kernel/git/stable/linux-stable.git/net, branch linux-2.6.15.y

[PATCH] NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated.

2006-03-28T07:00:23+00:00

The user can pass us arbitrary garbage so we should ensure the string they give us is null terminated before we pass it on to dev_get_by_index() et al. Found by Solar Designer. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242)

2006-03-28T07:00:23+00:00

The problem is in ip_push_pending_frames(), which uses: if (!df) { __ip_select_ident(iph, &rt->u.dst, 0); } else { iph->id = htons(inet->id++); } instead of ip_select_ident(). Right now I think the code is a nonsense. Most likely, I copied it from old ip_build_xmit(), where it was really special, we had to decide whether to generate unique ID when generating the first (well, the last) fragment. In ip_push_pending_frames() it does not make sense, it should use plain ip_select_ident() instead. Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Netfilter ip_queue: Fix wrong skb->len == nlmsg_len assumption

2006-03-28T07:00:21+00:00

The size of the skb carrying the netlink message is not equivalent to the length of the actual netlink message due to padding. ip_queue matches the length of the payload against the original packet size to determine if packet mangling is desired, due to the above wrong assumption arbitary packets may not be mangled depening on their original size. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Don't reset rskq_defer_accept in reqsk_queue_alloc

2006-03-05T19:07:17+00:00

In 295f7324ff8d9ea58b4d3ec93b1aaa1d80e048a9 I moved defer_accept from tcp_sock to request_queue and mistakingly reset it at reqsl_queue_alloc, causing calls to setsockopt(TCP_DEFER_ACCEPT ) to be lost after bind, the fix is to remove the zeroing of rskq_defer_accept from reqsl_queue_alloc. Thanks to Alexandra N. Kossovsky for reporting and testing the suggested fix. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Chris Wright

[PATCH] Fix a severe bug

2006-03-01T22:36:37+00:00

netlink overrun was broken while improvement of netlink. Destination socket is used in the place where it was meant to be source socket, so that now overrun is never sent to user netlink sockets, when it should be, and it even can be set on kernel socket, which results in complete deadlock of rtnetlink. Suggested fix is to restore status quo passing source socket as additional argument to netlink_attachskb(). A little explanation: overrun is set on a socket, when it failed to receive some message and sender of this messages does not or even have no way to handle this error. This happens in two cases: 1. when kernel sends something. Kernel never retransmits and cannot wait for buffer space. 2. when user sends a broadcast and the message was not delivered to some recipients. Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller Signed-off-by: Chris Wright

[PATCH] Fix deadlock in br_stp_disable_bridge

2006-03-01T22:36:34+00:00

Looks like somebody forgot to use the _bh spin_lock variant. We ran into a deadlock where br->hello_timer expired while br_stp_disable_br() walked br->port_list. Signed-off-by: Adrian Drzewiecki Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Address autoconfiguration does not work after device down/up cycle

2006-03-01T22:36:34+00:00

If you set network interface down and up again, the IPv6 address autoconfiguration does not work. 'ip addr' shows that the link-local address is in tentative state. We don't even react to periodical router advertisements. During NETDEV_DOWN we clear IF_READY, and we don't set it back in NETDEV_UP. While starting to perform DAD on the link-local address, we notice that the device is not in IF_READY, and we abort autoconfiguration process (which would eventually send router solicitations). Acked-by: Juha-Matti Tapio Acked-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Revert skb_copy_datagram_iovec() recursion elimination.

2006-03-01T22:36:33+00:00

Revert the following changeset: bc8dfcb93970ad7139c976356bfc99d7e251deaf Recursive SKB frag lists are really possible and disallowing them breaks things. Noticed by: Jesse Brandeburg Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] netfilter missing symbol has_bridge_parent

2006-03-01T22:36:32+00:00

5dce971acf2ae20c80d5e9d1f6bbf17376870911 in Linus' tree, otherwise known as bridge-netfilter-races-on-device-removal.patch in 2.5.15.4 removed has_bridge_parent, however this symbol is still called with NETFILTER_DEBUG is enabled. This patch uses the already seeded realoutdev value to detect if a parent exists, and if so, the value of the parent. Signed-Off-By: Horms Acked-by: Stephen Hemminger Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] bridge: fix RCU race on device removal

2006-02-10T07:20:15+00:00

Patch to 2.6.15 stable kernel to fix race conditions on device removal. These are reproducible by doing delif while packets are in flight. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman