- 04 Jun, 2008 21 commits
-
-
-
Ilpo Järvinen authored
This bug is able to corrupt fackets_out in very rare cases. In order for this to cause corruption: 1) DSACK in the middle of previous SACK block must be generated. 2) In order to take that particular branch, part or all of the DSACKed segment must already be SACKed so that we have that in cache in the first place. 3) The new info must be top enough so that fackets_out will be updated on this iteration. ...then fack_count is updated while skb wasn't, then we walk again that particular segment thus updating fack_count twice for a single skb and finally that value is assigned to fackets_out by tcp_sacktag_one. It is safe to call tcp_sacktag_one just once for a segment (at DSACK), no need to call again for plain SACK. Potential problem of the miscount are limited to premature entry to recovery and to inflated reordering metric (which could even cancel each other out in the most the luckiest scenarios :-)). Both are quite insignificant in worst case too and there exists also code to reset them (fackets_out once sacked_out becomes zero and reordering metric on RTO). This has been reported by a number of people, because it occurred quite rarely, it has been very evasive. Andy Furniss was able to get it to occur couple of times so that a bit more info was collected about the problem using a debug patch, though it still required lot of checking around. Thanks also to others who have tried to help here. This is listed as Bugzilla #10346. The bug was introduced by me in commit 68f8353b ([TCP]: Rewrite SACK block processing & sack_recv_cache use), I probably thought back then that there's need to scan that entry twice or didn't dare to make it go through it just once there. Going through twice would have required restoring fack_count after the walk but as noted above, I chose to drop the additional walk step altogether here. Signed-off-by:Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Mark Asselstine authored
Make use of local_irq_save and local_irq_restore rather then the deprecated save_and_cli and restore_flags calls. Signed-off-by:
Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by:
-
Adrian-Ken Rueegsegger authored
This patch fixes the usage of RIPEMD-160 in xfrm_algo which in turn allows hmac(rmd160) to be used as authentication mechanism in IPsec ESP and AH (see RFC 2857). Signed-off-by:
Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Acked-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Denis V. Lunev authored
Signed-off-by:
Denis V. Lunev <den@openvz.org> Signed-off-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
-
Denis V. Lunev authored
IPv6 UDP sockets wth IPv4 mapped address use udp_sendmsg to send the data actually. In this case ip_flush_pending_frames should be called instead of ip6_flush_pending_frames. Signed-off-by:
-
Denis V. Lunev authored
It is not allowed to change underlying protocol for int fd = socket(PF_INET6, SOCK_RAW, IPPROTO_UDP); Signed-off-by:
-
YOSHIFUJI Hideaki authored
Signed-off-by: -
YOSHIFUJI Hideaki authored
The outgoing interface index (ipi6_ifindex) in IPV6_PKTINFO ancillary data, is not checked if the source address (ipi6_addr) is unspecified. If the ipi6_ifindex is the not-exist interface, it should be fail. Based on patch from Shan Wei <shanwei@cn.fujitsu.com> and Brian Haley <brian.haley@hp.com>. Signed-off-by:
Shan Wei <shanwei@cn.fujitsu.com> Signed-off-by:
Brian Haley <brian.haley@hp.com> Signed-off-by:
-
Yang Hongyang authored
If get destination options with length which is not enough for that option,getsockopt() will still return the real length of the option, which is larger then the buffer space. This is because ipv6_getsockopt_sticky() returns the real length of the option. This patch fix this problem. Signed-off-by:
Yang Hongyang <yanghy@cn.fujitsu.com> Signed-off-by:
-
Yang Hongyang authored
If we pass NULL data buffer to getsockopt(), it will return 0, and the option length is set to -EFAULT: getsockopt(sk, IPPROTO_IPV6, IPV6_DSTOPTS, NULL, &len); This is because ipv6_getsockopt_sticky() will return -EFAULT or -EINVAL if some error occur. This patch fix this problem. Signed-off-by: -
YOSHIFUJI Hideaki authored
- Allow longer lifetimes (>= 0x7fffffff/HZ) on 64bit archs by using unsigned long. - Shadow this arithmetic overflow workaround by introducing helper functions: addrconf_timeout_fixup() and addrconf_finite_timeout(). Signed-off-by: -
YOSHIFUJI Hideaki authored
Signed-off-by: -
Colin authored
