Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[NET]: Remove redundant NULL checks before [kv]free
unaligned access in sk_run_filter()
[IPV6]: Clean up hop-by-hop options handler.
[IPV6] XFRM: Fix decoding session with preceding extension header(s).
[IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull().
[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.
[TCP]: Fix truesize underflow
+30
-18
+1
-1
include/net/ipv6.h
+1
-1
include/net/ipv6.h
···
230
230
void (*destructor)(struct sock *));
231
231
232
232
233
-
extern int ipv6_parse_hopopts(struct sk_buff *skb, int);
233
+
extern int ipv6_parse_hopopts(struct sk_buff *skb);
234
234
235
235
extern struct ipv6_txoptions * ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt);
236
236
extern struct ipv6_txoptions * ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+3
-2
net/core/filter.c
+3
-2
net/core/filter.c
···
34
34
#include <linux/timer.h>
35
35
#include <asm/system.h>
36
36
#include <asm/uaccess.h>
37
+
#include <asm/unaligned.h>
37
38
#include <linux/filter.h>
38
39
39
40
/* No hurry in this branch */
···
178
177
load_w:
179
178
ptr = load_pointer(skb, k, 4, &tmp);
180
179
if (ptr != NULL) {
181
-
A = ntohl(*(u32 *)ptr);
180
+
A = ntohl(get_unaligned((u32 *)ptr));
182
181
continue;
183
182
}
184
183
break;
···
187
186
load_h:
188
187
ptr = load_pointer(skb, k, 2, &tmp);
189
188
if (ptr != NULL) {
190
-
A = ntohs(*(u16 *)ptr);
189
+
A = ntohs(get_unaligned((u16 *)ptr));
191
190
continue;
192
191
}
193
192
break;
+2
-5
net/ipv4/ipcomp.c
+2
-5
net/ipv4/ipcomp.c
···
290
290
if (!scratches)
291
291
return;
292
292
293
-
for_each_possible_cpu(i) {
294
-
void *scratch = *per_cpu_ptr(scratches, i);
295
-
if (scratch)
296
-
vfree(scratch);
297
-
}
293
+
for_each_possible_cpu(i)
294
+
vfree(*per_cpu_ptr(scratches, i));
298
295
299
296
free_percpu(scratches);
300
297
}
+3
-1
net/ipv4/tcp_output.c
+3
-1
net/ipv4/tcp_output.c
···
551
551
buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
552
552
if (buff == NULL)
553
553
return -ENOMEM; /* We'll just try again later. */
554
-
sk_charge_skb(sk, buff);
554
+
555
+
buff->truesize = skb->len - len;
556
+
skb->truesize -= buff->truesize;
555
557
556
558
/* Correct the sequence numbers. */
557
559
TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
+14
-2
net/ipv6/exthdrs.c
+14
-2
net/ipv6/exthdrs.c
···
485
485
{ -1, }
486
486
};
487
487
488
-
int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)
488
+
int ipv6_parse_hopopts(struct sk_buff *skb)
489
489
{
490
490
struct inet6_skb_parm *opt = IP6CB(skb);
491
+
492
+
/*
493
+
* skb->nh.raw is equal to skb->data, and
494
+
* skb->h.raw - skb->nh.raw is always equal to
495
+
* sizeof(struct ipv6hdr) by definition of
496
+
* hop-by-hop options.
497
+
*/
498
+
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
499
+
!pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
500
+
kfree_skb(skb);
501
+
return -1;
502
+
}
491
503
492
504
opt->hop = sizeof(struct ipv6hdr);
493
505
if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
494
506
skb->h.raw += (skb->h.raw[1]+1)<<3;
495
507
opt->nhoff = sizeof(struct ipv6hdr);
496
-
return sizeof(struct ipv6hdr);
508
+
return 1;
497
509
}
498
510
return -1;
499
511
}
+1
-2
net/ipv6/ip6_input.c
+1
-2
net/ipv6/ip6_input.c
···
114
114
}
115
115
116
116
if (hdr->nexthdr == NEXTHDR_HOP) {
117
-
if (ipv6_parse_hopopts(skb, IP6CB(skb)->nhoff) < 0) {
117
+
if (ipv6_parse_hopopts(skb) < 0) {
118
118
IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
119
119
return 0;
120
120
}
121
-
hdr = skb->nh.ipv6h;
122
121
}
123
122
124
123
return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
+5
-3
net/ipv6/xfrm6_policy.c
+5
-3
net/ipv6/xfrm6_policy.c
···
191
191
static inline void
192
192
_decode_session6(struct sk_buff *skb, struct flowi *fl)
193
193
{
194
-
u16 offset = sizeof(struct ipv6hdr);
194
+
u16 offset = skb->h.raw - skb->nh.raw;
195
195
struct ipv6hdr *hdr = skb->nh.ipv6h;
196
-
struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
197
-
u8 nexthdr = skb->nh.ipv6h->nexthdr;
196
+
struct ipv6_opt_hdr *exthdr;
197
+
u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
198
198
199
199
memset(fl, 0, sizeof(struct flowi));
200
200
ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
201
201
ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
202
202
203
203
while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
204
+
exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
205
+
204
206
switch (nexthdr) {
205
207
case NEXTHDR_ROUTING:
206
208
case NEXTHDR_HOP: