kernel/linux.git/net, branch v3.0.6

cfg80211: Fix validation of AKM suites

2011-10-03T18:41:10+00:00

commit 1b9ca0272ffae212e726380f66777b30a56ed7a5 upstream. Incorrect variable was used in validating the akm_suites array from NL80211_ATTR_AKM_SUITES. In addition, there was no explicit validation of the array length (we only have room for NL80211_MAX_NR_AKM_SUITES). This can result in a buffer write overflow for stack variables with arbitrary data from user space. The nl80211 commands using the affected functionality require GENL_ADMIN_PERM, so this is only exposed to admin users. Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix timeout on scanning for the second time

2011-10-03T18:41:01+00:00

commit 2d20a26a92f72e3bb658fe8ce99c3663756e9e7a upstream. The checks for HCI_INQUIRY and HCI_MGMT were in the wrong order, so that second scans always failed. Signed-off-by: Oliver Neukum Signed-off-by: Gustavo F. Padovan Signed-off-by: Greg Kroah-Hartman

bridge: fix a possible use after free

2011-10-03T18:40:56+00:00

[ Upstream commit 22df13319d1fec30b8f9bcaadc295829647109bb ] br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb head can be reallocated. Cache icmp6_type field instead of dereferencing twice the struct icmp6hdr pointer. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

bridge: Pseudo-header required for the checksum of ICMPv6

2011-10-03T18:40:56+00:00

[ Upstream commit 4b275d7efa1c4412f0d572fcd7f78ed0919370b3 ] Checksum of ICMPv6 is not properly computed because the pseudo header is not used. Thus, the MLD packet gets dropped by the bridge. Signed-off-by: Zheng Yan Reported-by: Ang Way Chuang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

xfrm: Perform a replay check after return from async codepaths

2011-10-03T18:40:55+00:00

[ Upstream commit bcf66bf54aabffc150acd1c99e0f4bc51935eada ] When asyncronous crypto algorithms are used, there might be many packets that passed the xfrm replay check, but the replay advance function is not called yet for these packets. So the replay check function would accept a replay of all of these packets. Also the system might crash if there are more packets in async processing than the size of the anti replay window, because the replay advance function would try to update the replay window beyond the bounds. This pach adds a second replay check after resuming from the async processing to fix these issues. Signed-off-by: Steffen Klassert Acked-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

vlan: reset headers on accel emulation path

2011-10-03T18:40:55+00:00

[ Upstream commit c5114cd59d2664f258b0d021d79b1532d94bdc2b ] It's after all necessary to do reset headers here. The reason is we cannot depend that it gets reseted in __netif_receive_skb once skb is reinjected. For incoming vlanids without vlan_dev, vlan_do_receive() returns false with skb != NULL and __netif_reveive_skb continues, skb is not reinjected. This might be good material for 3.0-stable as well Reported-by: Mike Auty Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

tcp: initialize variable ecn_ok in syncookies path

2011-10-03T18:40:54+00:00

[ Upstream commit f0e3d0689da401f7d1981c2777a714ba295ea5ff ] Using a gcc 4.4.3, warnings are emitted for a possibly uninitialized use of ecn_ok. This can happen if cookie_check_timestamp() returns due to not having seen a timestamp. Defaulting to ecn off seems like a reasonable thing to do in this case, so initialized ecn_ok to false. Signed-off-by: Mike Waychison Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

tcp: fix validation of D-SACK

2011-10-03T18:40:54+00:00

[ Upstream commit f779b2d60ab95c17f1e025778ed0df3ec2f05d75 ] D-SACK is allowed to reside below snd_una. But the corresponding check in tcp_is_sackblock_valid() is the exact opposite. It looks like a typo. Signed-off-by: Zheng Yan Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

scm: Capture the full credentials of the scm sender

2011-10-03T18:40:54+00:00

[ Upstream commit e33f7a9f37d486f4c6cce5de18a6eea11d68f64f ] This patch corrects an erroneous update of credential's gid with uid introduced in commit 257b5358b32f17 since 2.6.36. Signed-off-by: Tim Chen Acked-by: Eric Dumazet Reviewed-by: James Morris Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

net_sched: prio: use qdisc_dequeue_peeked

2011-10-03T18:40:53+00:00

[ Upstream commit 3557619f0f6f7496ed453d4825e24958ab1884e0 ] commit 07bd8df5df4369487812bf85a237322ff3569b77 (sch_sfq: fix peek() implementation) changed sfq to use generic peek helper. This makes HFSC complain about a non-work-conserving child qdisc, if prio with sfq child is used within hfsc: hfsc peeks into prio qdisc, which will then peek into sfq. returned skb is stashed in sch->gso_skb. Next, hfsc tries to dequeue from prio, but prio will call sfq dequeue directly, which may return NULL instead of previously peeked-at skb. Have prio call qdisc_dequeue_peeked, so sfq->dequeue() is not called in this case. Cc: Eric Dumazet Signed-off-by: Florian Westphal Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman