Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
bridge: don't allow setting hello time to zero
netns : fix kernel panic in timewait socket destruction
pkt_sched: Fix qdisc state in net_tx_action()
netfilter: nf_conntrack_irc: make sure string is terminated before calling simple_strtoul
netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet
netfilter: nf_conntrack_gre: more locking around keymap list
netfilter: nf_conntrack_sip: de-static helper pointers
+94
-17
+3
include/net/inet_timewait_sock.h
+3
include/net/inet_timewait_sock.h
···
208
208
extern void inet_twsk_deschedule(struct inet_timewait_sock *tw,
209
209
struct inet_timewait_death_row *twdr);
210
210
211
+
extern void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
212
+
struct inet_timewait_death_row *twdr, int family);
213
+
211
214
static inline
212
215
struct net *twsk_net(const struct inet_timewait_sock *twsk)
213
216
{
+7
-1
net/bridge/br_ioctl.c
+7
-1
net/bridge/br_ioctl.c
···
188
188
return 0;
189
189
190
190
case BRCTL_SET_BRIDGE_HELLO_TIME:
191
+
{
192
+
unsigned long t = clock_t_to_jiffies(args[1]);
191
193
if (!capable(CAP_NET_ADMIN))
192
194
return -EPERM;
193
195
196
+
if (t < HZ)
197
+
return -EINVAL;
198
+
194
199
spin_lock_bh(&br->lock);
195
-
br->bridge_hello_time = clock_t_to_jiffies(args[1]);
200
+
br->bridge_hello_time = t;
196
201
if (br_is_root_bridge(br))
197
202
br->hello_time = br->bridge_hello_time;
198
203
spin_unlock_bh(&br->lock);
199
204
return 0;
205
+
}
200
206
201
207
case BRCTL_SET_BRIDGE_MAX_AGE:
202
208
if (!capable(CAP_NET_ADMIN))
+18
-8
net/bridge/br_sysfs_br.c
+18
-8
net/bridge/br_sysfs_br.c
···
29
29
*/
30
30
static ssize_t store_bridge_parm(struct device *d,
31
31
const char *buf, size_t len,
32
-
void (*set)(struct net_bridge *, unsigned long))
32
+
int (*set)(struct net_bridge *, unsigned long))
33
33
{
34
34
struct net_bridge *br = to_bridge(d);
35
35
char *endp;
36
36
unsigned long val;
37
+
int err;
37
38
38
39
if (!capable(CAP_NET_ADMIN))
39
40
return -EPERM;
···
44
43
return -EINVAL;
45
44
46
45
spin_lock_bh(&br->lock);
47
-
(*set)(br, val);
46
+
err = (*set)(br, val);
48
47
spin_unlock_bh(&br->lock);
49
-
return len;
48
+
return err ? err : len;
50
49
}
51
50
52
51
···
57
56
return sprintf(buf, "%lu\n", jiffies_to_clock_t(br->forward_delay));
58
57
}
59
58
60
-
static void set_forward_delay(struct net_bridge *br, unsigned long val)
59
+
static int set_forward_delay(struct net_bridge *br, unsigned long val)
61
60
{
62
61
unsigned long delay = clock_t_to_jiffies(val);
63
62
br->forward_delay = delay;
64
63
if (br_is_root_bridge(br))
65
64
br->bridge_forward_delay = delay;
65
+
return 0;
66
66
}
67
67
68
68
static ssize_t store_forward_delay(struct device *d,
···
82
80
jiffies_to_clock_t(to_bridge(d)->hello_time));
83
81
}
84
82
85
-
static void set_hello_time(struct net_bridge *br, unsigned long val)
83
+
static int set_hello_time(struct net_bridge *br, unsigned long val)
86
84
{
87
85
unsigned long t = clock_t_to_jiffies(val);
86
+
87
+
if (t < HZ)
88
+
return -EINVAL;
