Commit 4a73a437 authored by Linus Torvalds's avatar Linus Torvalds

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  vlan: dont drop packets from unknown vlans in promiscuous mode
  Phonet: Correct header retrieval after pskb_may_pull
  um: Proper Fix for f25c80a4: remove duplicate structure field initialization
  ip_gre: Fix dependencies wrt. ipv6.
  net-2.6: SYN retransmits: Add new parameter to retransmits_timed_out()
  iwl3945: queue the right work if the scan needs to be aborted
  mac80211: fix use-after-free
parents c470af0a 173e79fb
...@@ -255,18 +255,6 @@ static void uml_net_tx_timeout(struct net_device *dev) ...@@ -255,18 +255,6 @@ static void uml_net_tx_timeout(struct net_device *dev)
netif_wake_queue(dev); netif_wake_queue(dev);
} }
static int uml_net_set_mac(struct net_device *dev, void *addr)
{
struct uml_net_private *lp = netdev_priv(dev);
struct sockaddr *hwaddr = addr;
spin_lock_irq(&lp->lock);
eth_mac_addr(dev, hwaddr->sa_data);
spin_unlock_irq(&lp->lock);
return 0;
}
static int uml_net_change_mtu(struct net_device *dev, int new_mtu) static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
{ {
dev->mtu = new_mtu; dev->mtu = new_mtu;
...@@ -373,7 +361,7 @@ static const struct net_device_ops uml_netdev_ops = { ...@@ -373,7 +361,7 @@ static const struct net_device_ops uml_netdev_ops = {
.ndo_start_xmit = uml_net_start_xmit, .ndo_start_xmit = uml_net_start_xmit,
.ndo_set_multicast_list = uml_net_set_multicast_list, .ndo_set_multicast_list = uml_net_set_multicast_list,
.ndo_tx_timeout = uml_net_tx_timeout, .ndo_tx_timeout = uml_net_tx_timeout,
.ndo_set_mac_address = uml_net_set_mac, .ndo_set_mac_address = eth_mac_addr,
.ndo_change_mtu = uml_net_change_mtu, .ndo_change_mtu = uml_net_change_mtu,
.ndo_validate_addr = eth_validate_addr, .ndo_validate_addr = eth_validate_addr,
}; };
...@@ -472,7 +460,8 @@ static void eth_configure(int n, void *init, char *mac, ...@@ -472,7 +460,8 @@ static void eth_configure(int n, void *init, char *mac,
((*transport->user->init)(&lp->user, dev) != 0)) ((*transport->user->init)(&lp->user, dev) != 0))
goto out_unregister; goto out_unregister;
eth_mac_addr(dev, device->mac); /* don't use eth_mac_addr, it will not work here */
memcpy(dev->dev_addr, device->mac, ETH_ALEN);
dev->mtu = transport->user->mtu; dev->mtu = transport->user->mtu;
dev->netdev_ops = &uml_netdev_ops; dev->netdev_ops = &uml_netdev_ops;
dev->ethtool_ops = &uml_net_ethtool_ops; dev->ethtool_ops = &uml_net_ethtool_ops;
......
...@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif) ...@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
clear_bit(STATUS_SCAN_HW, &priv->status); clear_bit(STATUS_SCAN_HW, &priv->status);
clear_bit(STATUS_SCANNING, &priv->status); clear_bit(STATUS_SCANNING, &priv->status);
/* inform mac80211 scan aborted */ /* inform mac80211 scan aborted */
queue_work(priv->workqueue, &priv->scan_completed); queue_work(priv->workqueue, &priv->abort_scan);
} }
int iwlagn_manage_ibss_station(struct iwl_priv *priv, int iwlagn_manage_ibss_station(struct iwl_priv *priv,
......
...@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif) ...@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
clear_bit(STATUS_SCANNING, &priv->status); clear_bit(STATUS_SCANNING, &priv->status);
/* inform mac80211 scan aborted */ /* inform mac80211 scan aborted */
queue_work(priv->workqueue, &priv->scan_completed); queue_work(priv->workqueue, &priv->abort_scan);
} }
static void iwl3945_bg_restart(struct work_struct *data) static void iwl3945_bg_restart(struct work_struct *data)
......
...@@ -24,8 +24,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp, ...@@ -24,8 +24,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
if (vlan_dev) if (vlan_dev)
skb->dev = vlan_dev; skb->dev = vlan_dev;
else if (vlan_id) else if (vlan_id) {
goto drop; if (!(skb->dev->flags & IFF_PROMISC))
goto drop;
skb->pkt_type = PACKET_OTHERHOST;
}
return (polling ? netif_receive_skb(skb) : netif_rx(skb)); return (polling ? netif_receive_skb(skb) : netif_rx(skb));
...@@ -102,8 +105,11 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp, ...@@ -102,8 +105,11 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
if (vlan_dev) if (vlan_dev)
skb->dev = vlan_dev; skb->dev = vlan_dev;
else if (vlan_id) else if (vlan_id) {
goto drop; if (!(skb->dev->flags & IFF_PROMISC))
goto drop;
skb->pkt_type = PACKET_OTHERHOST;
}
for (p = napi->gro_list; p; p = p->next) { for (p = napi->gro_list; p; p = p->next) {
NAPI_GRO_CB(p)->same_flow = NAPI_GRO_CB(p)->same_flow =
......
...@@ -217,6 +217,7 @@ config NET_IPIP ...@@ -217,6 +217,7 @@ config NET_IPIP
config NET_IPGRE config NET_IPGRE
tristate "IP: GRE tunnels over IP" tristate "IP: GRE tunnels over IP"
depends on IPV6 || IPV6=n
help help
Tunneling means encapsulating data of one protocol type within Tunneling means encapsulating data of one protocol type within
another protocol and sending it over a channel that understands the another protocol and sending it over a channel that understands the
......
...@@ -135,13 +135,16 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) ...@@ -135,13 +135,16 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
/* This function calculates a "timeout" which is equivalent to the timeout of a /* This function calculates a "timeout" which is equivalent to the timeout of a
* TCP connection after "boundary" unsuccessful, exponentially backed-off * TCP connection after "boundary" unsuccessful, exponentially backed-off
* retransmissions with an initial RTO of TCP_RTO_MIN. * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
* syn_set flag is set.
*/ */
static bool retransmits_timed_out(struct sock *sk, static bool retransmits_timed_out(struct sock *sk,
unsigned int boundary) unsigned int boundary,
bool syn_set)
{ {
unsigned int timeout, linear_backoff_thresh; unsigned int timeout, linear_backoff_thresh;
unsigned int start_ts; unsigned int start_ts;
unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
if (!inet_csk(sk)->icsk_retransmits) if (!inet_csk(sk)->icsk_retransmits)
return false; return false;
...@@ -151,12 +154,12 @@ static bool retransmits_timed_out(struct sock *sk, ...@@ -151,12 +154,12 @@ static bool retransmits_timed_out(struct sock *sk,
else else
start_ts = tcp_sk(sk)->retrans_stamp; start_ts = tcp_sk(sk)->retrans_stamp;
linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN); linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
if (boundary <= linear_backoff_thresh) if (boundary <= linear_backoff_thresh)
timeout = ((2 << boundary) - 1) * TCP_RTO_MIN; timeout = ((2 << boundary) - 1) * rto_base;
else else
timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN + timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
(boundary - linear_backoff_thresh) * TCP_RTO_MAX; (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
return (tcp_time_stamp - start_ts) >= timeout; return (tcp_time_stamp - start_ts) >= timeout;
...@@ -167,14 +170,15 @@ static int tcp_write_timeout(struct sock *sk) ...@@ -167,14 +170,15 @@ static int tcp_write_timeout(struct sock *sk)
{ {
struct inet_connection_sock *icsk = inet_csk(sk); struct inet_connection_sock *icsk = inet_csk(sk);
int retry_until; int retry_until;
bool do_reset; bool do_reset, syn_set = 0;
if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) { if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
if (icsk->icsk_retransmits) if (icsk->icsk_retransmits)
dst_negative_advice(sk); dst_negative_advice(sk);
retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries; retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
syn_set = 1;
} else { } else {
if (retransmits_timed_out(sk, sysctl_tcp_retries1)) { if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
/* Black hole detection */ /* Black hole detection */
tcp_mtu_probing(icsk, sk); tcp_mtu_probing(icsk, sk);
...@@ -187,14 +191,14 @@ static int tcp_write_timeout(struct sock *sk) ...@@ -187,14 +191,14 @@ static int tcp_write_timeout(struct sock *sk)
retry_until = tcp_orphan_retries(sk, alive); retry_until = tcp_orphan_retries(sk, alive);
do_reset = alive || do_reset = alive ||
!retransmits_timed_out(sk, retry_until); !retransmits_timed_out(sk, retry_until, 0);
if (tcp_out_of_resources(sk, do_reset)) if (tcp_out_of_resources(sk, do_reset))
return 1; return 1;
} }
} }
if (retransmits_timed_out(sk, retry_until)) { if (retransmits_timed_out(sk, retry_until, syn_set)) {
/* Has it gone just too far? */ /* Has it gone just too far? */
tcp_write_err(sk); tcp_write_err(sk);
return 1; return 1;
...@@ -436,7 +440,7 @@ void tcp_retransmit_timer(struct sock *sk) ...@@ -436,7 +440,7 @@ void tcp_retransmit_timer(struct sock *sk)
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX); icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
} }
inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX); inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1)) if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
__sk_dst_reset(sk); __sk_dst_reset(sk);
out:; out:;
......
...@@ -2199,9 +2199,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, ...@@ -2199,9 +2199,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
struct net_device *prev_dev = NULL; struct net_device *prev_dev = NULL;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
if (status->flag & RX_FLAG_INTERNAL_CMTR)
goto out_free_skb;
if (skb_headroom(skb) < sizeof(*rthdr) && if (skb_headroom(skb) < sizeof(*rthdr) &&
pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
goto out_free_skb; goto out_free_skb;
...@@ -2260,7 +2257,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, ...@@ -2260,7 +2257,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
} else } else
goto out_free_skb; goto out_free_skb;
status->flag |= RX_FLAG_INTERNAL_CMTR;
return; return;
out_free_skb: out_free_skb:
......
...@@ -225,12 +225,13 @@ static void pipe_grant_credits(struct sock *sk) ...@@ -225,12 +225,13 @@ static void pipe_grant_credits(struct sock *sk)
static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
{ {
struct pep_sock *pn = pep_sk(sk); struct pep_sock *pn = pep_sk(sk);
struct pnpipehdr *hdr = pnp_hdr(skb); struct pnpipehdr *hdr;
int wake = 0; int wake = 0;
if (!pskb_may_pull(skb, sizeof(*hdr) + 4)) if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
return -EINVAL; return -EINVAL;
hdr = pnp_hdr(skb);
if (hdr->data[0] != PN_PEP_TYPE_COMMON) { if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n", LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
(unsigned)hdr->data[0]); (unsigned)hdr->data[0]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment