rpms/kernel/F-7 linux-2.6-net-fix-panic-removing-teql-devices.patch, NONE, 1.1 linux-2.6-net-l2tp-fix-oops-in-xmit-receive.patch, NONE, 1.1 kernel-2.6.spec, 1.3374, 1.3375
Chuck Ebbert (cebbert)
fedora-extras-commits at redhat.com
Fri Nov 9 20:38:21 UTC 2007
Author: cebbert
Update of /cvs/pkgs/rpms/kernel/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv32031
Modified Files:
kernel-2.6.spec
Added Files:
linux-2.6-net-fix-panic-removing-teql-devices.patch
linux-2.6-net-l2tp-fix-oops-in-xmit-receive.patch
Log Message:
* Fri Nov 09 2007 Chuck Ebbert <cebbert at redhat.com>
- Fix oopses in the networking code (l2tp, teql).
linux-2.6-net-fix-panic-removing-teql-devices.patch:
--- NEW FILE linux-2.6-net-fix-panic-removing-teql-devices.patch ---
From: Evgeniy Polyakov <johnpol at 2ka.mipt.ru>
Date: Tue, 6 Nov 2007 11:08:09 +0000 (-0800)
Subject: [PKT_SCHED]: Fix OOPS when removing devices from a teql queuing discipline
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=4f9f8311a08c0d95c70261264a2b47f2ae99683a
[PKT_SCHED]: Fix OOPS when removing devices from a teql queuing discipline
tecl_reset() is called from deactivate and qdisc is set to noop already,
but subsequent teql_xmit does not know about it and dereference private
data as teql qdisc and thus oopses.
not catch it first :)
Signed-off-by: Evgeniy Polyakov <johnpol at 2ka.mipt.ru>
Signed-off-by: David S. Miller <davem at davemloft.net>
---
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 421281d..c0ed06d 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -252,6 +252,9 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
static __inline__ int
teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
{
+ if (dev->qdisc == &noop_qdisc)
+ return -ENODEV;
+
if (dev->hard_header == NULL ||
skb->dst == NULL ||
skb->dst->neighbour == NULL)
linux-2.6-net-l2tp-fix-oops-in-xmit-receive.patch:
--- NEW FILE linux-2.6-net-l2tp-fix-oops-in-xmit-receive.patch ---
From: James Chapman <jchapman at katalix.com>
Date: Tue, 6 Nov 2007 07:32:37 +0000 (-0800)
Subject: [PPP]: L2TP: Fix oops in transmit and receive paths
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=91781004b9c029ee55b7aa9ef950a373ba865dc6
[PPP]: L2TP: Fix oops in transmit and receive paths
Changes made on 18-sep to fix skb handling in the pppol2tp driver
broke the transmit and receive paths. Users are only running into this
now because distros are now using 2.6.23 and I must have messed up
when I tested the change.
For receive, we now do our own calculation of how much to pull from
the skb (variable length L2TP header) rather than using
skb_transport_offset(). Also, if the skb isn't a data packet, it must
be passed back to UDP with skb->data pointing to the UDP header.
For transmit, make sure skb->sk is set up because ip_queue_xmit()
needs it.
Signed-off-by: James Chapman <jchapman at katalix.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
---
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index f8904fd..a7556cd 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -488,7 +488,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
{
struct pppol2tp_session *session = NULL;
struct pppol2tp_tunnel *tunnel;
- unsigned char *ptr;
+ unsigned char *ptr, *optr;
u16 hdrflags;
u16 tunnel_id, session_id;
int length;
@@ -496,7 +496,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
tunnel = pppol2tp_sock_to_tunnel(sock);
if (tunnel == NULL)
- goto error;
+ goto no_tunnel;
/* UDP always verifies the packet length. */
__skb_pull(skb, sizeof(struct udphdr));
@@ -509,7 +509,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
}
/* Point to L2TP header */
- ptr = skb->data;
+ optr = ptr = skb->data;
/* Get L2TP header flags */
hdrflags = ntohs(*(__be16*)ptr);
@@ -637,12 +637,14 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
/* If offset bit set, skip it. */
if (hdrflags & L2TP_HDRFLAG_O) {
offset = ntohs(*(__be16 *)ptr);
- skb->transport_header += 2 + offset;
- if (!pskb_may_pull(skb, skb_transport_offset(skb) + 2))
- goto discard;
+ ptr += 2 + offset;
}
- __skb_pull(skb, skb_transport_offset(skb));
+ offset = ptr - optr;
+ if (!pskb_may_pull(skb, offset))
+ goto discard;
+
+ __skb_pull(skb, offset);
/* Skip PPP header, if present. In testing, Microsoft L2TP clients
* don't send the PPP header (PPP header compression enabled), but
@@ -652,6 +654,9 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
* Note that skb->data[] isn't dereferenced from a u16 ptr here since
* the field may be unaligned.
*/
+ if (!pskb_may_pull(skb, 2))
+ goto discard;
+
if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
skb_pull(skb, 2);
@@ -709,6 +714,10 @@ discard:
return 0;
error:
+ /* Put UDP header back */
+ __skb_push(skb, sizeof(struct udphdr));
+
+no_tunnel:
return 1;
}
@@ -1050,6 +1059,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
/* Get routing info from the tunnel socket */
dst_release(skb->dst);
skb->dst = sk_dst_get(sk_tun);
+ skb_orphan(skb);
+ skb->sk = sk_tun;
/* Queue the packet to IP for output */
len = skb->len;
Index: kernel-2.6.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-7/kernel-2.6.spec,v
retrieving revision 1.3374
retrieving revision 1.3375
diff -u -r1.3374 -r1.3375
--- kernel-2.6.spec 9 Nov 2007 20:00:59 -0000 1.3374
+++ kernel-2.6.spec 9 Nov 2007 20:37:45 -0000 1.3375
@@ -567,6 +567,8 @@
Patch428: linux-2.6-cifs-fix-bad-handling-of-EAGAIN.patch
Patch430: linux-2.6-net-silence-noisy-printks.patch
+Patch431: linux-2.6-net-fix-panic-removing-teql-devices.patch
+Patch432: linux-2.6-net-l2tp-fix-oops-in-xmit-receive.patch
Patch440: linux-2.6-sha_alignment.patch
Patch450: linux-2.6-input-kill-stupid-messages.patch
@@ -1222,6 +1224,9 @@
# Networking
# Disable easy to trigger printk's.
ApplyPatch linux-2.6-net-silence-noisy-printks.patch
+# fix two oopses in network code
+ApplyPatch linux-2.6-net-fix-panic-removing-teql-devices.patch
+ApplyPatch linux-2.6-net-l2tp-fix-oops-in-xmit-receive.patch
# Misc fixes
# Fix SHA1 alignment problem on ia64
@@ -2282,6 +2287,9 @@
%changelog
* Fri Nov 09 2007 Chuck Ebbert <cebbert at redhat.com>
+- Fix oopses in the networking code (l2tp, teql).
+
+* Fri Nov 09 2007 Chuck Ebbert <cebbert at redhat.com>
- Update utrace, fixing some powerpc bugs.
- Disable precise scheduler CPU accounting (#340161).
More information about the fedora-extras-commits
mailing list