I discover a strange behavior in [ipv4 in ipv6] tunnel. When IPv6 tunnel payload is less than 40(0x28), packet can be sent to network, received in physical interface, but not seen in IP tunnel interface. No counter increase in tunnel interface. Signed-off-by: -
Thomas Graf authored
As of now, the prefix length is not vaildated when adding or deleting addresses. The value is passed directly into the inet6_ifaddr structure and later passed on to memcmp() as length indicator which relies on the value never to exceed 128 (bits). Due to the missing check, the currently code allows for any 8 bit value to be passed on as prefix length while using the netlink interface, and any 32 bit value while using the ioctl interface. [Use unsigned int instead to generate better code - yoshfuji] Signed-off-by:
Thomas Graf <tgraf@suug.ch> Signed-off-by:
-
YOSHIFUJI Hideaki authored
ip6_sk_dst_lookup returns held dst entry. It should be released on all paths beyond this point. Add missed release when up->pending is set. Bug report and initial patch by Denis V. Lunev <den@openvz.org>. Signed-off-by:
-
YOSHIFUJI Hideaki authored
Commit 7cbca67c ("[IPV6]: Support Source Address Selection API (RFC5014)") introduced NULL dereference of asoc to sctp_v6_get_saddr in net/sctp/ipv6.c. Pointed out by Johann Felix Soden <johfel@users.sourceforge.net>. Signed-off-by:
-
David S. Miller authored
-
Ilpo Järvinen authored
It is possible that this skip path causes TCP to end up into an invalid state where ca_state was left to CA_Open while some segments already came into sacked_out. If next valid ACK doesn't contain new SACK information TCP fails to enter into tcp_fastretrans_alert(). Thus at least high_seq is set incorrectly to a too high seqno because some new data segments could be sent in between (and also, limited transmit is not being correctly invoked there). Reordering in both directions can easily cause this situation to occur. I guess we would want to use tcp_moderate_cwnd(tp) there as well as it may be possible to use this to trigger oversized burst to network by sending an old ACK with huge amount of SACK info, but I'm a bit unsure about its effects (mainly to FlightSize), so to be on the safe side I just currently fixed it minimally to keep TCP's state consistent (obviously, such nasty ACKs have been possible this far). Though it seems that FlightSize is already underestimated by some amount, so probably on the long term we might want to trigger recovery there too, if appropriate, to make FlightSize calculation to resemble reality at the time when the losses where discovered (but such change scares me too much now and requires some more thinking anyway how to do that as it likely involves some code shuffling). This bug was found by Brian Vowell while running my TCP debug patch to find cause of another TCP issue (fackets_out miscount). Signed-off-by:
-
Jarek Poplawski authored
[ 63.531438] ================================= [ 63.531520] [ INFO: inconsistent lock state ] [ 63.531520] 2.6.26-rc4 #7 [ 63.531520] --------------------------------- [ 63.531520] inconsistent {softirq-on-W} -> {in-softirq-W} usage. [ 63.531520] tcpsic6/3864 [HC0[0]:SC1[1]:HE1:SE0] takes: [ 63.531520] (&q->lock#2){-+..}, at: [<c07175b0>] ipv6_frag_rcv+0xd0/0xbd0 [ 63.531520] {softirq-on-W} state was registered at: [ 63.531520] [<c0143bba>] __lock_acquire+0x3aa/0x1080 [ 63.531520] [<c0144906>] lock_acquire+0x76/0xa0 [ 63.531520] [<c07a8f0b>] _spin_lock+0x2b/0x40 [ 63.531520] [<c0727636>] nf_ct_frag6_gather+0x3f6/0x910 ... According to this and another similar lockdep report inet_fragment locks are taken from nf_ct_frag6_gather() with softirqs enabled, but these locks are mainly used in softirq context, so disabling BHs is necessary. Reported-and-tested-by:Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by:
Jarek Poplawski <jarkao2@gmail.com> Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Dong Wei authored
In xt_connlimit match module, the counter of an IP is decreased when the TCP packet is go through the chain with ip_conntrack state TW. Well, it's very natural that the server and client close the socket with FIN packet. But when the client/server close the socket with RST packet(using so_linger), the counter for this connection still exsit. The following patch can fix it which is based on linux-2.6.25.4 Signed-off-by:
Dong Wei <dwei.zh@gmail.com> Acked-by:
Jan Engelhardt <jengelh@medozas.de> Signed-off-by:
-
- 03 Jun, 2008 10 commits
-
-
Thomas Graf authored
