kernel/git/stable/linux.git/net/atm, branch linux-3.8.y

atm: update msg_namelen in vcc_recvmsg()

2013-05-01T16:46:00+00:00

[ Upstream commit 9b3e617f3df53822345a8573b6d358f6b9e5ed87 ] The current code does not fill the msg_name member in case it is set. It also does not set the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix that by simply setting msg_namelen to 0 as obviously nobody cared about vcc_recvmsg() not filling the msg_name in case it was set. Signed-off-by: Mathias Krause Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

atm: use scnprintf() instead of sprintf()

2012-12-18T04:50:51+00:00

As reported by Chen Gang , we should ensure there is enough space when formatting the sysfs buffers. Signed-off-by: Chas Williams Signed-off-by: David S. Miller

pppoatm: optimise PPP channel wakeups after sock_owned_by_user()

2012-12-02T00:05:20+00:00

We don't need to schedule the wakeup tasklet on *every* unlock; only if we actually blocked the channel in the first place. Signed-off-by: David Woodhouse Acked-by: Krzysztof Mazur

br2684: allow assign only on a connected socket

2012-12-02T00:05:19+00:00

The br2684 does not check if used vcc is in connected state, causing potential Oops in pppoatm_send() when vcc->send() is called on not fully connected socket. Now br2684 can be assigned only on connected sockets; otherwise -EINVAL error is returned. Signed-off-by: Krzysztof Mazur Signed-off-by: David Woodhouse

br2684: fix module_put() race

2012-12-02T00:05:16+00:00

The br2684 code used module_put() during unassignment from vcc with hope that we have BKL. This assumption is no longer true. Now owner field in atmvcc is used to move this module_put() to vcc_destroy_socket(). Signed-off-by: David Woodhouse Acked-by: Krzysztof Mazur

pppoatm: fix missing wakeup in pppoatm_send()

2012-12-02T00:05:15+00:00

Now that we can return zero from pppoatm_send() for reasons *other* than the queue being full, that means we can't depend on a subsequent call to pppoatm_pop() waking the queue, and we might leave it stalled indefinitely. Use the ->release_cb() callback to wake the queue after the sock is unlocked. Signed-off-by: David Woodhouse Acked-by: Krzysztof Mazur

br2684: don't send frames on not-ready vcc

2012-12-02T00:05:14+00:00

Avoid submitting packets to a vcc which is being closed. Things go badly wrong when the ->pop method gets later called after everything's been torn down. Use the ATM socket lock for synchronisation with vcc_destroy_socket(), which clears the ATM_VF_READY bit under the same lock. Otherwise, we could end up submitting a packet to the device driver even after its ->ops->close method has been called. And it could call the vcc's ->pop method after the protocol has been shut down. Which leads to a panic. Signed-off-by: David Woodhouse Acked-by: Krzysztof Mazur

atm: add release_cb() callback to vcc

2012-12-02T00:05:12+00:00

The immediate use case for this is that it will allow us to ensure that a pppoatm queue is woken after it has to drop a packet due to the sock being locked. Note that 'release_cb' is called when the socket is *unlocked*. This is not to be confused with vcc_release() — which probably ought to be called vcc_close(). Signed-off-by: David Woodhouse Acked-by: Krzysztof Mazur

pppoatm: do not inline pppoatm_may_send()

2012-11-30T12:23:19+00:00

The pppoatm_may_send() is quite heavy and it's called three times in pppoatm_send() and inlining costs more than 200 bytes of code (more than 10% of total pppoatm driver code size). add/remove: 1/0 grow/shrink: 0/1 up/down: 132/-367 (-235) function old new delta pppoatm_may_send - 132 +132 pppoatm_send 900 533 -367 Signed-off-by: Krzysztof Mazur Signed-off-by: David Woodhouse

pppoatm: drop frames to not-ready vcc

2012-11-30T12:21:42+00:00

The vcc_destroy_socket() closes vcc before the protocol is detached from vcc by calling vcc->push() with NULL skb. This leaves some time window, where the protocol may call vcc->send() on closed vcc and crash. Now pppoatm_send(), like vcc_sendmsg(), checks for vcc flags that indicate that vcc is not ready. If the vcc is not ready we just drop frame. Queueing frames is much more complicated because we don't have callbacks that inform us about vcc flags changes. Signed-off-by: Krzysztof Mazur Signed-off-by: David Woodhouse