History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: tproxy: fixe a possible read from an invalid location in the socket match zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr() mac80211: use unaligned safe memcmp() in-place of compare_ether_addr() ipw2200: fix netif_*_queue() removal regression iwlwifi: clean key table in iwl_clear_stations_table function tcp: tcp_vegas ssthresh bug fix can: omit received RTR frames for single ID filter lists ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table netx-eth: initialize per device spinlock tcp: make urg+gso work for real this time enc28j60: Fix sporadic packet loss (corrected again) hysdn: fix writing outside the field on 64 bits b1isa: fix b1isa_exit() to really remove registered capi controllers can: Fix CAN_(EFF|RTR)_FLAG handling in can_filter Phonet: do not dump addresses from other namespaces netlabel: Fix a potential NULL pointer dereference bnx2: Add workaround to handle missed MSI. xfrm: Fix kernel panic when flush and dump SPD entries

Linus Torvalds committed 17 years ago

Commit f7a8db82 parents 6f84b4d c49b9f221 files · +173 −54Browse files

Unified · Split

21 files
  1. drivers/isdn/hardware/avm/b1isa.c +2 −4
  2. drivers/isdn/hysdn/hysdn_net.c +2 −2
  3. drivers/net/bnx2.c +32 −3
  4. drivers/net/bnx2.h +6 −0
  5. drivers/net/enc28j60.c +14 −2
  6. drivers/net/netx-eth.c +2 −0
  7. drivers/net/wireless/ipw2200.c +4 −0
  8. drivers/net/wireless/iwlwifi/iwl-core.c +3 −0
  9. drivers/net/wireless/iwlwifi/iwl-sta.c +21 −3
  10. drivers/net/wireless/zd1211rw/zd_mac.c +1 −1
  11. include/linux/can/core.h +1 −1
  12. net/atm/svc.c +5 −1
  13. net/can/af_can.c +52 −16
  14. net/can/bcm.c +4 −3
  15. net/ipv4/tcp_output.c +10 −12
  16. net/ipv4/tcp_vegas.c +2 −0
  17. net/mac80211/sta_info.c +1 −1
  18. net/netfilter/xt_socket.c +1 −1
  19. net/netlabel/netlabel_unlabeled.c +6 −4
  20. net/phonet/pn_netlink.c +3 −0
  21. net/xfrm/xfrm_policy.c +1 −0
drivers/isdn/hardware/avm/b1isa.c+2−4
@@ -233,10 +233,8 @@ static void __exit b1isa_exit(void) · 232 unmodified lines
233233 int i;
234234
235235 for (i = 0; i < MAX_CARDS; i++) {
236− if (!io[i])
237− break;
238−
239− b1isa_remove(&isa_dev[i]);
236+ if (isa_dev[i].resource[0].start)
237+ b1isa_remove(&isa_dev[i]);
240238 }
241239 unregister_capi_driver(&capi_driver_b1isa);
242240 }
drivers/isdn/hysdn/hysdn_net.c+2−2
@@ -83,12 +83,12 @@ net_open(struct net_device *dev) · 82 unmodified lines
8383
8484 /* Fill in the MAC-level header (if not already set) */
8585 if (!card->mac_addr[0]) {
86− for (i = 0; i < ETH_ALEN - sizeof(unsigned long); i++)
86+ for (i = 0; i < ETH_ALEN; i++)
8787 dev->dev_addr[i] = 0xfc;
8888 if ((in_dev = dev->ip_ptr) != NULL) {
8989 struct in_ifaddr *ifa = in_dev->ifa_list;
9090 if (ifa != NULL)
91− memcpy(dev->dev_addr + (ETH_ALEN - sizeof(unsigned long)), &ifa->ifa_local, sizeof(unsigned long));
91+ memcpy(dev->dev_addr + (ETH_ALEN - sizeof(ifa->ifa_local)), &ifa->ifa_local, sizeof(ifa->ifa_local));
9292 }
9393 } else
9494 memcpy(dev->dev_addr, card->mac_addr, ETH_ALEN);
drivers/net/bnx2.c+32−3
@@ -3144,6 +3144,28 @@ bnx2_has_work(struct bnx2_napi *bnapi) · 3143 unmodified lines
31443144 return 0;
31453145 }
31463146
3147+static void
3148+bnx2_chk_missed_msi(struct bnx2 *bp)
3149+{
3150+ struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
3151+ u32 msi_ctrl;
3152+
3153+ if (bnx2_has_work(bnapi)) {
3154+ msi_ctrl = REG_RD(bp, BNX2_PCICFG_MSI_CONTROL);
3155+ if (!(msi_ctrl & BNX2_PCICFG_MSI_CONTROL_ENABLE))
3156+ return;
3157+
3158+ if (bnapi->last_status_idx == bp->idle_chk_status_idx) {
3159+ REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl &
3160+ ~BNX2_PCICFG_MSI_CONTROL_ENABLE);
3161+ REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl);
3162+ bnx2_msi(bp->irq_tbl[0].vector, bnapi);
3163+ }
3164+ }
3165+
3166+ bp->idle_chk_status_idx = bnapi->last_status_idx;
3167+}
3168+
31473169 static void bnx2_poll_link(struct bnx2 *bp, struct bnx2_napi *bnapi)
31483170 {
31493171 struct status_block *sblk = bnapi->status_blk.msi;
@@ -3218,14 +3240,15 @@ static int bnx2_poll(struct napi_struct *napi, int budget) · 68 unmodified lines
32183240
32193241 work_done = bnx2_poll_work(bp, bnapi, work_done, budget);
32203242
3221− if (unlikely(work_done >= budget))
3222− break;
3223−
32243243 /* bnapi->last_status_idx is used below to tell the hw how
32253244 * much work has been processed, so we must read it before
32263245 * checking for more work.
32273246 */
32283247 bnapi->last_status_idx = sblk->status_idx;
3248+
3249+ if (unlikely(work_done >= budget))
3250+ break;
3251+
32293252 rmb();
32303253 if (likely(!bnx2_has_work(bnapi))) {
32313254 netif_rx_complete(bp->dev, napi);
@@ -4570,6 +4593,8 @@ bnx2_init_chip(struct bnx2 *bp) · 1338 unmodified lines
45704593 for (i = 0; i < BNX2_MAX_MSIX_VEC; i++)
45714594 bp->bnx2_napi[i].last_status_idx = 0;
45724595
4596+ bp->idle_chk_status_idx = 0xffff;
4597+
45734598 bp->rx_mode = BNX2_EMAC_RX_MODE_SORT_MODE;
45744599
45754600 /* Set up how to generate a link change interrupt. */
@@ -5718,6 +5743,10 @@ bnx2_timer(unsigned long data) · 1142 unmodified lines
57185743 if (atomic_read(&bp->intr_sem) != 0)
57195744 goto bnx2_restart_timer;
57205745
5746+ if ((bp->flags & (BNX2_FLAG_USING_MSI | BNX2_FLAG_ONE_SHOT_MSI)) ==
5747+ BNX2_FLAG_USING_MSI)
5748+ bnx2_chk_missed_msi(bp);
5749+
57215750 bnx2_send_heart_beat(bp);
57225751
57235752 bp->stats_blk->stat_FwRxDrop =
drivers/net/bnx2.h+6−0
@@ -378,6 +378,9 @@ struct l2_fhdr { · 377 unmodified lines
378378 * pci_config_l definition
379379 * offset: 0000
380380 */
381+#define BNX2_PCICFG_MSI_CONTROL 0x00000058
382+#define BNX2_PCICFG_MSI_CONTROL_ENABLE (1L<<16)
383+
381384 #define BNX2_PCICFG_MISC_CONFIG 0x00000068
382385 #define BNX2_PCICFG_MISC_CONFIG_TARGET_BYTE_SWAP (1L<<2)
383386 #define BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP (1L<<3)
@@ -6863,6 +6866,9 @@ struct bnx2 { · 6479 unmodified lines
68636866
68646867 u8 num_tx_rings;
68656868 u8 num_rx_rings;
6869+
6870+ u32 idle_chk_status_idx;
6871+
68666872 };
68676873
68686874 #define REG_RD(bp, offset) \
drivers/net/enc28j60.c+14−2
@@ -568,6 +568,17 @@ static u16 erxrdpt_workaround(u16 next_packet_ptr, u16 start, u16 end) · 567 unmodified lines
568568 return erxrdpt;
569569 }
570570
571+/*
572+ * Calculate wrap around when reading beyond the end of the RX buffer
573+ */
574+static u16 rx_packet_start(u16 ptr)
575+{
576+ if (ptr + RSV_SIZE > RXEND_INIT)
577+ return (ptr + RSV_SIZE) - (RXEND_INIT - RXSTART_INIT + 1);
578+ else
579+ return ptr + RSV_SIZE;
580+}
581+
571582 static void nolock_rxfifo_init(struct enc28j60_net *priv, u16 start, u16 end)
572583 {
573584 u16 erxrdpt;
@@ -938,8 +949,9 @@ static void enc28j60_hw_rx(struct net_device *ndev) · 364 unmodified lines
938949 skb->dev = ndev;
939950 skb_reserve(skb, NET_IP_ALIGN);
940951 /* copy the packet from the receive buffer */
941− enc28j60_mem_read(priv, priv->next_pk_ptr + sizeof(rsv),
