Annotation of /trunk/kernel26-magellan-server/patches-2.6.25-r5/0112-2.6.25.13-all-fixes.patch
Parent Directory | Revision Log
Revision 677 -
(hide annotations)
(download)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 7546 byte(s)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 7546 byte(s)
2.6.25-magellan-r5: - updated to linux-2.6.25.17
1 | niro | 677 | diff --git a/Documentation/networking/udplite.txt b/Documentation/networking/udplite.txt |
2 | index 3870f28..855d8da 100644 | ||
3 | --- a/Documentation/networking/udplite.txt | ||
4 | +++ b/Documentation/networking/udplite.txt | ||
5 | @@ -148,7 +148,7 @@ | ||
6 | getsockopt(sockfd, SOL_SOCKET, SO_NO_CHECK, &value, ...); | ||
7 | |||
8 | is meaningless (as in TCP). Packets with a zero checksum field are | ||
9 | - illegal (cf. RFC 3828, sec. 3.1) will be silently discarded. | ||
10 | + illegal (cf. RFC 3828, sec. 3.1) and will be silently discarded. | ||
11 | |||
12 | 4) Fragmentation | ||
13 | |||
14 | diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c | ||
15 | index ae9629f..c258a05 100644 | ||
16 | --- a/drivers/net/hamradio/hdlcdrv.c | ||
17 | +++ b/drivers/net/hamradio/hdlcdrv.c | ||
18 | @@ -88,6 +88,7 @@ | ||
19 | static inline void append_crc_ccitt(unsigned char *buffer, int len) | ||
20 | { | ||
21 | unsigned int crc = crc_ccitt(0xffff, buffer, len) ^ 0xffff; | ||
22 | + buffer += len; | ||
23 | *buffer++ = crc; | ||
24 | *buffer++ = crc >> 8; | ||
25 | } | ||
26 | diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c | ||
27 | index ac0ac98..6bc58dd 100644 | ||
28 | --- a/drivers/net/pppoe.c | ||
29 | +++ b/drivers/net/pppoe.c | ||
30 | @@ -341,12 +341,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) | ||
31 | struct pppox_sock *relay_po; | ||
32 | |||
33 | if (sk->sk_state & PPPOX_BOUND) { | ||
34 | - struct pppoe_hdr *ph = pppoe_hdr(skb); | ||
35 | - int len = ntohs(ph->length); | ||
36 | - skb_pull_rcsum(skb, sizeof(struct pppoe_hdr)); | ||
37 | - if (pskb_trim_rcsum(skb, len)) | ||
38 | - goto abort_kfree; | ||
39 | - | ||
40 | ppp_input(&po->chan, skb); | ||
41 | } else if (sk->sk_state & PPPOX_RELAY) { | ||
42 | relay_po = get_item_by_addr(&po->pppoe_relay); | ||
43 | @@ -357,7 +351,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) | ||
44 | if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) | ||
45 | goto abort_put; | ||
46 | |||
47 | - skb_pull(skb, sizeof(struct pppoe_hdr)); | ||
48 | if (!__pppoe_xmit(sk_pppox(relay_po), skb)) | ||
49 | goto abort_put; | ||
50 | } else { | ||
51 | @@ -388,6 +381,7 @@ static int pppoe_rcv(struct sk_buff *skb, | ||
52 | { | ||
53 | struct pppoe_hdr *ph; | ||
54 | struct pppox_sock *po; | ||
55 | + int len; | ||
56 | |||
57 | if (!(skb = skb_share_check(skb, GFP_ATOMIC))) | ||
58 | goto out; | ||
59 | @@ -399,10 +393,21 @@ static int pppoe_rcv(struct sk_buff *skb, | ||
60 | goto drop; | ||
61 | |||
62 | ph = pppoe_hdr(skb); | ||
63 | + len = ntohs(ph->length); | ||
64 | + | ||
65 | + skb_pull_rcsum(skb, sizeof(*ph)); | ||
66 | + if (skb->len < len) | ||
67 | + goto drop; | ||
68 | |||
69 | po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex); | ||
70 | - if (po != NULL) | ||
71 | - return sk_receive_skb(sk_pppox(po), skb, 0); | ||
72 | + if (!po) | ||
73 | + goto drop; | ||
74 | + | ||
75 | + if (pskb_trim_rcsum(skb, len)) | ||
76 | + goto drop; | ||
77 | + | ||
78 | + return sk_receive_skb(sk_pppox(po), skb, 0); | ||
79 | + | ||
80 | drop: | ||
81 | kfree_skb(skb); | ||
82 | out: | ||
83 | @@ -427,12 +432,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb, | ||
84 | if (dev->nd_net != &init_net) | ||
85 | goto abort; | ||
86 | |||
87 | - if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) | ||
88 | - goto abort; | ||
89 | - | ||
90 | if (!(skb = skb_share_check(skb, GFP_ATOMIC))) | ||
91 | goto out; | ||
92 | |||
93 | + if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) | ||
94 | + goto abort; | ||
95 | + | ||
96 | ph = pppoe_hdr(skb); | ||
97 | if (ph->code != PADT_CODE) | ||
98 | goto abort; | ||
99 | @@ -937,12 +942,10 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock, | ||
100 | m->msg_namelen = 0; | ||
101 | |||
102 | if (skb) { | ||
103 | - struct pppoe_hdr *ph = pppoe_hdr(skb); | ||
104 | - const int len = ntohs(ph->length); | ||
105 | - | ||
106 | - error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len); | ||
107 | + total_len = min_t(size_t, total_len, skb->len); | ||
108 | + error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len); | ||
109 | if (error == 0) | ||
110 | - error = len; | ||
111 | + error = total_len; | ||
112 | } | ||
113 | |||
114 | kfree_skb(skb); | ||
115 | diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c | ||
116 | index a629355..a3e1d22 100644 | ||
117 | --- a/drivers/net/pppol2tp.c | ||
118 | +++ b/drivers/net/pppol2tp.c | ||
119 | @@ -783,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock, | ||
120 | err = 0; | ||
121 | skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, | ||
122 | flags & MSG_DONTWAIT, &err); | ||
123 | - if (skb) { | ||
124 | - err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data, | ||
125 | - skb->len); | ||
126 | - if (err < 0) | ||
127 | - goto do_skb_free; | ||
128 | - err = skb->len; | ||
129 | - } | ||
130 | -do_skb_free: | ||
131 | + if (!skb) | ||
132 | + goto end; | ||
133 | + | ||
134 | + if (len > skb->len) | ||
135 | + len = skb->len; | ||
136 | + else if (len < skb->len) | ||
137 | + msg->msg_flags |= MSG_TRUNC; | ||
138 | + | ||
139 | + err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len); | ||
140 | + if (likely(err == 0)) | ||
141 | + err = len; | ||
142 | + | ||
143 | kfree_skb(skb); | ||
144 | end: | ||
145 | return err; | ||
146 | diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h | ||
147 | index 134c8e5..2584306 100644 | ||
148 | --- a/include/linux/ipv6.h | ||
149 | +++ b/include/linux/ipv6.h | ||
150 | @@ -123,6 +123,7 @@ struct ipv6hdr { | ||
151 | struct in6_addr daddr; | ||
152 | }; | ||
153 | |||
154 | +#ifdef __KERNEL__ | ||
155 | /* | ||
156 | * This structure contains configuration options per IPv6 link. | ||
157 | */ | ||
158 | @@ -162,6 +163,7 @@ struct ipv6_devconf { | ||
159 | #endif | ||
160 | void *sysctl; | ||
161 | }; | ||
162 | +#endif | ||
163 | |||
164 | /* index values for the variables in ipv6_devconf */ | ||
165 | enum { | ||
166 | diff --git a/include/linux/kernel.h b/include/linux/kernel.h | ||
167 | index 2df44e7..6890264 100644 | ||
168 | --- a/include/linux/kernel.h | ||
169 | +++ b/include/linux/kernel.h | ||
170 | @@ -20,6 +20,7 @@ | ||
171 | extern const char linux_banner[]; | ||
172 | extern const char linux_proc_banner[]; | ||
