pm24.git/net, branch v2.6.35-rc5

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2010-07-08T02:56:00Z

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (35 commits) NET: SB1250: Initialize .owner vxge: show startup message with KERN_INFO ll_temac: Fix missing iounmaps bridge: Clear IPCB before possible entry into IP stack bridge br_multicast: BUG: unable to handle kernel NULL pointer dereference net: Fix definition of netif_vdbg() when VERBOSE_DEBUG is defined net/ne: fix memory leak in ne_drv_probe() xfrm: fix xfrm by MARK logic virtio_net: fix oom handling on tx virtio_net: do not reschedule rx refill forever s2io: resolve statistics issues linux/net.h: fix kernel-doc warnings net: decreasing real_num_tx_queues needs to flush qdisc sched: qdisc_reset_all_tx is calling qdisc_reset without qdisc_lock qlge: fix a eeh handler to not add a pending timer qlge: Replacing add_timer() to mod_timer() usbnet: Set parent device early for netdev_printk() net: Revert "rndis_host: Poll status channel before control channel" netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT drivers: bluetooth: bluecard_cs.c: Fixed include error, changed to linux/io.h ...

bridge: Clear IPCB before possible entry into IP stack

2010-07-07T21:43:33Z

The bridge protocol lives dangerously by having incestuous relations with the IP stack. In this instance an abomination has been created where a bogus IPCB area from a bridged packet leads to a crash in the IP stack because it's interpreted as IP options. This patch papers over the problem by clearing the IPCB area in that particular spot. To fix this properly we'd also need to parse any IP options if present but I'm way too lazy for that. Signed-off-by: Herbert Xu Cheers, Signed-off-by: David S. Miller

bridge br_multicast: BUG: unable to handle kernel NULL pointer dereference

2010-07-06T03:08:06Z

On Tue, Jul 06, 2010 at 08:48:35AM +0800, Herbert Xu wrote: > > bridge: Restore NULL check in br_mdb_ip_get Resend with proper attribution. bridge: Restore NULL check in br_mdb_ip_get Somewhere along the line the NULL check in br_mdb_ip_get went AWOL, causing crashes when we receive an IGMP packet with no multicast table allocated. This patch restores it and ensures all br_mdb_*_get functions use it. Reported-by: Frank Arnold Signed-off-by: Herbert Xu Thanks, Signed-off-by: David S. Miller

xfrm: fix xfrm by MARK logic

2010-07-04T18:46:07Z

While using xfrm by MARK feature in 2.6.34 - 2.6.35 kernels, the mark is always cleared in flowi structure via memset in _decode_session4 (net/ipv4/xfrm4_policy.c), so the policy lookup fails. IPv6 code is affected by this bug too. Signed-off-by: Peter Kosyh Acked-by: Eric Dumazet Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6

2010-07-03T05:04:49Z

net: decreasing real_num_tx_queues needs to flush qdisc

2010-07-03T04:59:07Z

Reducing real_num_queues needs to flush the qdisc otherwise skbs with queue_mappings greater then real_num_tx_queues can be sent to the underlying driver. The flow for this is, dev_queue_xmit() dev_pick_tx() skb_tx_hash() => hash using real_num_tx_queues skb_set_queue_mapping() ... qdisc_enqueue_root() => enqueue skb on txq from hash ... dev->real_num_tx_queues -= n ... sch_direct_xmit() dev_hard_start_xmit() ndo_start_xmit(skb,dev) => skb queue set with old hash skbs are enqueued on the qdisc with skb->queue_mapping set 0 < queue_mappings < real_num_tx_queues. When the driver decreases real_num_tx_queues skb's may be dequeued from the qdisc with a queue_mapping greater then real_num_tx_queues. This fixes a case in ixgbe where this was occurring with DCB and FCoE. Because the driver is using queue_mapping to map skbs to tx descriptor rings we can potentially map skbs to rings that no longer exist. Signed-off-by: John Fastabend Tested-by: Ross Brattain Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT

2010-07-02T08:05:01Z

We should release dst if dst->error is set. Bug introduced in 2.6.14 by commit e104411b82f5c ([XFRM]: Always release dst_entry on error in xfrm_lookup) Signed-off-by: Eric Dumazet Cc: stable@kernel.org Signed-off-by: Patrick McHardy

ethtool: Fix potential user buffer overflow for ETHTOOL_{G, S}RXFH

2010-06-29T08:00:29Z

struct ethtool_rxnfc was originally defined in 2.6.27 for the ETHTOOL_{G,S}RXFH command with only the cmd, flow_type and data fields. It was then extended in 2.6.30 to support various additional commands. These commands should have been defined to use a new structure, but it is too late to change that now. Since user-space may still be using the old structure definition for the ETHTOOL_{G,S}RXFH commands, and since they do not need the additional fields, only copy the originally defined fields to and from user-space. Signed-off-by: Ben Hutchings Cc: stable@kernel.org Signed-off-by: David S. Miller

ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL

2010-06-29T08:00:29Z

On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer overflow and the buffer may be smaller than needed. Since ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at least denial of service. Signed-off-by: Ben Hutchings Cc: stable@kernel.org Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2010-06-27T18:28:02Z

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (52 commits) phylib: Add autoload support for the LXT973 phy. ISDN: hysdn, fix potential NULL dereference vxge: fix memory leak in vxge_alloc_msix() error path isdn/gigaset: correct CAPI connection state storage isdn/gigaset: encode HLC and BC together isdn/gigaset: correct CAPI DATA_B3 Delivery Confirmation isdn/gigaset: correct CAPI voice connection encoding isdn/gigaset: honor CAPI application's buffer size request cpmac: do not leak struct net_device on phy_connect errors smc91c92_cs: fix the problem that lan & modem does not work simultaneously ipv6: fix NULL reference in proxy neighbor discovery Bluetooth: Bring back var 'i' increment xfrm: check bundle policy existance before dereferencing it sky2: enable rx/tx in sky2_phy_reinit() cnic: Disable statistics initialization for eth clients that do not support statistics net: add dependency on fw class module to qlcnic and netxen_nic snmp: fix SNMP_ADD_STATS() hso: remove setting of low_latency flag udp: Fix bogus UFO packet generation lasi82596: fix netdev_mc_count conversion ...