Contents of /trunk/kernel26-magellan/patches-2.6.25-r5/0112-2.6.25.13-all-fixes.patch
Parent Directory | Revision Log
Revision 677 -
(show annotations)
(download)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 7546 byte(s)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 7546 byte(s)
2.6.25-magellan-r5: - updated to linux-2.6.25.17
1 | diff --git a/Documentation/networking/udplite.txt b/Documentation/networking/udplite.txt |
2 | index 3870f28..855d8da 100644 |
3 | --- a/Documentation/networking/udplite.txt |
4 | +++ b/Documentation/networking/udplite.txt |
5 | @@ -148,7 +148,7 @@ |
6 | getsockopt(sockfd, SOL_SOCKET, SO_NO_CHECK, &value, ...); |
7 | |
8 | is meaningless (as in TCP). Packets with a zero checksum field are |
9 | - illegal (cf. RFC 3828, sec. 3.1) will be silently discarded. |
10 | + illegal (cf. RFC 3828, sec. 3.1) and will be silently discarded. |
11 | |
12 | 4) Fragmentation |
13 | |
14 | diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c |
15 | index ae9629f..c258a05 100644 |
16 | --- a/drivers/net/hamradio/hdlcdrv.c |
17 | +++ b/drivers/net/hamradio/hdlcdrv.c |
18 | @@ -88,6 +88,7 @@ |
19 | static inline void append_crc_ccitt(unsigned char *buffer, int len) |
20 | { |
21 | unsigned int crc = crc_ccitt(0xffff, buffer, len) ^ 0xffff; |
22 | + buffer += len; |
23 | *buffer++ = crc; |
24 | *buffer++ = crc >> 8; |
25 | } |
26 | diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c |
27 | index ac0ac98..6bc58dd 100644 |
28 | --- a/drivers/net/pppoe.c |
29 | +++ b/drivers/net/pppoe.c |
30 | @@ -341,12 +341,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) |
31 | struct pppox_sock *relay_po; |
32 | |
33 | if (sk->sk_state & PPPOX_BOUND) { |
34 | - struct pppoe_hdr *ph = pppoe_hdr(skb); |
35 | - int len = ntohs(ph->length); |
36 | - skb_pull_rcsum(skb, sizeof(struct pppoe_hdr)); |
37 | - if (pskb_trim_rcsum(skb, len)) |
38 | - goto abort_kfree; |
39 | - |
40 | ppp_input(&po->chan, skb); |
41 | } else if (sk->sk_state & PPPOX_RELAY) { |
42 | relay_po = get_item_by_addr(&po->pppoe_relay); |
43 | @@ -357,7 +351,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) |
44 | if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) |
45 | goto abort_put; |
46 | |
47 | - skb_pull(skb, sizeof(struct pppoe_hdr)); |
48 | if (!__pppoe_xmit(sk_pppox(relay_po), skb)) |
49 | goto abort_put; |
50 | } else { |
51 | @@ -388,6 +381,7 @@ static int pppoe_rcv(struct sk_buff *skb, |
52 | { |
53 | struct pppoe_hdr *ph; |
54 | struct pppox_sock *po; |
55 | + int len; |
56 | |
57 | if (!(skb = skb_share_check(skb, GFP_ATOMIC))) |
58 | goto out; |
59 | @@ -399,10 +393,21 @@ static int pppoe_rcv(struct sk_buff *skb, |
60 | goto drop; |
61 | |
62 | ph = pppoe_hdr(skb); |
63 | + len = ntohs(ph->length); |
64 | + |
65 | + skb_pull_rcsum(skb, sizeof(*ph)); |
66 | + if (skb->len < len) |
67 | + goto drop; |
68 | |
69 | po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex); |
70 | - if (po != NULL) |
71 | - return sk_receive_skb(sk_pppox(po), skb, 0); |
72 | + if (!po) |
73 | + goto drop; |
74 | + |
75 | + if (pskb_trim_rcsum(skb, len)) |
76 | + goto drop; |
77 | + |
78 | + return sk_receive_skb(sk_pppox(po), skb, 0); |
79 | + |
80 | drop: |
81 | kfree_skb(skb); |
82 | out: |
83 | @@ -427,12 +432,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb, |
84 | if (dev->nd_net != &init_net) |
85 | goto abort; |
86 | |
87 | - if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) |
88 | - goto abort; |
89 | - |
90 | if (!(skb = skb_share_check(skb, GFP_ATOMIC))) |
91 | goto out; |
92 | |
93 | + if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) |
94 | + goto abort; |
95 | + |
96 | ph = pppoe_hdr(skb); |
97 | if (ph->code != PADT_CODE) |
98 | goto abort; |
99 | @@ -937,12 +942,10 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock, |
100 | m->msg_namelen = 0; |
101 | |
102 | if (skb) { |
103 | - struct pppoe_hdr *ph = pppoe_hdr(skb); |
104 | - const int len = ntohs(ph->length); |
105 | - |
106 | - error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len); |
107 | + total_len = min_t(size_t, total_len, skb->len); |
108 | + error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len); |
109 | if (error == 0) |
110 | - error = len; |
111 | + error = total_len; |
112 | } |
113 | |
114 | kfree_skb(skb); |
115 | diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c |
116 | index a629355..a3e1d22 100644 |
117 | --- a/drivers/net/pppol2tp.c |
118 | +++ b/drivers/net/pppol2tp.c |
119 | @@ -783,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock, |
120 | err = 0; |
121 | skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, |
122 | flags & MSG_DONTWAIT, &err); |
123 | - if (skb) { |
124 | - err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data, |
125 | - skb->len); |
126 | - if (err < 0) |
127 | - goto do_skb_free; |
128 | - err = skb->len; |
129 | - } |
130 | -do_skb_free: |
131 | + if (!skb) |
132 | + goto end; |
133 | + |
134 | + if (len > skb->len) |
135 | + len = skb->len; |
136 | + else if (len < skb->len) |
137 | + msg->msg_flags |= MSG_TRUNC; |
138 | + |
139 | + err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len); |
140 | + if (likely(err == 0)) |
141 | + err = len; |
142 | + |
143 | kfree_skb(skb); |
144 | end: |
145 | return err; |
146 | diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h |
147 | index 134c8e5..2584306 100644 |
148 | --- a/include/linux/ipv6.h |
149 | +++ b/include/linux/ipv6.h |
150 | @@ -123,6 +123,7 @@ struct ipv6hdr { |
151 | struct in6_addr daddr; |
152 | }; |
153 | |
154 | +#ifdef __KERNEL__ |
155 | /* |
156 | * This structure contains configuration options per IPv6 link. |
157 | */ |
158 | @@ -162,6 +163,7 @@ struct ipv6_devconf { |
159 | #endif |
160 | void *sysctl; |
161 | }; |
162 | +#endif |
163 | |
164 | /* index values for the variables in ipv6_devconf */ |
165 | enum { |
166 | diff --git a/include/linux/kernel.h b/include/linux/kernel.h |
167 | index 2df44e7..6890264 100644 |
168 | --- a/include/linux/kernel.h |
169 | +++ b/include/linux/kernel.h |
170 | @@ -20,6 +20,7 @@ |
171 | extern const char linux_banner[]; |
172 | extern const char linux_proc_banner[]; |
173 | |
174 | +#define USHORT_MAX ((u16)(~0U)) |
175 | #define INT_MAX ((int)(~0U>>1)) |
176 | #define INT_MIN (-INT_MAX - 1) |
177 | #define UINT_MAX (~0U) |
178 | diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c |
179 | index a3002fe..37801ae 100644 |
180 | --- a/net/ipv4/raw.c |
181 | +++ b/net/ipv4/raw.c |
182 | @@ -936,7 +936,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i) |
183 | srcp = inet->num; |
184 | |
185 | seq_printf(seq, "%4d: %08X:%04X %08X:%04X" |
186 | - " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d", |
187 | + " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n", |
188 | i, src, srcp, dest, destp, sp->sk_state, |
189 | atomic_read(&sp->sk_wmem_alloc), |
190 | atomic_read(&sp->sk_rmem_alloc), |
191 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
192 | index 1704c14..9703c87 100644 |
193 | --- a/net/ipv4/udp.c |
194 | +++ b/net/ipv4/udp.c |
195 | @@ -1325,6 +1325,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, |
196 | return -ENOPROTOOPT; |
197 | if (val != 0 && val < 8) /* Illegal coverage: use default (8) */ |
198 | val = 8; |
199 | + else if (val > USHORT_MAX) |
200 | + val = USHORT_MAX; |
201 | up->pcslen = val; |
202 | up->pcflag |= UDPLITE_SEND_CC; |
203 | break; |
204 | @@ -1337,6 +1339,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, |
205 | return -ENOPROTOOPT; |
206 | if (val != 0 && val < 8) /* Avoid silly minimal values. */ |
207 | val = 8; |
208 | + else if (val > USHORT_MAX) |
209 | + val = USHORT_MAX; |
210 | up->pcrlen = val; |
211 | up->pcflag |= UDPLITE_RECV_CC; |
212 | break; |
213 | diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c |
214 | index 584e6d7..7135279 100644 |
215 | --- a/net/ipv4/xfrm4_mode_tunnel.c |
216 | +++ b/net/ipv4/xfrm4_mode_tunnel.c |
217 | @@ -52,7 +52,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) |
218 | IP_ECN_clear(top_iph); |
219 | |
220 | top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? |
221 | - 0 : XFRM_MODE_SKB_CB(skb)->frag_off; |
222 | + 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF)); |
223 | ip_select_ident(top_iph, dst->child, NULL); |
224 | |
225 | top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); |
226 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c |
227 | index bab72b6..dee7fea 100644 |
228 | --- a/net/ipv6/ip6_fib.c |
229 | +++ b/net/ipv6/ip6_fib.c |
230 | @@ -679,7 +679,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, |
231 | |
232 | static __inline__ void fib6_start_gc(struct rt6_info *rt) |
233 | { |
234 | - if (ip6_fib_timer.expires == 0 && |
235 | + if (!timer_pending(&ip6_fib_timer) && |
236 | (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE))) |
237 | mod_timer(&ip6_fib_timer, jiffies + |
238 | init_net.ipv6.sysctl.ip6_rt_gc_interval); |
239 | @@ -687,7 +687,7 @@ static __inline__ void fib6_start_gc(struct rt6_info *rt) |
240 | |
241 | void fib6_force_start_gc(void) |
242 | { |
243 | - if (ip6_fib_timer.expires == 0) |
244 | + if (!timer_pending(&ip6_fib_timer)) |
245 | mod_timer(&ip6_fib_timer, jiffies + |
246 | init_net.ipv6.sysctl.ip6_rt_gc_interval); |
247 | } |