89
+
88
90
br->hello_time = t;
89
91
if (br_is_root_bridge(br))
90
92
br->bridge_hello_time = t;
93
+
return 0;
91
94
}
92
95
93
96
static ssize_t store_hello_time(struct device *d,
···
111
104
jiffies_to_clock_t(to_bridge(d)->max_age));
112
105
}
113
106
114
-
static void set_max_age(struct net_bridge *br, unsigned long val)
107
+
static int set_max_age(struct net_bridge *br, unsigned long val)
115
108
{
116
109
unsigned long t = clock_t_to_jiffies(val);
117
110
br->max_age = t;
118
111
if (br_is_root_bridge(br))
119
112
br->bridge_max_age = t;
113
+
return 0;
120
114
}
121
115
122
116
static ssize_t store_max_age(struct device *d, struct device_attribute *attr,
···
134
126
return sprintf(buf, "%lu\n", jiffies_to_clock_t(br->ageing_time));
135
127
}
136
128
137
-
static void set_ageing_time(struct net_bridge *br, unsigned long val)
129
+
static int set_ageing_time(struct net_bridge *br, unsigned long val)
138
130
{
139
131
br->ageing_time = clock_t_to_jiffies(val);
132
+
return 0;
140
133
}
141
134
142
135
static ssize_t store_ageing_time(struct device *d,
···
189
180
(br->bridge_id.prio[0] << 8) | br->bridge_id.prio[1]);
190
181
}
191
182
192
-
static void set_priority(struct net_bridge *br, unsigned long val)
183
+
static int set_priority(struct net_bridge *br, unsigned long val)
193
184
{
194
185
br_stp_set_bridge_priority(br, (u16) val);
186
+
return 0;
195
187
}
196
188
197
189
static ssize_t store_priority(struct device *d, struct device_attribute *attr,
+6
-1
net/core/dev.c
+6
-1
net/core/dev.c
···
1991
1991
spin_unlock(root_lock);
1992
1992
} else {
1993
1993
if (!test_bit(__QDISC_STATE_DEACTIVATED,
1994
-
&q->state))
1994
+
&q->state)) {
1995
1995
__netif_reschedule(q);
1996
+
} else {
1997
+
smp_mb__before_clear_bit();
1998
+
clear_bit(__QDISC_STATE_SCHED,
1999
+
&q->state);
2000
+
}
1996
2001
}
1997
2002
}
1998
2003
}
+35
net/ipv4/inet_timewait_sock.c
+35
net/ipv4/inet_timewait_sock.c
···
409
409
}
410
410
411
411
EXPORT_SYMBOL_GPL(inet_twdr_twcal_tick);
412
+
413
+
void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
414
+
struct inet_timewait_death_row *twdr, int family)
415
+
{
416
+
struct inet_timewait_sock *tw;
417
+
struct sock *sk;
418
+
struct hlist_node *node;
419
+
int h;
420
+
421
+
local_bh_disable();
422
+
for (h = 0; h < (hashinfo->ehash_size); h++) {
423
+
struct inet_ehash_bucket *head =
424
+
inet_ehash_bucket(hashinfo, h);
425
+
rwlock_t *lock = inet_ehash_lockp(hashinfo, h);
426
+
restart:
427
+
write_lock(lock);
428
+
sk_for_each(sk, node, &head->twchain) {
429
+
430
+
tw = inet_twsk(sk);
431
+
if (!net_eq(twsk_net(tw), net) ||
432
+
tw->tw_family != family)
433
+
continue;
434
+
435
+
atomic_inc(&tw->tw_refcnt);
436
+
write_unlock(lock);
437
+
inet_twsk_deschedule(tw, twdr);
438
+
inet_twsk_put(tw);
439
+
440
+
goto restart;
441
+
}
442
+
write_unlock(lock);
443
+
}
444
+
local_bh_enable();
445
+
}
446
+
EXPORT_SYMBOL_GPL(inet_twsk_purge);
+1
net/ipv4/tcp_ipv4.c
+1
net/ipv4/tcp_ipv4.c
+1
net/ipv6/tcp_ipv6.c
+1
net/ipv6/tcp_ipv6.c
+10
net/netfilter/nf_conntrack_irc.c
