From 35019539d71bacd98de318c34728c97b1b505b49 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 14 Aug 2007 13:13:28 -0700 Subject: [NETFILTER]: netfilter: xt_u32 bug correction An extraneous ";" makes xt_u32 match useless Signed-off-by: Eric Dumazet Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/netfilter/xt_u32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 74f9b14c012f..bec427915b30 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -36,7 +36,7 @@ static bool u32_match_it(const struct xt_u32 *data, at = 0; pos = ct->location[0].number; - if (skb->len < 4 || pos > skb->len - 4); + if (skb->len < 4 || pos > skb->len - 4) return false; ret = skb_copy_bits(skb, pos, &n, sizeof(n)); -- cgit v1.2.2 From 465f90a486cd724d364167747e8b8b9f806fa91a Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Tue, 14 Aug 2007 13:13:54 -0700 Subject: [NETFILTER]: nf_conntrack_sip: check sname != NULL before calling strncmp The check got lost during the conversion to nf_conntrack. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/netfilter/nf_conntrack_sip.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'net') diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 1276a442f10c..5cc9636e46e9 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -330,7 +330,8 @@ int ct_sip_get_info(struct nf_conn *ct, while (dptr <= limit) { if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) && - (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) { + (hnfo->sname == NULL || + strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) { dptr++; continue; } -- cgit v1.2.2 From aa584eda5d2002097de9f608b362d9150730abd7 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Tue, 14 Aug 2007 13:14:35 -0700 Subject: [NETFILTER]: nf_conntrack_sip: fix SIP-URI parsing The userinfo component of a SIP-URI is optional, continue parsing at the beginning of the SIP-URI in case its not found. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/netfilter/nf_conntrack_sip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'net') diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 5cc9636e46e9..d449fa47491c 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -295,6 +295,7 @@ static int epaddr_len(struct nf_conn *ct, const char *dptr, static int skp_epaddr_len(struct nf_conn *ct, const char *dptr, const char *limit, int *shift) { + const char *start = dptr; int s = *shift; /* Search for @, but stop at the end of the line. @@ -309,8 +310,10 @@ static int skp_epaddr_len(struct nf_conn *ct, const char *dptr, if (dptr <= limit && *dptr == '@') { dptr++; (*shift)++; - } else + } else { + dptr = start; *shift = s; + } return epaddr_len(ct, dptr, limit, shift); } -- cgit v1.2.2 From 45241a7a07537266eec363593ef377a1e6b7db7f Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Tue, 14 Aug 2007 13:14:58 -0700 Subject: [NETFILTER]: nf_nat_sip: don't drop short packets Don't drop packets shorter than "SIP/2.0", just ignore them. Keep-alives can validly be shorter for example. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/ipv4/netfilter/nf_nat_sip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c index a889ec3ec83a..e14d41976c27 100644 --- a/net/ipv4/netfilter/nf_nat_sip.c +++ b/net/ipv4/netfilter/nf_nat_sip.c @@ -104,7 +104,7 @@ static unsigned int ip_nat_sip(struct sk_buff **pskb, dataoff = ip_hdrlen(*pskb) + sizeof(struct udphdr); datalen = (*pskb)->len - dataoff; if (datalen < sizeof("SIP/2.0") - 1) - return NF_DROP; + return NF_ACCEPT; addr_map_init(ct, &map); -- cgit v1.2.2 From 17120889b0706b69ae24cba3ef0a340dc3fb7edc Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Tue, 14 Aug 2007 13:21:34 -0700 Subject: [BRIDGE]: sysfs locking fix. The stp change code generates "sleeping function called from invalid context" because rtnl_lock() called with BH disabled. This fixes it by not acquiring then dropping the bridge lock. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller --- net/bridge/br_sysfs_br.