942− len, skb_put(skb, len));
952+ enc28j60_mem_read(priv,
953+ rx_packet_start(priv->next_pk_ptr),
954+ len, skb_put(skb, len));
943955 if (netif_msg_pktdata(priv))
944956 dump_packet(__func__, skb->len, skb->data);
945957 skb->protocol = eth_type_trans(skb, ndev);
drivers/net/netx-eth.c+2−0
@@ -401,6 +401,8 @@ static int netx_eth_drv_probe(struct platform_device *pdev) · 400 unmodified lines
401401 priv->xmac_base = priv->xc->xmac_base;
402402 priv->sram_base = priv->xc->sram_base;
403403
404+ spin_lock_init(&priv->lock);
405+
404406 ret = pfifo_request(PFIFO_MASK(priv->id));
405407 if (ret) {
406408 printk("unable to request PFIFO\n");
drivers/net/wireless/ipw2200.c+4−0
@@ -3897,6 +3897,7 @@ static int ipw_disassociate(void *data) · 3896 unmodified lines
38973897 if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
38983898 return 0;
38993899 ipw_send_disassociate(data, 0);
3900+ netif_carrier_off(priv->net_dev);
39003901 return 1;
39013902 }
39023903
@@ -10190,6 +10191,9 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb, · 6287 unmodified lines
1019010191 u16 remaining_bytes;
1019110192 int fc;
1019210193
10194+ if (!(priv->status & STATUS_ASSOCIATED))
10195+ goto drop;
10196+
1019310197 hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
1019410198 switch (priv->ieee->iw_mode) {
1019510199 case IW_MODE_ADHOC:
drivers/net/wireless/iwlwifi/iwl-core.c+3−0
@@ -290,6 +290,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv) · 289 unmodified lines
290290 priv->num_stations = 0;
291291 memset(priv->stations, 0, sizeof(priv->stations));
292292
293+ /* clean ucode key table bit map */
294+ priv->ucode_key_table = 0;
295+
293296 spin_unlock_irqrestore(&priv->sta_lock, flags);
294297 }
295298 EXPORT_SYMBOL(iwl_clear_stations_table);
drivers/net/wireless/iwlwifi/iwl-sta.c+21−3
@@ -475,7 +475,7 @@ static int iwl_get_free_ucode_key_index(struct iwl_priv *priv) · 474 unmodified lines
475475 if (!test_and_set_bit(i, &priv->ucode_key_table))
476476 return i;
477477
478− return -1;
478+ return WEP_INVALID_OFFSET;
479479 }
480480
481481 int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
@@ -620,6 +620,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv, · 138 unmodified lines
620620 /* else, we are overriding an existing key => no need to allocated room
621621 * in uCode. */
622622
623+ WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
624+ "no space for new kew");
625+
623626 priv->stations[sta_id].sta.key.key_flags = key_flags;
624627 priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
625628 priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
@@ -637,6 +640,7 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv, · 11 unmodified lines
637640 {
638641 unsigned long flags;
639642 __le16 key_flags = 0;
643+ int ret;
640644
641645 key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
642646 key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
@@ -664,14 +668,18 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv, · 21 unmodified lines
664668 /* else, we are overriding an existing key => no need to allocated room
665669 * in uCode. */
666670
671+ WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
672+ "no space for new kew");
673+
667674 priv->stations[sta_id].sta.key.key_flags = key_flags;
668675 priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
669676 priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
670677
678+ ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