+10
net/netfilter/nf_conntrack_irc.c
···
68
68
static int parse_dcc(char *data, const char *data_end, u_int32_t *ip,
69
69
u_int16_t *port, char **ad_beg_p, char **ad_end_p)
70
70
{
71
+
char *tmp;
72
+
71
73
/* at least 12: "AAAAAAAA P\1\n" */
72
74
while (*data++ != ' ')
73
75
if (data > data_end - 12)
74
76
return -1;
77
+
78
+
/* Make sure we have a newline character within the packet boundaries
79
+
* because simple_strtoul parses until the first invalid character. */
80
+
for (tmp = data; tmp <= data_end; tmp++)
81
+
if (*tmp == '\n')
82
+
break;
83
+
if (tmp > data_end || *tmp != '\n')
84
+
return -1;
75
85
76
86
*ad_beg_p = data;
77
87
*ip = simple_strtoul(data, &data, 10);
+9
-5
net/netfilter/nf_conntrack_proto_gre.c
+9
-5
net/netfilter/nf_conntrack_proto_gre.c
···
45
45
46
46
void nf_ct_gre_keymap_flush(void)
47
47
{
48
-
struct list_head *pos, *n;
48
+
struct nf_ct_gre_keymap *km, *tmp;
49
49
50
50
write_lock_bh(&nf_ct_gre_lock);
51
-
list_for_each_safe(pos, n, &gre_keymap_list) {
52
-
list_del(pos);
53
-
kfree(pos);
51
+
list_for_each_entry_safe(km, tmp, &gre_keymap_list, list) {
52
+
list_del(&km->list);
53
+
kfree(km);
54
54
}
55
55
write_unlock_bh(&nf_ct_gre_lock);
56
56
}
···
97
97
kmp = &help->help.ct_pptp_info.keymap[dir];
98
98
if (*kmp) {
99
99
/* check whether it's a retransmission */
100
+
read_lock_bh(&nf_ct_gre_lock);
100
101
list_for_each_entry(km, &gre_keymap_list, list) {
101
-
if (gre_key_cmpfn(km, t) && km == *kmp)
102
+
if (gre_key_cmpfn(km, t) && km == *kmp) {
103
+
read_unlock_bh(&nf_ct_gre_lock);
102
104
return 0;
105
+
}
103
106
}
107
+
read_unlock_bh(&nf_ct_gre_lock);
104
108
pr_debug("trying to override keymap_%s for ct %p\n",
105
109
dir == IP_CT_DIR_REPLY ? "reply" : "orig", ct);
106
110
return -EEXIST;
+4
-2
net/netfilter/nf_conntrack_sip.c
+4
-2
net/netfilter/nf_conntrack_sip.c
···
1193
1193
static int process_sip_response(struct sk_buff *skb,
1194
1194
const char **dptr, unsigned int *datalen)
1195
1195
{
1196
-
static const struct sip_handler *handler;
1197
1196
enum ip_conntrack_info ctinfo;
1198
1197
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1199
1198
unsigned int matchoff, matchlen;
···
1213
1214
dataoff = matchoff + matchlen + 1;
1214
1215
1215
1216
for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
1217
+
const struct sip_handler *handler;
1218
+
1216
1219
handler = &sip_handlers[i];
1217
1220
if (handler->response == NULL)
1218
1221
continue;
···
1229
1228
static int process_sip_request(struct sk_buff *skb,
1230
1229
const char **dptr, unsigned int *datalen)
1231
1230
{
1232
-
static const struct sip_handler *handler;
1233
1231
enum ip_conntrack_info ctinfo;
1234
1232
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1235
1233
unsigned int matchoff, matchlen;
1236
1234
unsigned int cseq, i;
1237
1235
1238
1236
for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
1237
+
const struct sip_handler *handler;
1238
+
1239
1239
handler = &sip_handlers[i];
1240
1240
if (handler->request == NULL)
1241
1241
continue;