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) (limited to 'net') diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c index 4f42263e0a8a..88f43003b193 100644 --- a/net/bridge/br_sysfs_br.c +++ b/net/bridge/br_sysfs_br.c @@ -147,20 +147,26 @@ static ssize_t show_stp_state(struct device *d, return sprintf(buf, "%d\n", br->stp_enabled); } -static void set_stp_state(struct net_bridge *br, unsigned long val) -{ - rtnl_lock(); - spin_unlock_bh(&br->lock); - br_stp_set_enabled(br, val); - spin_lock_bh(&br->lock); - rtnl_unlock(); -} static ssize_t store_stp_state(struct device *d, struct device_attribute *attr, const char *buf, size_t len) { - return store_bridge_parm(d, buf, len, set_stp_state); + struct net_bridge *br = to_bridge(d); + char *endp; + unsigned long val; + + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + + val = simple_strtoul(buf, &endp, 0); + if (endp == buf) + return -EINVAL; + + rtnl_lock(); + br_stp_set_enabled(br, val); + rtnl_unlock(); + } static DEVICE_ATTR(stp_state, S_IRUGO | S_IWUSR, show_stp_state, store_stp_state); -- cgit v1.2.2 From 02f44315dc4bce8a222564aa023c965efbeb73b5 Mon Sep 17 00:00:00 2001 From: Jussi Kivilinna Date: Tue, 14 Aug 2007 13:22:58 -0700 Subject: [BRIDGE]: Fix typo in net/bridge/br_stp_if.c Signed-off-by: Jussi Kivilinna Acked-by: Stephen Hemminger Signed-off-by: David S. Miller --- net/bridge/br_stp_if.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c index 1ea2f86f7683..1a430eccec9b 100644 --- a/net/bridge/br_stp_if.c +++ b/net/bridge/br_stp_if.c @@ -132,7 +132,7 @@ static void br_stp_start(struct net_bridge *br) } else { br->stp_enabled = BR_KERNEL_STP; printk(KERN_INFO "%s: starting userspace STP failed, " - "staring kernel STP\n", br->dev->name); + "starting kernel STP\n", br->dev->name); /* To start timers on any ports left in blocking */ spin_lock_bh(&br->lock); -- cgit v1.2.2 From 7b7ed879254ad43990c9d67f95be3427401c3392 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 7 Aug 2007 10:23:57 +0200 Subject: [PATCH] mac80211: fix tx status frame code When I added the monitor for outgoing frames somehow a break statement slipped in. Remove it. Signed-off-by: Johannes Berg --- net/mac80211/ieee80211.c | 1 - 1 file changed, 1 deletion(-) (limited to 'net') diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c index 8ec5ed192b5d..7286c389a4d0 100644 --- a/net/mac80211/ieee80211.c +++ b/net/mac80211/ieee80211.c @@ -4678,7 +4678,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb, memset(skb->cb, 0, sizeof(skb->cb)); netif_rx(skb); skb = skb2; - break; } } out: -- cgit v1.2.2 From b9bf1e60a294fc7795d5198f94a917290e52865b Mon Sep 17 00:00:00 2001 From: "John W. Linville" Date: Tue, 7 Aug 2007 16:33:15 -0400 Subject: [PATCH] mac80211: probe for hidden SSIDs in pre-auth scan Probe for hidden SSIDs if initiating pre-authentication scan and SSID is set for STA interface. Signed-off-by: John W. Linville --- net/mac80211/ieee80211_sta.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'net') diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c index 7ba352e3ffe0..0d99b685df5f 100644 --- a/net/mac80211/ieee80211_sta.c +++ b/net/mac80211/ieee80211_sta.c @@ -2154,7 +2154,11 @@ static int ieee80211_sta_config_auth(struct net_device *dev, return 0; } else { if (ifsta->state != IEEE80211_AUTHENTICATE) { - ieee80211_sta_start_scan(dev, NULL, 0); + if (ifsta->auto_ssid_sel) + ieee80211_sta_start_scan(dev, NULL, 0); + else + ieee80211_sta_start_scan(dev, ifsta->ssid, + ifsta->ssid_len); ifsta->state = IEEE80211_AUTHENTICATE; set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request); } else -- cgit v1.2.2 From 9ac0be9d4fa0c0ec7a447eeaa080bc13cf865319 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Tue, 14 Aug 2007 17:24:05 -0700 Subject: [AX25]: don't free pointers to statically allocated data commit 8d5cf596d10d740b69b5f4bbdb54b85abf75810d started to add statically allocated ax25_protocol's to list. However kfree() was still in place waiting for unsuspecting ones on module removal. Steps to reproduce: modprobe netrom rmmod netrom P.S.: code would benefit greatly from list_add/list_del usage kernel BUG at mm/slab.c:592! invalid opcode: 0000 [1] PREEMPT SMP CPU 0 Modules linked in: netrom ax25 af_packet usbcore rtc_cmos rtc_core rtc_lib Pid: 4477, comm: rmmod Not tainted 2.6.23-rc3-bloat #2 RIP: 0010:[] [] kfree+0x1c6/0x260 RSP: 0000:ffff810079a05e48 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff81000000c000 RDX: ffff81007e552458 RSI: 0000000000000000 RDI: 000000000000805d RBP: ffff810079a05e88 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8805d080 R13: ffffffff8805d080 R14: 0000000000000000 R15: 0000000000000282 FS: 00002b73fc98aae0(0000) GS:ffffffff805dc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000000053f3b8 CR3: 0000000079ff2000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process rmmod (pid: 4477, threadinfo ffff810079a04000, task ffff8100775aa480) Stack: ffff810079a05e68 0000000000000246 ffffffff8804eca0 0000000000000000 ffffffff8805d080 00000000000000cf 0000000000000000 0000000000000880 ffff810079a05eb8 ffffffff8803ec90 ffff810079a05eb8 0000000000000000 Call Trace: [] :ax25:ax25_protocol_release+0xa0/0xb0 [] :netrom:nr_exit+0x6b/0xf0 [] sys_delete_module+0x170/0x1f0 [] trace_hardirqs_on+0xd5/0x170 [] trace_hardirqs_on_thunk+0x35/0x37 [] system_call+0x7e/0x83 Code: 0f 0b eb fe 66 66 90 66 66 90 48 8b 52 10 48 8b 02 25 00 40 RIP [] kfree+0x1c6/0x260 RSP Kernel panic - not syncing: Fatal exception Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller --- net/ax25/ax25_iface.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'net') diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c index 16be0c14780a..8443af57a374 100644 --- a/net/ax25/ax25_iface.c +++ b/net/ax25/ax25_iface.c @@ -69,7 +69,6 @@ void ax25_protocol_release(unsigned int pid) if (protocol->pid == pid) { protocol_list = protocol->next; write_unlock_bh(&protocol_list_lock); - kfree(protocol); return; } @@ -78,7 +77,6 @@ void ax25_protocol_release(unsigned int pid) s = protocol->next; protocol->next = protocol->next->next; write_unlock_bh(&protocol_list_lock); - kfree(s); return; } -- cgit v1.2.2 From 9c29a377f99b42c59721112cd2388cf27547fc84 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Tue, 14 Aug 2007 17:25:20 -0700 Subject: [ECONET]: remove econet_packet_type on unload Steps to reproduce: modprobe econet rmmod econet modprobe econet Unable to handle kernel paging request at ffffffff8870a098 RIP: [] dev_add_pack+0x48/0x90 PGD 203067 PUD 207063 PMD 7817f067 PTE 0 Oops: 0002 [1] PREEMPT SMP CPU 1 Modules linked in: econet [maaaany] Pid: 10671, comm: modprobe Not tainted 2.6.23-rc3-bloat #6 RIP: 0010:[] [] dev_add_pack+0x48/0x90 RSP: 0000:ffff810076293df8 EFLAGS: 00010202 RAX: ffffffff88659090 RBX: ffffffff88659060 RCX: ffffffff8870a090 RDX: 0000000000000080 RSI: ffffffff805ec660 RDI: ffff810078ce4680 RBP: ffff810076293e08 R08: 0000000000000002 R09: 0000000000000000 R10: ffffffff8040bf88 R11: 0000000000000001 R12: ffff810076293e18 R13: 000000000000001b R14: ffff810076dd06b0 R15: ffffffff886590c0 FS: 00002b96a525dae0(0000) GS:ffff81007e0e2138(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffff8870a098 CR3: 000000007bb67000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 10671, threadinfo ffff810076292000, task ffff810078ce4680) Stack: ffff810076dd06b0 0000000000000000 ffff810076293e38 ffffffff8865b180 0000000000800000 0000000000000000 ffffffff886590c0 ffff810076dd01c8 ffff810076293f78 ffffffff8026723c ffff810076293e48 ffffffff886590d8 Call Trace: [] :econet:econet_proto_init+0x180/0x1da [] sys_init_module+0x15c/0x19e0 [] system_call+0x7e/0x83 Code: 48 89 41 08 48 89 82 e0 c5 5e 80 48 c7 c7 a0 08 5d 80 e8 f1 RIP [] dev_add_pack+0x48/0x90 RSP CR2: ffffffff8870a098 Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller --- net/econet/af_econet.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'net') diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c index b5524f32ac2d..35c96bcc0f32 100644 --- a/net/econet/af_econet.c +++ b/net/econet/af_econet.c @@ -1146,6 +1146,9 @@ static void __exit econet_proto_exit(void) sock_release(udpsock); #endif unregister_netdevice_notifier(&econet_netdev_notifier); +#ifdef CONFIG_ECONET_NATIVE + dev_remove_pack(&econet_packet_type); +#endif sock_unregister(econet_family_ops.family); proto_unregister(&econet_proto); } -- cgit v1.2.2 From 6f93b9c28326df34b23a6c0dbe4c51d4654bdf0b Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Tue, 14 Aug 2007 17:38:44 -0700 Subject: [NET]: Unexport dev_ethtool This patch removes the no longer used EXPORT_SYMBOL(dev_ethtool). Signed-off-by: Adrian Bunk Acked-by: Matthew Wilcox Signed-off-by: David S. Miller --- net/core/ethtool.c | 1 - 1 file changed, 1 deletion(-) (limited to 'net') diff --git a/net/core/ethtool.c b/net/core/ethtool.c index 2ab0a60046a5..c5e059352d43 100644 --- a/net/core/ethtool.c +++ b/net/core/ethtool.c @@ -948,7 +948,6 @@ int dev_ethtool(struct ifreq *ifr) return rc; } -EXPORT_SYMBOL(dev_ethtool); EXPORT_SYMBOL(ethtool_op_get_link); EXPORT_SYMBOL(ethtool_op_get_sg); EXPORT_SYMBOL(ethtool_op_get_tso); -- cgit v1.2.2 From 16f3051b166bde3f1bd741783b64a8feebdb6f00 Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Tue, 14 Aug 2007 17:39:43 -0700 Subject: [VLAN] net/8021q/vlanproc.c: fix check-after-use The Coverity checker spotted that we'd have already oops'ed if "vlandev" was NULL. Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller --- net/8021q/vlanproc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c index c0040c9064a1..bd08aa090763 100644 --- a/net/8021q/vlanproc.c +++ b/net/8021q/vlanproc.c @@ -319,7 +319,7 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset) static const char fmt[] = "%30s %12lu\n"; int i; - if ((vlandev == NULL) || (!(vlandev->priv_flags & IFF_802_1Q_VLAN))) + if (!(vlandev->priv_flags & IFF_802_1Q_VLAN)) return 0; seq_printf(seq, "%s VID: %d REORDER_HDR: %i dev->priv_flags: %hx\n", -- cgit v1.2.2 From 3b1855255098e1f78fa74c0f3378c0391e9a7a2b Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Wed, 15 Aug 2007 14:46:02 -0700 Subject: [NET]: Fix unbalanced rcu_read_unlock in __sock_create The recent RCU work created an unbalanced rcu_read_unlock in __sock_create. This patch fixes that. Reported by oleg 123. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/socket.c b/net/socket.c index ec077037f534..7d44453dfae1 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1168,7 +1168,7 @@ static int __sock_create(int family, int type, int protocol, module_put(pf->owner); err = security_socket_post_create(sock, family, type, protocol, kern); if (err) - goto out_release; + goto out_sock_release; *res = sock; return 0; -- cgit v1.2.2 From 660adc6e60bc8882b16e466c09401cff017dcd94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Date: Wed, 15 Aug 2007 15:07:30 -0700 Subject: [IPv6]: Invalid semicolon after if statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A similar fix to netfilter from Eric Dumazet inspired me to look around a bit by using some grep/sed stuff as looking for this kind of bugs seemed easy to automate. This is one of them I found where it looks like this semicolon is not valid. Signed-off-by: Ilpo Järvinen Signed-off-by: David S. Miller --- net/ipv6/ipv6_sockglue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index d6846393182d..761a910f4f97 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -820,7 +820,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt, return 0; len = min_t(unsigned int, len, ipv6_optlen(hdr)); - if (copy_to_user(optval, hdr, len)); + if (copy_to_user(optval, hdr, len)) return -EFAULT; return ipv6_optlen(hdr); } -- cgit v1.2.2