1. 12 Mar, 2011 1 commit
  2. 09 Mar, 2011 1 commit
    • Vasiliy Kulikov's avatar
      net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules · 8909c9ad
      Vasiliy Kulikov authored
      Since a8f80e8f any process with
      CAP_NET_ADMIN may load any module from /lib/modules/.  This doesn't mean
      that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are
      limited to /lib/modules/**.  However, CAP_NET_ADMIN capability shouldn't
      allow anybody load any module not related to networking.
      This patch restricts an ability of autoloading modules to netdev modules
      with explicit aliases.  This fixes CVE-2011-1019.
      Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior
      of loading netdev modules by name (without any prefix) for processes
      with CAP_SYS_MODULE to maintain the compatibility with network scripts
      that use autoloading netdev modules by aliases like "eth0", "wlan0".
      Currently there are only three users of the feature in the upstream
      kernel: ipip, ip_gre and sit.
          root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) --
          root@albatros:~# grep Cap /proc/$$/status
          CapInh:	0000000000000000
          CapPrm:	fffffff800001000
          CapEff:	fffffff800001000
          CapBnd:	fffffff800001000
          root@albatros:~# modprobe xfs
          FATAL: Error inserting xfs
          (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted
          root@albatros:~# lsmod | grep xfs
          root@albatros:~# ifconfig xfs
          xfs: error fetching interface information: Device not found
          root@albatros:~# lsmod | grep xfs
          root@albatros:~# lsmod | grep sit
          root@albatros:~# ifconfig sit
          sit: error fetching interface information: Device not found
          root@albatros:~# lsmod | grep sit
          root@albatros:~# ifconfig sit0
          sit0      Link encap:IPv6-in-IPv4
      	      NOARP  MTU:1480  Metric:1
          root@albatros:~# lsmod | grep sit
          sit                    10457  0
          tunnel4                 2957  1 sit
      For CAP_SYS_MODULE module loading is still relaxed:
          root@albatros:~# grep Cap /proc/$$/status
          CapInh:	0000000000000000
          CapPrm:	ffffffffffffffff
          CapEff:	ffffffffffffffff
          CapBnd:	ffffffffffffffff
          root@albatros:~# ifconfig xfs
          xfs: error fetching interface information: Device not found
          root@albatros:~# lsmod | grep xfs
          xfs                   745319  0
      Reference: https://lkml.org/lkml/2011/2/24/203
      Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
      Signed-off-by: default avatarMichael Tokarev <mjt@tls.msk.ru>
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Acked-by: default avatarKees Cook <kees.cook@canonical.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
  3. 02 Mar, 2011 1 commit
  4. 01 Dec, 2010 1 commit
  5. 17 Nov, 2010 1 commit
  6. 27 Oct, 2010 1 commit
  7. 05 Oct, 2010 1 commit
    • Eric Dumazet's avatar
      net: add a core netdev->rx_dropped counter · caf586e5
      Eric Dumazet authored
      In various situations, a device provides a packet to our stack and we
      drop it before it enters protocol stack :
      - softnet backlog full (accounted in /proc/net/softnet_stat)
      - bad vlan tag (not accounted)
      - unknown/unregistered protocol (not accounted)
      We can handle a per-device counter of such dropped frames at core level,
      and automatically adds it to the device provided stats (rx_dropped), so
      that standard tools can be used (ifconfig, ip link, cat /proc/net/dev)
      This is a generalization of commit 8990f468
       (net: rx_dropped
      accounting), thus reverting it.
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  8. 29 Sep, 2010 2 commits
    • Eric Dumazet's avatar
      ipip: enable lockless xmits · 153f0943
      Eric Dumazet authored
      IPIP tunnels can benefit from lockless xmits, using NETIF_F_LLTX
      Bench on a 16 cpus machine (dual E5540 cpus), 16 threads sending
      10000000 UDP frames via one ipip tunnel (size:200 bytes per frame)
      Before patch :
      real	2m53.321s
      user	0m10.277s
      sys	46m0.597s
      After patch:
      real	0m32.063s
      user	0m9.237s
      sys	8m16.255s
      Last problem to solve is the contention on dst :
      16118.00 28.3% __ip_route_output_key         vmlinux
       6135.00 10.8% dst_release                   vmlinux
       3220.00  5.6% ip_finish_output              vmlinux
       2149.00  3.8% ip_route_output_flow          vmlinux
       1575.00  2.8% ip_append_data                vmlinux
       1481.00  2.6% ip_push_pending_frames        vmlinux
       1349.00  2.4% __xfrm_lookup                 vmlinux
       1216.00  2.1% csum_partial_copy_generic     vmlinux
       1208.00  2.1% udp_sendmsg                   vmlinux
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Eric Dumazet's avatar
      ipip: fix percpu stats accounting · fada5636
      Eric Dumazet authored
      commit 3c97af99
       (ipip: percpu stats accounting) forgot the fallback
      tunnel case (tunl0), and can crash pretty fast.
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  9. 28 Sep, 2010 1 commit
  10. 20 Sep, 2010 1 commit
  11. 16 Sep, 2010 1 commit
  12. 30 Aug, 2010 1 commit
  13. 11 Jun, 2010 1 commit
  14. 18 May, 2010 1 commit
  15. 30 Mar, 2010 1 commit
    • Tejun Heo's avatar
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking... · 5a0e3ad6
      Tejun Heo authored
      include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
      percpu.h is included by sched.h and module.h and thus ends up being
      included when building most .c files.  percpu.h includes slab.h which
      in turn includes gfp.h making everything defined by the two files
      universally available and complicating inclusion dependencies.
      percpu.h -> slab.h dependency is about to be removed.  Prepare for
      this change by updating users of gfp and slab facilities include those
      headers directly instead of assuming availability.  As this conversion
      needs to touch large number of source files, the following script is
      used as the basis of conversion.
      The script does the followings.
      * Scan files for gfp and slab usages and update includes such that
        only the necessary includes are there.  ie. if only gfp is used,
        gfp.h, if slab is used, slab.h.
      * When the script inserts a new include, it looks at the include
  16. 16 Feb, 2010 1 commit
  17. 18 Jan, 2010 1 commit
  18. 02 Dec, 2009 1 commit
  19. 18 Nov, 2009 1 commit
  20. 07 Nov, 2009 1 commit
    • Herbert Xu's avatar
      ipip: Fix handling of DF packets when pmtudisc is OFF · 23ca0c98
      Herbert Xu authored
      RFC 2003 requires the outer header to have DF set if DF is set
      on the inner header, even when PMTU discovery is off for the
      tunnel.  Our implementation does exactly that.
      For this to work properly the IPIP gateway also needs to engate
      in PMTU when the inner DF bit is set.  As otherwise the original
      host would not be able to carry out its PMTU successfully since
      part of the path is only visible to the gateway.
      Unfortunately when the tunnel PMTU discovery setting is off, we
      do not collect the necessary soft state, resulting in blackholes
      when the original host tries to perform PMTU discovery.
      This problem is not reproducible on the IPIP gateway itself as
      the inner packet usually has skb->local_df set.  This is not
      correctly cleared (an unrelated bug) when the packet passes
      through the tunnel, which allows fragmentation to occur.  For
      hosts behind the IPIP gateway it is readily visible with a simple
      This patch fixes the problem by performing PMTU discovery for
      all packets with the inner DF bit set, regardless of the PMTU
      discovery setting on the tunnel itself.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  21. 28 Oct, 2009 1 commit
  22. 24 Oct, 2009 1 commit
  23. 05 Oct, 2009 1 commit
    • Eric Dumazet's avatar
      tunnels: Optimize tx path · 0bfbedb1
      Eric Dumazet authored
      We currently dirty a cache line to update tunnel device stats
      (tx_packets/tx_bytes). We better use the txq->tx_bytes/tx_packets
      counters that already are present in cpu cache, in the cache
      line shared with txq->_xmit_lock
      This patch extends IPTUNNEL_XMIT() macro to use txq pointer
      provided by the caller.
      Also &tunnel->dev->stats can be replaced by &dev->stats
      Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  24. 24 Sep, 2009 1 commit
  25. 01 Sep, 2009 1 commit
  26. 06 Jul, 2009 1 commit
  27. 03 Jun, 2009 2 commits
  28. 29 May, 2009 1 commit
  29. 25 Feb, 2009 1 commit
  30. 23 Feb, 2009 1 commit
  31. 24 Nov, 2008 1 commit
    • Alexey Dobriyan's avatar
      net: fix tunnels in netns after ndo_ changes · be77e593
      Alexey Dobriyan authored
      dev_net_set() should be the very first thing after alloc_netdev().
      "ndo_" changes turned simple assignment (which is OK to do before netns
      assignment) into quite non-trivial operation (which is not OK, init_net was
      used). This leads to incomplete initialisation of tunnel device in netns.
      BUG: unable to handle kernel NULL pointer dereference at 00000004
      IP: [<c02efdb5>] ip6_tnl_exit_net+0x37/0x4f
      *pde = 00000000 
      Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC
      last sysfs file: /sys/class/net/lo/operstate
      Pid: 10, comm: netns Not tainted (2.6.28-rc6 #1) 
      EIP: 0060:[<c02efdb5>] EFLAGS: 00010246 CPU: 0
      EIP is at ip6_tnl_exit_net+0x37/0x4f
      EAX: 00000000 EBX: 00000020 ECX: 00000000 EDX: 00000003
      ESI: c5caef30 EDI: c782bbe8 EBP: c7909f50 ESP: c7909f48
       DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
      Process netns (pid: 10, ti=c7908000 task=c7905780 task.ti=c7908000)
       c03e75e0 c7390bc8 c7909f60 c0245448 c7390bd8 c7390bf0 c7909fa8 c012577a
       00000000 00000002 00000000 c0125736 c782bbe8 c7909f90 c0308fe3 c782bc04
       c7390bd4 c0245406 c084b718 c04f0770 c03ad785 c782bbe8 c782bc04 c782bc0c
      Call Trace:
       [<c0245448>] ? cleanup_net+0x42/0x82
       [<c012577a>] ? run_workqueue+0xd6/0x1ae
       [<c0125736>] ? run_workqueue+0x92/0x1ae
       [<c0308fe3>] ? schedule+0x275/0x285
       [<c0245406>] ? cleanup_net+0x0/0x82
       [<c0125ae1>] ? worker_thread+0x81/0x8d
       [<c0128344>] ? autoremove_wake_function+0x0/0x33
       [<c0125a60>] ? worker_thread+0x0/0x8d
       [<c012815c>] ? kthread+0x39/0x5e
       [<c0128123>] ? kthread+0x0/0x5e
       [<c0103b9f>] ? kernel_thread_helper+0x7/0x10
      Code: db e8 05 ff ff ff 89 c6 e8 dc 04 f6 ff eb 08 8b 40 04 e8 38 89 f5 ff 8b 44 9e 04 85 c0 75 f0 43 83 fb 20 75 f2 8b 86 84 00 00 00 <8b> 40 04 e8 1c 89 f5 ff e8 98 04 f6 ff 89 f0 e8 f8 63 e6 ff 5b 
      EIP: [<c02efdb5>] ip6_tnl_exit_net+0x37/0x4f SS:ESP 0068:c7909f48
      ---[ end trace 6c2f2328fccd3e0c ]---
      Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  32. 21 Nov, 2008 1 commit
  33. 03 Nov, 2008 1 commit
  34. 14 Oct, 2008 1 commit
  35. 12 Jun, 2008 1 commit
  36. 22 May, 2008 1 commit
  37. 21 May, 2008 1 commit
  38. 16 Apr, 2008 1 commit