kernel/linux.git/include/net, branch linux-2.6.16.y

[NET]: Generic checksum annotations and cleanups.

2008-01-21T00:14:18+00:00

Signed-off-by: Al Viro Signed-off-by: Adrian Bunk

[PKT_SCHED] RED: Fix overflow in calculation of queue average

2007-10-18T15:56:27+00:00

Overflow can occur very easily with 32 bits, e.g., with 1 second us_idle is approx. 2^20, which leaves only 11-Wlog bits for queue length. Since the EWMA exponent is typically around 9, queue lengths larger than 2^2 cause overflow. Whether the affected branch is taken when us_idle is as high as 1 second, depends on Scell_log, but with rather reasonable configuration Scell_log is large enough to cause p->Stab to have zero index, which always results zero shift (typically also few other small indices result in zero shift). Signed-off-by: Ilpo Järvinen Signed-off-by: Adrian Bunk

[IFB]: Fix crash on input device removal

2007-04-03T02:03:55+00:00

The input_device pointer is not refcounted, which means the device may disappear while packets are queued, causing a crash when ifb passes packets with a stale skb->dev pointer to netif_rx(). Fix by storing the interface index instead and do a lookup where neccessary. Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk

[NET_SCHED]: Fix endless loops caused by inaccurate qlen counters

2007-03-28T19:31:36+00:00

There are multiple problems related to qlen adjustment that can lead to an upper qdisc getting out of sync with the real number of packets queued, leading to endless dequeueing attempts by the upper layer code. All qdiscs must maintain an accurate q.qlen counter. There are basically two groups of operations affecting the qlen: operations that propagate down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the root qdisc and operations only affecting a subtree or single qdisc (change, graft, delete class). Since qlen changes during operations from the second group don't propagate to ancestor qdiscs, their qlen values become desynchronized. This patch adds a function to propagate qlen changes up the qdisc tree, optionally calling a callback function to perform qdisc-internal maintenance when the child qdisc is deactivated, and converts all qdiscs to use this where necessary. Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk

[INET]: twcal_jiffie should be unsigned long, not int

2007-03-08T07:19:00+00:00

Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[Bluetooth] Handle command complete event for exit periodic inquiry

2007-01-26T19:49:22+00:00

The command complete event of the exit periodic inquiry command must clear the HCI_INQUIRY flag and finish the HCI request. Signed-off-by: Marcel Holtmann Signed-off-by: Adrian Bunk

[IPX]: Annotate and fix IPX checksum

2006-11-24T02:03:34+00:00

Calculation of IPX checksum got buggered about 2.4.0. The old variant mangled the packet; that got fixed, but calculation itself got buggered. Restored the correct logics, fixed a subtle breakage we used to have even back then: if the sum is 0 mod 0xffff, we want to return 0, not 0xffff. The latter has special meaning for IPX (cheksum disabled). Observation (and obvious fix) nicked from history of FreeBSD ipx_cksum.c... Signed-off-by: Al Viro Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

SCTP: Reject sctp packets with broadcast addresses.

2006-08-26T00:39:03+00:00

Make SCTP handle broadcast properly Signed-off-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

Fix sctp privilege elevation (CVE-2006-3745)

2006-08-23T16:01:55+00:00

sctp_make_abort_user() now takes the msg_len along with the msg so that we don't have to recalculate the bytes in iovec. It also uses memcpy_fromiovec() so that we don't go beyond the length allocated. It is good to have this fix even if verify_iovec() is fixed to return error on overflow. Signed-off-by: Sridhar Samudrala Acked-by: David Miller Signed-off-by: Adrian Bunk

[PATCH] SCTP: Respect the real chunk length when walking parameters (CVE-2006-1858)

2006-05-20T22:00:34+00:00

When performing bound checks during the parameter processing, we want to use the real chunk and paramter lengths for bounds instead of the rounded ones. This prevents us from potentially walking of the end if the chunk length was miscalculated. We still use rounded lengths when advancing the pointer. This was found during a conformance test that changed the chunk length without modifying parameters. (Vlad noted elsewhere: the most you'd overflow is 3 bytes, so problem is parameter dependent). Signed-off-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: Chris Wright