1. 09 Jun, 2009 1 commit
  2. 02 Jun, 2009 3 commits
    • Minoru Usui's avatar
      net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel... · 12186be7
      Minoru Usui authored
      
      net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
      
      This patch fixes a bug which unconfigured struct tcf_proto keeps
      chaining in tc_ctl_tfilter(), and avoids kernel panic in
      cls_cgroup_classify() when we use cls_cgroup.
      
      When we execute 'tc filter add', tcf_proto is allocated, initialized
      by classifier's init(), and chained.  After it's chained,
      tc_ctl_tfilter() calls classifier's change().  When classifier's
      change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.
      
      In addition, cls_cgroup is initialized in change() not in init().  It
      accesses unconfigured struct tcf_proto which is chained before
      change(), then hits Oops.
      Signed-off-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
      Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
      Signed-off-by: default avatarJamal Hadi Salim <hadi@cyberus.ca>
      Tested-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12186be7
    • Neil Horman's avatar
      e1000: add missing length check to e1000 receive routine · ea30e119
      Neil Horman authored
      
      
      	Patch to fix bad length checking in e1000.  E1000 by default does two
      things:
      
      1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
      2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
      doing an skb_put
      
      Since the e1000 driver isn't written to support receiving packets that span
      multiple rx buffers, it checks the End of Packet bit of every frame, and
      discards it if its not set.  This places us in a situation where, if we have a
      spanning packet, the first part is discarded, but the second part is not (since
      it is the end of packet, and it passes the EOP bit test).  If the second part of
      the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
      underflow the length, and wind up in skb_over_panic, when we try to skb_put a
      huge number of bytes into the skb.  This amounts to a remote DOS attack through
      careful selection of frame size in relation to interface MTU.  The fix for this
      is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
      one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
      small frames from causing the underflow described above
      Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Tested-by: default avatarAndy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ea30e119
    • Ed Swierk's avatar
      forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) · 5a9a8e32
      Ed Swierk authored
      Add a phy_power_down parameter to forcedeth: set to 1 to power down the
      phy and disable the link when an interface goes down; set to 0 to always
      leave the phy powered up.
      
      The phy power state persists across reboots; Windows, some BIOSes, and
      older versions of Linux don't bother to power up the phy again, forcing
      users to remove all power to get the interface working (see
      http://bugzilla.kernel.org/show_bug.cgi?id=13072
      
      ).  Leaving the phy
      powered on is the safest default behavior.  Users accustomed to seeing
      the link state reflect the interface state and/or wanting to minimize
      power consumption can set phy_power_down=1 if compatibility with other
      OSes is not an issue.
      Signed-off-by: default avatarEd Swierk <eswierk@aristanetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a9a8e32
  3. 01 Jun, 2009 3 commits
  4. 30 May, 2009 4 commits
  5. 29 May, 2009 5 commits
  6. 27 May, 2009 8 commits
  7. 26 May, 2009 4 commits
  8. 25 May, 2009 3 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_dccp: add missing DCCP protocol changes in event cache · b38b1f61
      Pablo Neira Ayuso authored
      
      
      This patch adds the missing protocol state-change event reporting
      for DCCP.
      
      $ sudo conntrack -E
          [NEW] dccp     33 240 src=192.168.0.2 dst=192.168.1.2 sport=57040 dport=5001 [UNREPLIED] src=192.168.1.2 dst=192.168.1.100 sport=5001 dport=57040
      
      With this patch:
      
      $ sudo conntrack -E
          [NEW] dccp     33 240 REQUEST src=192.168.0.2 dst=192.168.1.2 sport=57040 dport=5001 [UNREPLIED] src=192.168.1.2 dst=192.168.1.100 sport=5001 dport=57040
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      b38b1f61
    • Jozsef Kadlecsik's avatar
      netfilter: nf_ct_tcp: fix accepting invalid RST segments · bfcaa502
      Jozsef Kadlecsik authored
      
      
      Robert L Mathews discovered that some clients send evil TCP RST segments,
      which are accepted by netfilter conntrack but discarded by the
      destination. Thus the conntrack entry is destroyed but the destination
      retransmits data until timeout.
      
      The same technique, i.e. sending properly crafted RST segments, can easily
      be used to bypass connlimit/connbytes based restrictions (the sample
      script written by Robert can be found in the netfilter mailing list
      archives).
      
      The patch below adds a new flag and new field to struct ip_ct_tcp_state so
      that checking RST segments can be made more strict and thus TCP conntrack
      can catch the invalid ones: the RST segment is accepted only if its
      sequence number higher than or equal to the highest ack we seen from the
      other direction. (The last_ack field cannot be reused because it is used
      to catch resent packets.)
      Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      bfcaa502
    • Lennert Buytenhek's avatar
      gianfar: fix BUG under load after introduction of skb recycling · 4e2fd555
      Lennert Buytenhek authored
      Since commit 0fd56bb5
      
       ("gianfar:
      Add support for skb recycling"), gianfar puts skbuffs that are in
      the rx ring back onto the recycle list as-is in case there was a
      receive error, but this breaks the following invariant: that all
      skbuffs on the recycle list have skb->data = skb->head + NET_SKB_PAD.
      
      The RXBUF_ALIGNMENT realignment done in gfar_new_skb() will be done
      twice on skbuffs recycled in this way, causing there not to be enough
      room in the skb anymore to receive a full packet, eventually leading
      to an skb_over_panic from gfar_clean_rx_ring() -> skb_put().
      
      Resetting the skb->data pointer to skb->head + NET_SKB_PAD before
      putting the skb back onto the recycle list restores the mentioned
      invariant, and should fix this issue.
      Reported-by: default avatarMichael Guntsche <mike@it-loops.com>
      Tested-by: default avatarMichael Guntsche <mike@it-loops.com>
      Signed-off-by: default avatarLennert Buytenhek <buytenh@wantstofly.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e2fd555
  9. 22 May, 2009 1 commit
    • Inaky Perez-Gonzalez's avatar
      wimax/i2400m: usb: fix device reset on autosuspend while not yet idle · e069c0cf
      Inaky Perez-Gonzalez authored
      
      
      When the i2400m is connected to a network, the host interface (USB)
      cannot be suspended. For that to happen, the device has to have
      negotiated with the basestation to put the link on IDLE state.
      
      If the host tries to put the device in standby while it is connected
      but not idle, the device resets, as the driver should not do that.
      
      To avoid triggering that, when the USB susbsytem requires the driver
      to autosuspend the device, the driver checks if the device is not yet
      idle. If it is not, the request is rejected (will be retried again
      later on after the autosuspend timeout). At some point the device will
      enter idle and the request will succeed (unless of course, there is
      network traffic, but at that point, there is no idle neither in the
      link or the host interface).
      Signed-off-by: default avatarInaky Perez-Gonzalez <inaky@linux.intel.com>
      e069c0cf
  10. 21 May, 2009 8 commits