679+
671680 spin_unlock_irqrestore(&priv->sta_lock, flags);
672681
673− IWL_DEBUG_INFO("hwcrypto: modify ucode station key info\n");
674− return iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
682+ return ret;
675683 }
676684
677685 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
@@ -696,6 +704,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv, · 18 unmodified lines
696704 /* else, we are overriding an existing key => no need to allocated room
697705 * in uCode. */
698706
707+ WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
708+ "no space for new kew");
709+
699710 /* This copy is acutally not needed: we get the key with each TX */
700711 memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
701712
@@ -734,6 +745,13 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv, · 32 unmodified lines
734745 return 0;
735746 }
736747
748+ if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
749+ IWL_WARNING("Removing wrong key %d 0x%x\n",
750+ keyconf->keyidx, key_flags);
751+ spin_unlock_irqrestore(&priv->sta_lock, flags);
752+ return 0;
753+ }
754+
737755 if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
738756 &priv->ucode_key_table))
739757 IWL_ERROR("index %d not used in uCode key table.\n",
drivers/net/wireless/zd1211rw/zd_mac.c+1−1
@@ -615,7 +615,7 @@ static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr, · 614 unmodified lines
615615 struct ieee80211_hdr *tx_hdr;
616616
617617 tx_hdr = (struct ieee80211_hdr *)skb->data;
618− if (likely(!compare_ether_addr(tx_hdr->addr2, rx_hdr->addr1)))
618+ if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
619619 {
620620 __skb_unlink(skb, q);
621621 tx_status(hw, skb, IEEE80211_TX_STAT_ACK, stats->signal, 1);
include/linux/can/core.h+1−1
@@ -19,7 +19,7 @@ · 18 unmodified lines
1919 #include <linux/skbuff.h>
2020 #include <linux/netdevice.h>
2121
22−#define CAN_VERSION "20071116"
22+#define CAN_VERSION "20081130"
2323
2424 /* increment this number each time you change some user-space interface */
2525 #define CAN_ABI_VERSION "8"
net/atm/svc.c+5−1
@@ -293,7 +293,10 @@ static int svc_listen(struct socket *sock,int backlog) · 292 unmodified lines
293293 error = -EINVAL;
294294 goto out;
295295 }
296− vcc_insert_socket(sk);
296+ if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
297+ error = -EADDRINUSE;
298+ goto out;
299+ }
297300 set_bit(ATM_VF_WAITING, &vcc->flags);
298301 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
299302 sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
@@ -307,6 +310,7 @@ static int svc_listen(struct socket *sock,int backlog) · 7 unmodified lines
307310 goto out;
308311 }
309312 set_bit(ATM_VF_LISTEN,&vcc->flags);
313+ vcc_insert_socket(sk);
310314 sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
311315 error = -sk->sk_err;
312316 out:
net/can/af_can.c+52−16
@@ -319,23 +319,52 @@ static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev) · 318 unmodified lines
319319 return n ? d : NULL;
320320 }
321321
322+/**
323+ * find_rcv_list - determine optimal filterlist inside device filter struct
324+ * @can_id: pointer to CAN identifier of a given can_filter
325+ * @mask: pointer to CAN mask of a given can_filter
326+ * @d: pointer to the device filter struct
327+ *
328+ * Description:
329+ * Returns the optimal filterlist to reduce the filter handling in the
330+ * receive path. This function is called by service functions that need
331+ * to register or unregister a can_filter in the filter lists.
