Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
vlan: dont drop packets from unknown vlans in promiscuous mode
Phonet: Correct header retrieval after pskb_may_pull
um: Proper Fix for f25c80a4: remove duplicate structure field initialization
ip_gre: Fix dependencies wrt. ipv6.
net-2.6: SYN retransmits: Add new parameter to retransmits_timed_out()
iwl3945: queue the right work if the scan needs to be aborted
mac80211: fix use-after-free
+32
-35
+3
-14
arch/um/drivers/net_kern.c
+3
-14
arch/um/drivers/net_kern.c
···
255
255
netif_wake_queue(dev);
256
256
}
257
257
258
-
static int uml_net_set_mac(struct net_device *dev, void *addr)
259
-
{
260
-
struct uml_net_private *lp = netdev_priv(dev);
261
-
struct sockaddr *hwaddr = addr;
262
-
263
-
spin_lock_irq(&lp->lock);
264
-
eth_mac_addr(dev, hwaddr->sa_data);
265
-
spin_unlock_irq(&lp->lock);
266
-
267
-
return 0;
268
-
}
269
-
270
258
static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
271
259
{
272
260
dev->mtu = new_mtu;
···
361
373
.ndo_start_xmit = uml_net_start_xmit,
362
374
.ndo_set_multicast_list = uml_net_set_multicast_list,
363
375
.ndo_tx_timeout = uml_net_tx_timeout,
364
-
.ndo_set_mac_address = uml_net_set_mac,
376
+
.ndo_set_mac_address = eth_mac_addr,
365
377
.ndo_change_mtu = uml_net_change_mtu,
366
378
.ndo_validate_addr = eth_validate_addr,
367
379
};
···
460
472
((*transport->user->init)(&lp->user, dev) != 0))
461
473
goto out_unregister;
462
474
463
-
eth_mac_addr(dev, device->mac);
475
+
/* don't use eth_mac_addr, it will not work here */
476
+
memcpy(dev->dev_addr, device->mac, ETH_ALEN);
464
477
dev->mtu = transport->user->mtu;
465
478
dev->netdev_ops = ¨_netdev_ops;
466
479
dev->ethtool_ops = ¨_net_ethtool_ops;
+1
-1
drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+1
-1
drivers/net/wireless/iwlwifi/iwl-agn-lib.c
···
1411
1411
clear_bit(STATUS_SCAN_HW, &priv->status);
1412
1412
clear_bit(STATUS_SCANNING, &priv->status);
1413
1413
/* inform mac80211 scan aborted */
1414
-
queue_work(priv->workqueue, &priv->scan_completed);
1414
+
queue_work(priv->workqueue, &priv->abort_scan);
1415
1415
}
1416
1416
1417
1417
int iwlagn_manage_ibss_station(struct iwl_priv *priv,
+1
-1
drivers/net/wireless/iwlwifi/iwl3945-base.c
+1
-1
drivers/net/wireless/iwlwifi/iwl3945-base.c
···
3018
3018
clear_bit(STATUS_SCANNING, &priv->status);
3019
3019
3020
3020
/* inform mac80211 scan aborted */
3021
-
queue_work(priv->workqueue, &priv->scan_completed);
3021
+
queue_work(priv->workqueue, &priv->abort_scan);
3022
3022
}
3023
3023
3024
3024
static void iwl3945_bg_restart(struct work_struct *data)
+10
-4
net/8021q/vlan_core.c
+10
-4
net/8021q/vlan_core.c
···
24
24
25
25
if (vlan_dev)
26
26
skb->dev = vlan_dev;
27
-
else if (vlan_id)
28
-
goto drop;
27
+
else if (vlan_id) {
28
+
if (!(skb->dev->flags & IFF_PROMISC))
29
+
goto drop;
30
+
skb->pkt_type = PACKET_OTHERHOST;
31
+
}
29
32
30
33
return (polling ? netif_receive_skb(skb) : netif_rx(skb));
31
34
···
105
102
106
103
if (vlan_dev)
107
104
skb->dev = vlan_dev;
108
-
else if (vlan_id)
109
-
goto drop;
105
+
else if (vlan_id) {
106
+
if (!(skb->dev->flags & IFF_PROMISC))
107
+
goto drop;
108
+
skb->pkt_type = PACKET_OTHERHOST;
109
+
}
110
110
111
111
for (p = napi->gro_list; p; p = p->next) {
112
112
NAPI_GRO_CB(p)->same_flow =
+1
net/ipv4/Kconfig
+1
net/ipv4/Kconfig
+14
-10
net/ipv4/tcp_timer.c
+14
-10
net/ipv4/tcp_timer.c
···
135
135
136
136
/* This function calculates a "timeout" which is equivalent to the timeout of a
137
137
* TCP connection after "boundary" unsuccessful, exponentially backed-off
138
-
* retransmissions with an initial RTO of TCP_RTO_MIN.
138
+
* retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
139
+
* syn_set flag is set.
139
140
*/
140
141
static bool retransmits_timed_out(struct sock *sk,
141
-
unsigned int boundary)
142
+
unsigned int boundary,
143
+
bool syn_set)
142
144
{
143
145
unsigned int timeout, linear_backoff_thresh;
144
146
unsigned int start_ts;
147
+
unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
145
148
146
149
if (!inet_csk(sk)->icsk_retransmits)
147
150
return false;
···
154
151
else
155
152
start_ts = tcp_sk(sk)->retrans_stamp;
156
153
157
-
linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
154
+
linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
158
155
159
156
if (boundary <= linear_backoff_thresh)
160
-
timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
157
+
timeout = ((2 << boundary) - 1) * rto_base;
161
158
else
162
-
timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
159
+
timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
163
160
(boundary - linear_backoff_thresh) * TCP_RTO_MAX;
164
161
165
162
return (tcp_time_stamp - start_ts) >= timeout;
···
170
167
{
171
168
struct inet_connection_sock *icsk = inet_csk(sk);
172
169
int retry_until;
173
-
bool do_reset;
170
+
bool do_reset, syn_set = 0;
174
171
175
172
if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
176
173
if (icsk->icsk_retransmits)
177
174
dst_negative_advice(sk);
178
175
retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
176
+
syn_set = 1;
179
177
} else {
180
-
if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
178
+
if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
181
179
/* Black hole detection */
182
180
tcp_mtu_probing(icsk, sk);
183
181
···
191
187
192
188
retry_until = tcp_orphan_retries(sk, alive);
193
189
do_reset = alive ||
194
-
!retransmits_timed_out(sk, retry_until);
190
+
!retransmits_timed_out(sk, retry_until, 0);
195
191
196
192
if (tcp_out_of_resources(sk, do_reset))
197
193
return 1;
198
194
}
199
195
}
200
196
201
-
if (retransmits_timed_out(sk, retry_until)) {
197
+
if (retransmits_timed_out(sk, retry_until, syn_set)) {
202
198
/* Has it gone just too far? */
203
199
tcp_write_err(sk);
204
200
return 1;
···
440
436
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
441
437
}
442
438
inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
443
-
if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
439
+
if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
444
440
__sk_dst_reset(sk);
445
441
446
442
out:;
-4
net/mac80211/rx.c
-4
net/mac80211/rx.c
···
2199
2199
struct net_device *prev_dev = NULL;
2200
2200
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2201
2201
2202
-
if (status->flag & RX_FLAG_INTERNAL_CMTR)
2203
-
goto out_free_skb;
2204
-
2205
2202
if (skb_headroom(skb) < sizeof(*rthdr) &&
2206
2203
pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2207
2204
goto out_free_skb;
···
2257
2260
} else
2258
2261
goto out_free_skb;
2259
2262
2260
-
status->flag |= RX_FLAG_INTERNAL_CMTR;
2261
2263
return;
2262
2264
2263
2265
out_free_skb:
+2
-1
net/phonet/pep.c
+2
-1
net/phonet/pep.c
···
225
225
static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
226
226
{
227
227
struct pep_sock *pn = pep_sk(sk);
228
-
struct pnpipehdr *hdr = pnp_hdr(skb);
228
+
struct pnpipehdr *hdr;
229
229
int wake = 0;
230
230
231
231
if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
232
232
return -EINVAL;
233
233
234
+
hdr = pnp_hdr(skb);
234
235
if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
235
236
LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
236
237
(unsigned)hdr->data[0]);