The field was supposed to allow the creation of an anycast route by assigning an anycast address to an address prefix. It was never implemented so this field is unused and serves no purpose. Remove it. Signed-off-by:
-
Thomas Graf authored
Make nlmsg_trim(), nlmsg_cancel(), genlmsg_cancel(), and nla_nest_cancel() void functions. Return -EMSGSIZE instead of -1 if the provided message buffer is not big enough. Signed-off-by:
-
Thomas Graf authored
Also removes an unused policy entry for an attribute which is only used in kernel->user direction. Signed-off-by:
-
Thomas Graf authored
Also removes an obsolete check for the unused flag RTCF_MASQ. Signed-off-by:
-
Brice Goglin authored
No need to compute copy twice in the frags loop in dma_skb_copy_datagram_iovec(). Signed-off-by:
Brice Goglin <Brice.Goglin@inria.fr> Acked-by:
Shannon Nelson <shannon.nelson@intel.com> Signed-off-by:
Maciej Sosnowski <maciej.sosnowski@intel.com> Signed-off-by:
Dan Williams <dan.j.williams@intel.com> Signed-off-by:
-
Stephen Hemminger authored
The neighbor table time of last use information is returned in the incorrect unit. Kernel to user space ABI's need to use USER_HZ (or milliseconds), otherwise the application has to try and discover the real system HZ value which is problematic. Linux has standardized on keeping USER_HZ consistent (100hz) even when kernel is running internally at some other value. This change is small, but it breaks the ABI for older version of iproute2 utilities. But these utilities are already broken since they are looking at the psched_hz values which are completely different. So let's just go ahead and fix both kernel and user space. Older utilities will just print wrong values. Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
-
Adrian Bunk authored
This patch updates the URL of the bridge homepage. Signed-off-by:
Adrian Bunk <bunk@kernel.org> Signed-off-by:
-
Pavel Emelyanov authored
Bad type/protocol specified result in sk leak. Fix is simple - release the sk if bad values are given, but to make it possible just to call sk_free(), I move some sk initialization a bit lower. Signed-off-by:
Pavel Emelyanov <xemul@openvz.org> Signed-off-by:
-
Jarek Poplawski authored
From: Jarek Poplawski <jarkao2@gmail.com> There is only one function in AX25 calling skb_append(), and it really looks suspicious: appends skb after previously enqueued one, but in the meantime this previous skb could be removed from the queue. This patch Fixes it the simple way, so this is not fully compatible with the current method, but testing hasn't shown any problems. Signed-off-by:
Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
-
Dave Young authored
There's logic in __rfcomm_dlc_close: rfcomm_dlc_lock(d); d->state = BT_CLOSED; d->state_changed(d, err); rfcomm_dlc_unlock(d); In rfcomm_dev_state_change, it's possible that rfcomm_dev_put try to take the dlc lock, then we will deadlock. Here fixed it by unlock dlc before rfcomm_dev_get in rfcomm_dev_state_change. why not unlock just before rfcomm_dev_put? it's because there's another problem. rfcomm_dev_get/rfcomm_dev_del will take rfcomm_dev_lock, but in rfcomm_dev_add the lock order is : rfcomm_dev_lock --> dlc lock so I unlock dlc before the taken of rfcomm_dev_lock. Actually it's a regression caused by commit 1905f6c7 ("bluetooth : __rfcomm_dlc_close lock fix"), the dlc state_change could be two callbacks : rfcomm_sk_state_change and rfcomm_dev_state_change. I missed the rfcomm_sk_state_change that time. Thanks Arjan van de Ven <arjan@linux.intel.com> for the effort in commit 4c8411f8 ("bluetooth: fix locking bug in the rfcomm socket cleanup handling") but he missed the rfcomm_dev_state_change lock issue. Signed-off-by:
Dave Young <hidave.darkstar@gmail.com> Acked-by:
Marcel Holtmann <marcel@holtmann.org> Signed-off-by:
-
- 02 Jun, 2008 7 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: [CRYPTO] cts: Init SG tables
-
git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2Linus Torvalds authored
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2: [PATCH 3/3] ocfs2/net: Silence build warnings [PATCH 2/3] ocfs2/dlm: Silence build warnings [PATCH 1/3] ocfs2/net: Silence build warnings ocfs2: Rename 'user_stack' plugin structure to 'ocfs2_user_plugin'
-
Anton Vorontsov authored
Since mmc_spi.h uses irqreturn_t type, it should include appropriate header, otherwise build will break if users didn't include it (some of them do not use interrupts). Signed-off-by:
Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by:
