERR(dev->tty_dev); > } > ... > > <-- snip --> > > Spotted by the Coverity checker. really good catch. I fully overlooked that one. The attached patch should fix it. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-24 22:24:35 +0000