332+ *
333+ * A filter matches in general, when
334+ *
335+ * <received_can_id> & mask == can_id & mask
336+ *
337+ * so every bit set in the mask (even CAN_EFF_FLAG, CAN_RTR_FLAG) describe
338+ * relevant bits for the filter.
339+ *
340+ * The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
341+ * filter for error frames (CAN_ERR_FLAG bit set in mask). For error frames
342+ * there is a special filterlist and a special rx path filter handling.
343+ *
344+ * Return:
345+ * Pointer to optimal filterlist for the given can_id/mask pair.
346+ * Constistency checked mask.
347+ * Reduced can_id to have a preprocessed filter compare value.
348+ */
322349 static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
323350 struct dev_rcv_lists *d)
324351 {
325352 canid_t inv = *can_id & CAN_INV_FILTER; /* save flag before masking */
326353
327− /* filter error frames */
354+ /* filter for error frames in extra filterlist */
328355 if (*mask & CAN_ERR_FLAG) {
329− /* clear CAN_ERR_FLAG in list entry */
356+ /* clear CAN_ERR_FLAG in filter entry */
330357 *mask &= CAN_ERR_MASK;
331358 return &d->rx[RX_ERR];
332359 }
333360
334− /* ensure valid values in can_mask */
335− if (*mask & CAN_EFF_FLAG)
336− *mask &= (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG);
337− else
338− *mask &= (CAN_SFF_MASK | CAN_RTR_FLAG);
361+ /* with cleared CAN_ERR_FLAG we have a simple mask/value filterpair */
362+
363+#define CAN_EFF_RTR_FLAGS (CAN_EFF_FLAG | CAN_RTR_FLAG)
364+
365+ /* ensure valid values in can_mask for 'SFF only' frame filtering */
366+ if ((*mask & CAN_EFF_FLAG) && !(*can_id & CAN_EFF_FLAG))
367+ *mask &= (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS);
339368
340369 /* reduce condition testing at receive time */
341370 *can_id &= *mask;
@@ -348,15 +377,19 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, · 6 unmodified lines
348377 if (!(*mask))
349378 return &d->rx[RX_ALL];
350379
351− /* use extra filterset for the subscription of exactly *ONE* can_id */
352− if (*can_id & CAN_EFF_FLAG) {
353− if (*mask == (CAN_EFF_MASK | CAN_EFF_FLAG)) {
354− /* RFC: a use-case for hash-tables in the future? */
355− return &d->rx[RX_EFF];
380+ /* extra filterlists for the subscription of a single non-RTR can_id */
381+ if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS)
382+ && !(*can_id & CAN_RTR_FLAG)) {
383+
384+ if (*can_id & CAN_EFF_FLAG) {
385+ if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) {
386+ /* RFC: a future use-case for hash-tables? */
387+ return &d->rx[RX_EFF];
388+ }
389+ } else {
390+ if (*mask == (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS))
391+ return &d->rx_sff[*can_id];
356392 }
357− } else {
358− if (*mask == CAN_SFF_MASK)
359− return &d->rx_sff[*can_id];
360393 }
361394
362395 /* default: filter via can_id/can_mask */
@@ -589,7 +622,10 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb) · 226 unmodified lines
589622 }
590623 }
591624
592− /* check CAN_ID specific entries */
625+ /* check filterlists for single non-RTR can_ids */
626+ if (can_id & CAN_RTR_FLAG)
627+ return matches;
628+
