1. 20 Feb, 2013 4 commits
    • YOSHIFUJI Hideaki / 吉藤英明's avatar
      ipv6: fix race condition regarding dst->expires and dst->from. · ecd98837
      YOSHIFUJI Hideaki / 吉藤英明 authored
      Eric Dumazet wrote:
      | Some strange crashes happen in rt6_check_expired(), with access
      | to random addresses.
      |
      | At first glance, it looks like the RTF_EXPIRES and
      | stuff added in commit 1716a961
      | (ipv6: fix problem with expired dst cache)
      | are racy : same dst could be manipulated at the same time
      | on different cpus.
      |
      | At some point, our stack believes rt->dst.from contains a dst pointer,
      | while its really a jiffie value (as rt->dst.expires shares the same area
      | of memory)
      |
      | rt6_update_expires() should be fixed, or am I missing something ?
      |
      | CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060
      
      Because we do not have any locks for dst_entry, we cannot change
      essential structure in the entry; e.g., we cannot change reference
      to other entity.
      
      To fix this issue, split 'from' and 'expires' field in dst_entry
      out of union.  Once it is 'from' is assigned in the constructor,
      keep the reference until the very last stage of the life time of
      the object.
      
      Of course, it is unsafe to change 'from', so make rt6_set_from simple
      just for fresh entries.
      Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Reported-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      CC: Gao Feng <gaofeng@cn.fujitsu.com>
      Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarSteinar H. Gunderson <sesse@google.com>
      Reviewed-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ecd98837
    • Amerigo Wang's avatar
      net: fix a wrong assignment in skb_split() · 68534c68
      Amerigo Wang authored
      commit c9af6db4 (net: Fix possible wrong checksum generation)
      has a suspicous piece:
      
      	-       skb_shinfo(skb1)->gso_type = skb_shinfo(skb)->gso_type;
      	-
      	+       skb_shinfo(skb)->tx_flags = skb_shinfo(skb1)->tx_flags & SKBTX_SHARED_FRAG;
      
      skb1 is the new skb, therefore should be on the left side of the assignment.
      This patch fixes it.
      
      Cc: Pravin B Shelar <pshelar@nicira.com>
      Cc: David S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarCong Wang <amwang@redhat.com>
      Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      68534c68
    • David S. Miller's avatar
      Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next · c6b53807
      David S. Miller authored
      John W. Linville says:
      
      ====================
      One last batch of stragglers intended for 3.9...
      
      For the iwlwifi pull, Johannes says:
      
      "I hadn't expected to ask you to pull iwlwifi-next again, but I have a
      number of fixes most of which I'd also send in after rc1, so here it is.
      
      The first commit is a merge error between mac80211-next and
      iwlwifi-next; in addition I have fixes for P2P scanning and MVM driver
      MAC (virtual interface) management from Ilan, a CT-kill (critical
      temperature) fix from Eytan, and myself fixed three different little but
      annoying bugs in the MVM driver.
      
      The only ones I might not send for -rc1 are Emmanuel's debug patch, but
      OTOH it should help greatly if there are any issues, and my own time
      event debugging patch that I used to find the race condition but we
      decided to keep it for the future."
      
      For the mac80211 pull, Johannes says:
      
      "Like iwlwifi-next, this would almost be suitable for rc1.
      
      I have a fix for station management on non-TDLS drivers, a CAB queue
      crash fix for mesh, a fix for an annoying (but harmless) warning, a
      tracing fix and a documentation fix. Other than that, only a few mesh
      cleanups."
      
      Along with that is a fix for memory corruption in rtlwifi, an
      orinoco_usb fix to avoid allocating a DMA buffer on the stack, an a
      hostap fix to return -ENOMEM instead of -1 after a memory allocation
      failure.  The remaining bits implement 802.11ac support for the mwifiex
      driver -- I think that is still worth getting into 3.9.
      
      Please let me know if there are problems!
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6b53807
    • Eric Dumazet's avatar
      ip_gre: remove an extra dst_release() · 4aa896c4
      Eric Dumazet authored
      commit 68c33163 (v4 GRE: Add TCP segmentation offload for GRE)
      introduced a bug in error path.
      
      dst is attached to skb, so will be released when skb is freed.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Pravin B Shelar <pshelar@nicira.com>
      Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4aa896c4
  2. 19 Feb, 2013 28 commits
  3. 18 Feb, 2013 8 commits