Pierre Ossman <drzeus@drzeus.cx> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixesLinus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes: kbuild: fix $(src) assignmnet with external modules
-
git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/blackfin-2.6Linus Torvalds authored
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/blackfin-2.6: 8250 Serial Driver: revert extra IRQ flag definition patch Blackfin arch: update anomaly headers from toolchain trunk Blackfin arch: Remove bad and usless code Blackfin arch: Fix bug - set corret SSEL and IRQ to enable AD7877 on BF527 Blackfin arch: Fix typo. it should be _outsw_8 Blackfin arch: Cleanup no functional changes
-
git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpcLinus Torvalds authored
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: [POWERPC] Fix DMA nodes in the MPC8610 HPCD device tree [POWERPC] Export empty_zero_page and copy_page in arch/ppc [POWERPC] Add "memory" clobber to MMIO accessors [POWERPC] pasemi: update pasemi_defconfig, enable electra_cf electra_cf: Add MODULE_DEVICE_TABLE()
-
Alexey Dobriyan authored
Steps to reproduce: modprobe tcrypt # with CONFIG_DEBUG_SG=y testing cts(cbc(aes)) encryption test 1 (128 bit key): ------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:65! invalid opcode: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC CPU 0 Modules linked in: tea xts twofish twofish_common tcrypt(+) [maaaany] Pid: 16151, comm: modprobe Not tainted 2.6.26-rc4-fat #7 RIP: 0010:[<ffffffffa0bf032e>] [<ffffffffa0bf032e>] :cts:cts_cbc_encrypt+0x151/0x355 RSP: 0018:ffff81016f497a88 EFLAGS: 00010286 RAX: ffffe20009535d58 RBX: ffff81016f497af0 RCX: 0000000087654321 RDX: ffff8100010d4f28 RSI: ffff81016f497ee8 RDI: ffff81016f497ac0 RBP: ffff81016f497c38 R08: 0000000000000000 R09: 0000000000000011 R10: ffffffff00000008 R11: ffff8100010d4f28 R12: ffff81016f497ac0 R13: ffff81016f497b30 R14: 0000000000000010 R15: 0000000000000010 FS: 00007fac6fa276f0(0000) GS:ffffffff8060e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007f12ca7cc000 CR3: 000000016f441000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400 Process modprobe (pid: 16151, threadinfo ffff81016f496000, task ffff8101755b4ae0) Stack: 0000000000000001 ffff81016f496000 ffffffff80719f78 0000000000000001 0000000000000001 ffffffff8020c87c ffff81016f99c918 20646c756f772049 65687420656b696c 0000000000000020 0000000000000000 0000000033341102 Call Trace: [<ffffffff8020c87c>] ? restore_args+0x0/0x30 [<ffffffffa04aa311>] ? :aes_generic:crypto_aes_expand_key+0x311/0x369 [<ffffffff802ab453>] ? check_object+0x15a/0x213 [<ffffffff802aad22>] ? init_object+0x6e/0x76 [<ffffffff802ac3ae>] ? __slab_free+0xfc/0x371 [<ffffffffa0bf05ed>] :cts:crypto_cts_encrypt+0xbb/0xca [<ffffffffa07108de>] ? :crypto_blkcipher:setkey+0xc7/0xec [<ffffffffa07110b8>] :crypto_blkcipher:async_encrypt+0x38/0x3a [<ffffffffa2ce9341>] :tcrypt:test_cipher+0x261/0x7c6 [<ffffffffa2cfd9df>] :tcrypt:tcrypt_mod_init+0x9df/0x1b30 [<ffffffff80261e35>] sys_init_module+0x9e/0x1b2 [<ffffffff8020c15a>] system_call_after_swapgs+0x8a/0x8f Code: 45 c0 e8 aa 24 63 df 48 c1 e8 0c 48 b9 00 00 00 00 00 e2 ff ff 48 8b 55 88 48 6b c0 68 48 01 c8 b9 21 43 65 87 48 39 4d 80 74 04 <0f> 0b eb fe f6 c2 01 74 04 0f 0b eb fe 83 e2 03 4c 89 ef 44 89 RIP [<ffffffffa0bf032e>] :cts:cts_cbc_encrypt+0x151/0x355 RSP <ffff81016f497a88> ---[ end trace e8bahiarjand37fd ]--- Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
- 31 May, 2008 2 commits
-
-
Sam Ravnborg authored
When we introduced support for KBUILD_EXTRA_SYMBOLS we started to include the externam module's kbuild file when doing the final modpost step. As external modules often do: ccflags-y := -I$(src) We had problems because $(src) was unassinged and gcc then used the next parameter for -I resulting in strange build failures. Fix is to assign $(src) and $(obj) when building external modules. This fixes: http://bugzilla.kernel.org/show_bug.cgi?id=10798Signed-off-by:
Sam Ravnborg <sam@ravnborg.org> Cc: Tvrtko <tvrtko.ursulin@sophos.com> Cc: Andrea Arcangeli <andrea@qumranet.com> Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
-
Bryan Wu authored
As Russell pointed out, original patch will break some serial configurations because of the dependency of the <asm/serial.h> header file. Revert it first and try to find out other solution later Cc: Javier Herrero <jherrero@hvsistemas.es> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Russell King <rmk+lkml@arm.linux.org.uk> Signed-off-by:Bryan Wu <cooloney@kernel.org>
-