593629 if (can_id & CAN_EFF_FLAG) {
594630 hlist_for_each_entry_rcu(r, n, &d->rx[RX_EFF], list) {
595631 if (r->can_id == can_id) {
net/can/bcm.c+4−3
@@ -64,10 +64,11 @@ · 63 unmodified lines
6464 #define BCM_CAN_DLC_MASK 0x0F /* clean private flags in can_dlc by masking */
6565
6666 /* get best masking value for can_rx_register() for a given single can_id */
67−#define REGMASK(id) ((id & CAN_RTR_FLAG) | ((id & CAN_EFF_FLAG) ? \
68− (CAN_EFF_MASK | CAN_EFF_FLAG) : CAN_SFF_MASK))
67+#define REGMASK(id) ((id & CAN_EFF_FLAG) ? \
68+ (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
69+ (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
6970
70−#define CAN_BCM_VERSION "20080415"
71+#define CAN_BCM_VERSION CAN_VERSION
7172 static __initdata const char banner[] = KERN_INFO
7273 "can: broadcast manager protocol (rev " CAN_BCM_VERSION ")\n";
7374
net/ipv4/tcp_output.c+10−12
@@ -722,8 +722,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb) · 721 unmodified lines
722722 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
723723 unsigned int mss_now)
724724 {
725− if (skb->len <= mss_now || !sk_can_gso(sk) ||
726− tcp_urg_mode(tcp_sk(sk))) {
725+ if (skb->len <= mss_now || !sk_can_gso(sk)) {
727726 /* Avoid the costly divide in the normal
728727 * non-TSO case.
729728 */
@@ -1029,10 +1028,6 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu) · 299 unmodified lines
10291028
10301029 /* Compute the current effective MSS, taking SACKs and IP options,
10311030 * and even PMTU discovery events into account.
1032− *
1033− * LARGESEND note: !tcp_urg_mode is overkill, only frames up to snd_up
1034− * cannot be large. However, taking into account rare use of URG, this
1035− * is not a big flaw.
10361031 */
10371032 unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
10381033 {
@@ -1047,7 +1042,7 @@ unsigned int tcp_current_mss(struct sock *sk, int large_allowed) · 8 unmodified lines
10471042
10481043 mss_now = tp->mss_cache;
10491044
1050− if (large_allowed && sk_can_gso(sk) && !tcp_urg_mode(tp))
1045+ if (large_allowed && sk_can_gso(sk))
10511046 doing_tso = 1;
10521047
10531048 if (dst) {
@@ -1164,9 +1159,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, · 110 unmodified lines
11641159 {
11651160 int tso_segs = tcp_skb_pcount(skb);
11661161
1167− if (!tso_segs ||
1168− (tso_segs > 1 && (tcp_skb_mss(skb) != mss_now ||
1169− tcp_urg_mode(tcp_sk(sk))))) {
1162+ if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
11701163 tcp_set_skb_tso_segs(sk, skb, mss_now);
11711164 tso_segs = tcp_skb_pcount(skb);
11721165 }
@@ -1519,6 +1512,10 @@ static int tcp_mtu_probe(struct sock *sk) · 346 unmodified lines
15191512 * send_head. This happens as incoming acks open up the remote
15201513 * window for us.
15211514 *
1515+ * LARGESEND note: !tcp_urg_mode is overkill, only frames between
1516+ * snd_up-64k-mss .. snd_up cannot be large. However, taking into
1517+ * account rare use of URG, this is not a big flaw.
1518+ *
15221519 * Returns 1, if no segments are in flight and we have queued segments, but
15231520 * cannot send anything now because of SWS or another problem.
