Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c723d26 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: Remove redundant NULL checks before [kv]free
  unaligned access in sk_run_filter()
  [IPV6]: Clean up hop-by-hop options handler.
  [IPV6] XFRM: Fix decoding session with preceding extension header(s).
  [IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull().
  [IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.
  [TCP]: Fix truesize underflow
parents a196e788 63903ca6

include/net/ipv6.h

+1 −1
Original line number Diff line number Diff line
@@ -230,7 +230,7 @@ extern int ip6_ra_control(struct sock *sk, int sel, 
					       void (*destructor)(struct sock *));





extern int			ipv6_parse_hopopts(struct sk_buff *skb, int);

extern int			ipv6_parse_hopopts(struct sk_buff *skb);



extern struct ipv6_txoptions *  ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt);

extern struct ipv6_txoptions *	ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,

net/core/filter.c

+3 −2
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ 
#include <linux/timer.h>

#include <asm/system.h>

#include <asm/uaccess.h>

#include <asm/unaligned.h>

#include <linux/filter.h>



/* No hurry in this branch */
@@ -177,7 +178,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int 
load_w:

			ptr = load_pointer(skb, k, 4, &tmp);

			if (ptr != NULL) {

				A = ntohl(*(u32 *)ptr);

				A = ntohl(get_unaligned((u32 *)ptr));

				continue;

			}

			break;
@@ -186,7 +187,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int 
load_h:

			ptr = load_pointer(skb, k, 2, &tmp);

			if (ptr != NULL) {

				A = ntohs(*(u16 *)ptr);

				A = ntohs(get_unaligned((u16 *)ptr));

				continue;

			}

			break;

net/ipv4/ipcomp.c

+2 −5
Original line number Diff line number Diff line
@@ -290,11 +290,8 @@ static void ipcomp_free_scratches(void) 
	if (!scratches)

		return;



	for_each_possible_cpu(i) {

		void *scratch = *per_cpu_ptr(scratches, i);

		if (scratch)

			vfree(scratch);

	}

	for_each_possible_cpu(i)

		vfree(*per_cpu_ptr(scratches, i));



	free_percpu(scratches);

}

net/ipv4/tcp_output.c

+3 −1
Original line number Diff line number Diff line
@@ -551,7 +551,9 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss 
	buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);

	if (buff == NULL)

		return -ENOMEM; /* We'll just try again later. */

	sk_charge_skb(sk, buff);



	buff->truesize = skb->len - len;

	skb->truesize -= buff->truesize;



	/* Correct the sequence numbers. */

	TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;

net/ipv6/exthdrs.c

+14 −2
Original line number Diff line number Diff line
@@ -485,15 +485,27 @@ static struct tlvtype_proc tlvprochopopt_lst[] = { 
	{ -1, }

};



int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)

int ipv6_parse_hopopts(struct sk_buff *skb)

{

	struct inet6_skb_parm *opt = IP6CB(skb);



	/*

	 * skb->nh.raw is equal to skb->data, and

	 * skb->h.raw - skb->nh.raw is always equal to

	 * sizeof(struct ipv6hdr) by definition of

	 * hop-by-hop options.

	 */

	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||

	    !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {

		kfree_skb(skb);

		return -1;

	}



	opt->hop = sizeof(struct ipv6hdr);

	if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {

		skb->h.raw += (skb->h.raw[1]+1)<<3;

		opt->nhoff = sizeof(struct ipv6hdr);

		return sizeof(struct ipv6hdr);

		return 1;

	}

	return -1;

}