1. 19 Apr, 2013 4 commits
    • Dan Carpenter's avatar
      irda: small read past the end of array in debug code · e15465e1
      Dan Carpenter authored
      The "reason" can come from skb->data[] and it hasn't been capped so it
      can be from 0-255 instead of just 0-6.  For example in irlmp_state_dtr()
      the code does:
      
      	reason = skb->data[3];
      	...
      	irlmp_disconnect_indication(self, reason, skb);
      
      Also LMREASON has a couple other values which don't have entries in the
      irlmp_reasons[] array.  And 0xff is a valid reason as well which means
      "unknown".
      
      So far as I can see we don't actually care about "reason" except for in
      the debug code.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e15465e1
    • David S. Miller's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · fd7fc253
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      If time allows, please consider pulling the following patchset contains two
      late Netfilter fixes, they are:
      
      * Skip broadcast/multicast locally generated traffic in the rpfilter,
        (closes netfilter bugzilla #814), from Florian Westphal.
      
      * Fix missing elements in the listing of ipset bitmap ip,mac set
        type with timeout support enabled, from Jozsef Kadlecsik.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fd7fc253
    • David S. Miller's avatar
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless · 6a4cd3fd
      David S. Miller authored
      John W. Linville says:
      
      ====================
      A few stragglers hoping for 3.9, somewhat delayed due to my travels...
      
      On the mac80211 bits, Johannes says:
      
      "Sadly, I have another pull request -- the idle handling fix broke LED
      handling in some cases."
      
      and:
      
      "Yet one more!
      
      This fixes a fairly important/annoying bug -- when roaming between
      multiple APs of the same network, the system could get stuck thinking it
      was connected to the old one while it really wasn't."
      
      On top of that...
      
      Arend sends a brcmfmac patch that removes advertising a feature that
      isn't actually fully supported, and a brcmsmac patch that rearranges
      code to request firmware at IFF_UP to play more nicely with being
      built into the kernel.
      
      Felix gives us a minor ath9k_htc fix to support the newly released
      open source firmware, and an ath9k_hw initvals fix to improve device
      stability.
      
      Rafał Miłecki provides a fix for an ssb regression that caused a
      serious performance problem with b43.
      
      Zefir Kurtisi offers an ath9k fix to change some kmalloc flags to
      allow the DFS detector to be called in softirq context.
      
      Please let me know if there are problems.  If these don't make 3.9,
      I'll just pull them into wireless-next -- just let me know if you
      want to do it that way!
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6a4cd3fd
    • Eric Dumazet's avatar
      tcp: call tcp_replace_ts_recent() from tcp_ack() · 12fb3dd9
      Eric Dumazet authored
      commit bd090dfc (tcp: tcp_replace_ts_recent() should not be called
      from tcp_validate_incoming()) introduced a TS ecr bug in slow path
      processing.
      
      1 A > B P. 1:10001(10000) ack 1 <nop,nop,TS val 1001 ecr 200>
      2 B < A . 1:1(0) ack 1 win 257 <sack 9001:10001,TS val 300 ecr 1001>
      3 A > B . 1:1001(1000) ack 1 win 227 <nop,nop,TS val 1002 ecr 200>
      4 A > B . 1001:2001(1000) ack 1 win 227 <nop,nop,TS val 1002 ecr 200>
      
      (ecr 200 should be ecr 300 in packets 3 & 4)
      
      Problem is tcp_ack() can trigger send of new packets (retransmits),
      reflecting the prior TSval, instead of the TSval contained in the
      currently processed incoming packet.
      
      Fix this by calling tcp_replace_ts_recent() from tcp_ack() after the
      checks, but before the actions.
      Reported-by: default avatarYuchung Cheng <ycheng@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Neal Cardwell <ncardwell@google.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12fb3dd9
  2. 18 Apr, 2013 14 commits
  3. 17 Apr, 2013 13 commits
  4. 16 Apr, 2013 6 commits
  5. 15 Apr, 2013 3 commits