15241521 */
@@ -1570,7 +1567,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle) · 45 unmodified lines
15701567 }
15711568
15721569 limit = mss_now;
1573− if (tso_segs > 1)
1570+ if (tso_segs > 1 && !tcp_urg_mode(tp))
15741571 limit = tcp_mss_split_point(sk, skb, mss_now,
15751572 cwnd_quota);
15761573
@@ -1619,6 +1616,7 @@ void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss, · 42 unmodified lines
16191616 */
16201617 void tcp_push_one(struct sock *sk, unsigned int mss_now)
16211618 {
1619+ struct tcp_sock *tp = tcp_sk(sk);
16221620 struct sk_buff *skb = tcp_send_head(sk);
16231621 unsigned int tso_segs, cwnd_quota;
16241622
@@ -1633,7 +1631,7 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now) · 8 unmodified lines
16331631 BUG_ON(!tso_segs);
16341632
16351633 limit = mss_now;
1636− if (tso_segs > 1)
1634+ if (tso_segs > 1 && !tcp_urg_mode(tp))
16371635 limit = tcp_mss_split_point(sk, skb, mss_now,
16381636 cwnd_quota);
16391637
net/ipv4/tcp_vegas.c+2−0
@@ -326,6 +326,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight) · 325 unmodified lines
326326 tp->snd_cwnd = 2;
327327 else if (tp->snd_cwnd > tp->snd_cwnd_clamp)
328328 tp->snd_cwnd = tp->snd_cwnd_clamp;
329+
330+ tp->snd_ssthresh = tcp_current_ssthresh(sk);
329331 }
330332
331333 /* Wipe the slate clean for the next RTT. */
net/mac80211/sta_info.c+1−1
@@ -99,7 +99,7 @@ struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr) · 98 unmodified lines
9999
100100 sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
101101 while (sta) {
102− if (compare_ether_addr(sta->sta.addr, addr) == 0)
102+ if (memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
103103 break;
104104 sta = rcu_dereference(sta->hnext);
105105 }
net/netfilter/xt_socket.c+1−1
@@ -141,7 +141,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par) · 140 unmodified lines
141141 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
142142 saddr, daddr, sport, dport, par->in, false);
143143 if (sk != NULL) {
144− bool wildcard = (inet_sk(sk)->rcv_saddr == 0);
144+ bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0);
145145
146146 nf_tproxy_put_sock(sk);
147147 if (wildcard)
net/netlabel/netlabel_unlabeled.c+6−4
@@ -574,9 +574,10 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, · 573 unmodified lines
574574 list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
575575 &iface->addr4_list);
576576 spin_unlock(&netlbl_unlhsh_lock);
577− if (list_entry == NULL)
577+ if (list_entry != NULL)
578+ entry = netlbl_unlhsh_addr4_entry(list_entry);
579+ else
578580 ret_val = -ENOENT;
579− entry = netlbl_unlhsh_addr4_entry(list_entry);
580581
581582 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
582583 audit_info);
@@ -634,9 +635,10 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, · 51 unmodified lines
634635 spin_lock(&netlbl_unlhsh_lock);
635636 list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
636637 spin_unlock(&netlbl_unlhsh_lock);
637− if (list_entry == NULL)
638+ if (list_entry != NULL)
639+ entry = netlbl_unlhsh_addr6_entry(list_entry);
640+ else
638641 ret_val = -ENOENT;
639− entry = netlbl_unlhsh_addr6_entry(list_entry);
640642
641643 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
642644 audit_info);
net/phonet/pn_netlink.c+3−0
@@ -123,6 +123,7 @@ nla_put_failure: · 122 unmodified lines
123123
124124 static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
125125 {
126+ struct net *net = sock_net(skb->sk);
126127 struct phonet_device *pnd;
127128 int dev_idx = 0, dev_start_idx = cb->args[0];
128129 int addr_idx = 0, addr_start_idx = cb->args[1];
@@ -131,6 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb) · 2 unmodified lines
131132 list_for_each_entry(pnd, &pndevs.list, list) {
132133 u8 addr;
133134
135+ if (!net_eq(dev_net(pnd->netdev), net))
136+ continue;
134137 if (dev_idx > dev_start_idx)
135138 addr_start_idx = 0;
136139 if (dev_idx++ < dev_start_idx)
net/xfrm/xfrm_policy.c+1−0
@@ -817,6 +817,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info) · 816 unmodified lines
817817 continue;
818818 hlist_del(&pol->bydst);
819819 hlist_del(&pol->byidx);
820+ list_del(&pol->walk.all);
820821 write_unlock_bh(&xfrm_policy_lock);
821822
822823 xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t