173 | |||
174 | +#define USHORT_MAX ((u16)(~0U)) | ||
175 | #define INT_MAX ((int)(~0U>>1)) | ||
176 | #define INT_MIN (-INT_MAX - 1) | ||
177 | #define UINT_MAX (~0U) | ||
178 | diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c | ||
179 | index a3002fe..37801ae 100644 | ||
180 | --- a/net/ipv4/raw.c | ||
181 | +++ b/net/ipv4/raw.c | ||
182 | @@ -936,7 +936,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i) | ||
183 | srcp = inet->num; | ||
184 | |||
185 | seq_printf(seq, "%4d: %08X:%04X %08X:%04X" | ||
186 | - " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d", | ||
187 | + " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n", | ||
188 | i, src, srcp, dest, destp, sp->sk_state, | ||
189 | atomic_read(&sp->sk_wmem_alloc), | ||
190 | atomic_read(&sp->sk_rmem_alloc), | ||
191 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c | ||
192 | index 1704c14..9703c87 100644 | ||
193 | --- a/net/ipv4/udp.c | ||
194 | +++ b/net/ipv4/udp.c | ||
195 | @@ -1325,6 +1325,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, | ||
196 | return -ENOPROTOOPT; | ||
197 | if (val != 0 && val < 8) /* Illegal coverage: use default (8) */ | ||
198 | val = 8; | ||
199 | + else if (val > USHORT_MAX) | ||
200 | + val = USHORT_MAX; | ||
201 | up->pcslen = val; | ||
202 | up->pcflag |= UDPLITE_SEND_CC; | ||
203 | break; | ||
204 | @@ -1337,6 +1339,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, | ||
205 | return -ENOPROTOOPT; | ||
206 | if (val != 0 && val < 8) /* Avoid silly minimal values. */ | ||
207 | val = 8; | ||
208 | + else if (val > USHORT_MAX) | ||
209 | + val = USHORT_MAX; | ||
210 | up->pcrlen = val; | ||
211 | up->pcflag |= UDPLITE_RECV_CC; | ||
212 | break; | ||
213 | diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c | ||
214 | index 584e6d7..7135279 100644 | ||
215 | --- a/net/ipv4/xfrm4_mode_tunnel.c | ||
216 | +++ b/net/ipv4/xfrm4_mode_tunnel.c | ||
217 | @@ -52,7 +52,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) | ||
218 | IP_ECN_clear(top_iph); | ||
219 | |||
220 | top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? | ||
221 | - 0 : XFRM_MODE_SKB_CB(skb)->frag_off; | ||
222 | + 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF)); | ||
223 | ip_select_ident(top_iph, dst->child, NULL); | ||
224 | |||
225 | top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); | ||
226 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c | ||
227 | index bab72b6..dee7fea 100644 | ||
228 | --- a/net/ipv6/ip6_fib.c | ||
229 | +++ b/net/ipv6/ip6_fib.c | ||
230 | @@ -679,7 +679,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, | ||
231 | |||
232 | static __inline__ void fib6_start_gc(struct rt6_info *rt) | ||
233 | { | ||
234 | - if (ip6_fib_timer.expires == 0 && | ||
235 | + if (!timer_pending(&ip6_fib_timer) && | ||
236 | (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE))) | ||
237 | mod_timer(&ip6_fib_timer, jiffies + | ||
238 | init_net.ipv6.sysctl.ip6_rt_gc_interval); | ||
239 | @@ -687,7 +687,7 @@ static __inline__ void fib6_start_gc(struct rt6_info *rt) | ||
240 | |||
241 | void fib6_force_start_gc(void) | ||
242 | { | ||
243 | - if (ip6_fib_timer.expires == 0) | ||
244 | + if (!timer_pending(&ip6_fib_timer)) | ||
245 | mod_timer(&ip6_fib_timer, jiffies + | ||
246 | init_net.ipv6.sysctl.ip6_rt_gc_interval); | ||
247 | } |