Skip to content

L
linux
Switch branch/tag
  1. 08 Jun, 2007 33 commits
  3. 07 Jun, 2007 7 commits
    • David S. Miller's avatar
      [SPARC64]: Fix SBUS IRQ regression caused by PCI-E driver. · ec4d18f2
      David S. Miller authored 
      We used to access the 64-bit IRQ IMAP and ICLR registers of bus
controllers 4-bytes in and as a 32-bit register word, since only the
low 32-bits were relevant.  This seemed like a good idea at the time.

But the PCI-E controller requires full 8-byte 64-bit access to
these registers, so we switched over to accessing them fully.

SBUS was not adjusted properly, which broke interrupts completely.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ec4d18f2
    • David S. Miller's avatar
      [SPARC64]: Fix 2 bugs in PCI Sabre bus scanning. · 321566c2
      David S. Miller authored 
      If we are on hummingbird, bus runs at 66MHZ.

pbm->pci_bus should be setup with the result of pci_scan_one_pbm()
or else we deref NULL pointers in the error interrupt handlers.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      321566c2
    • Joy Latten's avatar
      xfrm: Add security check before flushing SAD/SPD · 4aa2e62c
      Joy Latten authored 
      Currently we check for permission before deleting entries from SAD and
SPD, (see security_xfrm_policy_delete() security_xfrm_state_delete())
However we are not checking for authorization when flushing the SPD and
the SAD completely. It was perhaps missed in the original security hooks
patch.

This patch adds a security check when flushing entries from the SAD and
SPD.  It runs the entire database and checks each entry for a denial.
If the process attempting the flush is unable to remove all of the
entries a denial is logged the the flush function returns an error
without removing anything.

This is particularly useful when a process may need to create or delete
its own xfrm entries used for things like labeled networking but that
same process should not be able to delete other entries or flush the
entire database.

Signed-off-by: Joy Latten<latten@austin.ibm.com>
Signed-off-by: default avatarEric Paris <eparis@parisplace.org>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      4aa2e62c
    • Patrick McHardy's avatar
      [NET_SCHED]: Fix filter double free · b00b4bf9
      Patrick McHardy authored 
      cbq and atm destroy their filters twice when destroying inner classes
during qdisc destruction.
Reported-and-tested-by: default avatarStrobl Anton <a.strobl@aws-it.at>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b00b4bf9
    • Thomas Graf's avatar
      [NET]: Avoid duplicate netlink notification when changing link state · 7c355f53
      Thomas Graf authored 
      When changing the link state from userspace not affecting any other
flags. Two duplicate notification are being sent, once as action
in the NETDEV_UP/NETDEV_DOWN notification chain and a second time
when comparing old and new device flags after the change has been
completed. Although harmless, the duplicates should be avoided.
Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7c355f53
    • David S. Miller's avatar
      [UDP]: Revert 2-pass hashing changes. · df2bc459
      David S. Miller authored 
      This reverts changesets:

6aaf47fa
b7b5f487
de34ed91
fc038410

There are still some correctness issues recently
discovered which do not have a known fix that doesn't
involve doing a full hash table scan on port bind.

So revert for now.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      df2bc459
    • Miklos Szeredi's avatar
      [AF_UNIX]: Fix stream recvmsg() race. · 3c0d2f37
      Miklos Szeredi authored 
      A recv() on an AF_UNIX, SOCK_STREAM socket can race with a
send()+close() on the peer, causing recv() to return zero, even though
the sent data should be received.

This happens if the send() and the close() is performed between
skb_dequeue() and checking sk->sk_shutdown in unix_stream_recvmsg():

process A  skb_dequeue() returns NULL, there's no data in the socket queue
process B  new data is inserted onto the queue by unix_stream_sendmsg()
process B  sk->sk_shutdown is set to SHUTDOWN_MASK by unix_release_sock()
process A  sk->sk_shutdown is checked, unix_release_sock() returns zero

I'm surprised nobody noticed this, it's not hard to trigger.  Maybe
it's just (un)luck with the timing.

It's possible to work around this bug in userspace, by retrying the
recv() once in case of a zero return value.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3c0d2f37
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7