aboutsummaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)AuthorFilesLines
2011-03-10net: don't allow CAP_NET_ADMIN to load non-netdev kernel modulesVasiliy Kulikov4-5/+13
Since a8f80e8ff94ecba629542d9b4b5f5a8ee3eb565c any process with CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't allow anybody load any module not related to networking. This patch restricts an ability of autoloading modules to netdev modules with explicit aliases. This fixes CVE-2011-1019. Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior of loading netdev modules by name (without any prefix) for processes with CAP_SYS_MODULE to maintain the compatibility with network scripts that use autoloading netdev modules by aliases like "eth0", "wlan0". Currently there are only three users of the feature in the upstream kernel: ipip, ip_gre and sit. root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) -- root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: fffffff800001000 CapEff: fffffff800001000 CapBnd: fffffff800001000 root@albatros:~# modprobe xfs FATAL: Error inserting xfs (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted root@albatros:~# lsmod | grep xfs root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit sit: error fetching interface information: Device not found root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit0 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 root@albatros:~# lsmod | grep sit sit 10457 0 tunnel4 2957 1 sit For CAP_SYS_MODULE module loading is still relaxed: root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: ffffffffffffffff CapEff: ffffffffffffffff CapBnd: ffffffffffffffff root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs xfs 745319 0 Reference: https://lkml.org/lkml/2011/2/24/203 Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: Michael Tokarev <[email protected]> Acked-by: David S. Miller <[email protected]> Acked-by: Kees Cook <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-03-09pktgen: fix errata in show resultsDaniel Turull1-1/+1
The units in show_results in pktgen were not correct. The results are in usec but it was displayed nsec. Reported-by: Jong-won Lee <[email protected]> Signed-off-by: Daniel Turull <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09tcp: ioctl type SIOCOUTQNSD returns amount of data not sentMario Schuknecht1-0/+9
In contrast to SIOCOUTQ which returns the amount of data sent but not yet acknowledged plus data not yet sent this patch only returns the data not sent. For various methods of live streaming bitrate control it may be helpful to know how much data are in the tcp outqueue are not sent yet. Signed-off-by: Mario Schuknecht <[email protected]> Signed-off-by: Steffen Sledz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09ipv4: Lookup multicast routes by rtable using helper.David S. Miller1-42/+28
Create a common helper for this operation, since we do it identically in three spots. Suggested by Eric Dumazet. Signed-off-by: David S. Miller <[email protected]>
2011-03-09ipv4: Fix erroneous uses of ifa_address.David S. Miller1-3/+3
In usual cases ifa_address == ifa_local, but in the case where SIOCSIFDSTADDR sets the destination address on a point-to-point link, ifa_address gets set to that destination address. Therefore we should use ifa_local when we want the local interface address. There were two cases where the selection was done incorrectly: 1) When devinet_ioctl() does matching, it checks ifa_address even though gifconf correct reported ifa_local to the user 2) IN_DEV_ARP_NOTIFY handling sends a gratuitous ARP using ifa_address instead of ifa_local. Reported-by: Julian Anastasov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09mac80211: update minstrel_ht sample rate when probe is setDaniel Halperin1-10/+5
Waiting until the status is received can cause the same rate to be probed multiple times consecutively. Cc: Felix Fietkau <[email protected]> Signed-off-by: Daniel Halperin <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-03-09net/wireless: add COUNTRY to to regulatory device ueventScott James Remnant2-11/+29
Regulatory devices issue change uevents to inform userspace of a need to call the crda tool; however these can often be sent before udevd is running, and were not previously included in the results of udevadm trigger (which requests a new change event using the /uevent attribute of the sysfs object). Add a uevent function to the device type which includes the COUNTRY information from the last request if it has yet to be processed, the case of multiple requests is already handled in the code by checking whether an unprocessed one is queued in the same manner and refusing to queue a new one. The existing udev rule continues to work as before. Signed-off-by: Scott James Remnant <[email protected]> Acked-By: Kay Sievers <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-03-09Phonet: kill the ST-Ericsson pipe controller KconfigRémi Denis-Courmont2-37/+0
This is now a run-time choice so that a single kernel can support both old and new generation ISI modems. Support for manually enabling the pipe flow is removed as it did not work properly, does not fit well with the socket API, and I am not aware of any use at the moment. Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: support active connection without pipe controller on modemRémi Denis-Courmont2-133/+141
This provides support for newer ISI modems with no need for the earlier experimental compile-time alternative choice. With this, we can now use the same kernel and userspace with both types of modems. This also avoids confusing two different and incompatible state machines, actively connected vs accepted sockets, and adds connection response error handling (processing "SYN/RST" of sorts). Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: provide pipe socket option to retrieve the pipe identifierRémi Denis-Courmont1-8/+7
User-space sometimes needs this information. In particular, the GPRS context or the AT commands pipe setups may use the pipe handle as a reference. This removes the settable pipe handle with CONFIG_PHONET_PIPECTRLR. It did not handle error cases correctly. Furthermore, the kernel *could* implement a smart scheme for allocating handles (if ever needed), but userspace really cannot. Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: allocate sock from accept syscall rather than soft IRQRémi Denis-Courmont2-173/+121
This moves most of the accept logic to process context like other socket stacks do. Then we can use a few more common socket helpers and simplify a bit. Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: factor common code to send control messagesRémi Denis-Courmont1-152/+73
With the addition of the pipe controller, there is now quite a bit of repetitive code for small signaling messages. Lets factor it. Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: correct pipe backlog callback return valuesRémi Denis-Courmont1-14/+11
In some cases, the Phonet pipe backlog callbacks returned negative errno instead of NET_RX_* values. In other cases, NET_RX_DROP was returned for invalid packets, even though it seems only intended for buffering problems (not for deliberately discarded packets). Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: return an error when packet TX failsRémi Denis-Courmont1-5/+3
Phonet assumes that packets are never dropped. We try our best to avoid this situation. But lets return ENOBUFS if queueing to the network device fails so that the caller knows things went wrong. Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09Phonet: fix NULL dereference on TX path with implicit sourceRémi Denis-Courmont1-3/+2
The previous Phonet patch series introduced per-socket implicit destination (i.e. connect()). In that case, the destination socket address is NULL in the transmit function. However commit a8059512b120362b15424f152b2548fe8b11bd0c ("Phonet: implement per-socket destination/peer address") is incomplete and would trigger a NULL dereference. (Fortunately, the code is not in released kernel, and in fact currently not reachable.) Signed-off-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-09netfilter: x_tables: misuse of try_then_request_moduleStephen Hemminger1-7/+15
Since xt_find_match() returns ERR_PTR(xx) on error not NULL, the macro try_then_request_module won't work correctly here. The macro expects its first argument will be zero if condition fails. But ERR_PTR(-ENOENT) is not zero. The correct solution is to propagate the error value back. Found by inspection, and compile tested only. Signed-off-by: Stephen Hemminger <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2011-03-08inetpeer: Don't disable BH for initial fast RCU lookup.David S. Miller1-9/+9
If modifications on other cpus are ok, then modifications to the tree during lookup done by the local cpu are ok too. Signed-off-by: David S. Miller <[email protected]>
2011-03-08dsa/mv88e6060: support nonzero mii base addressPeter Korsgaard1-3/+4
The mv88e6060 uses either the lower 16 or upper 16 mii addresses, depending on the value of the EE_CLK/ADDR4 pin. Support both configurations by using the sw_addr setting as base address. Signed-off-by: Peter Korsgaard <[email protected]> Acked-by: Lennert Buytenhek <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-08rds: prevent BUG_ON triggering on congestion map updatesNeil Horman2-4/+12
Recently had this bug halt reported to me: kernel BUG at net/rds/send.c:329! Oops: Exception in kernel mode, sig: 5 [#1] SMP NR_CPUS=1024 NUMA pSeries Modules linked in: rds sunrpc ipv6 dm_mirror dm_region_hash dm_log ibmveth sg ext4 jbd2 mbcache sd_mod crc_t10dif ibmvscsic scsi_transport_srp scsi_tgt dm_mod [last unloaded: scsi_wait_scan] NIP: d000000003ca68f4 LR: d000000003ca67fc CTR: d000000003ca8770 REGS: c000000175cab980 TRAP: 0700 Not tainted (2.6.32-118.el6.ppc64) MSR: 8000000000029032 <EE,ME,CE,IR,DR> CR: 44000022 XER: 00000000 TASK = c00000017586ec90[1896] 'krdsd' THREAD: c000000175ca8000 CPU: 0 GPR00: 0000000000000150 c000000175cabc00 d000000003cb7340 0000000000002030 GPR04: ffffffffffffffff 0000000000000030 0000000000000000 0000000000000030 GPR08: 0000000000000001 0000000000000001 c0000001756b1e30 0000000000010000 GPR12: d000000003caac90 c000000000fa2500 c0000001742b2858 c0000001742b2a00 GPR16: c0000001742b2a08 c0000001742b2820 0000000000000001 0000000000000001 GPR20: 0000000000000040 c0000001742b2814 c000000175cabc70 0800000000000000 GPR24: 0000000000000004 0200000000000000 0000000000000000 c0000001742b2860 GPR28: 0000000000000000 c0000001756b1c80 d000000003cb68e8 c0000001742b27b8 NIP [d000000003ca68f4] .rds_send_xmit+0x4c4/0x8a0 [rds] LR [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] Call Trace: [c000000175cabc00] [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] (unreliable) [c000000175cabd30] [d000000003ca7e64] .rds_send_worker+0x54/0x100 [rds] [c000000175cabdb0] [c0000000000b475c] .worker_thread+0x1dc/0x3c0 [c000000175cabed0] [c0000000000baa9c] .kthread+0xbc/0xd0 [c000000175cabf90] [c000000000032114] .kernel_thread+0x54/0x70 Instruction dump: 4bfffd50 60000000 60000000 39080001 935f004c f91f0040 41820024 813d017c 7d094a78 7d290074 7929d182 394a0020 <0b090000> 40e2ff68 4bffffa4 39200000 Kernel panic - not syncing: Fatal exception Call Trace: [c000000175cab560] [c000000000012e04] .show_stack+0x74/0x1c0 (unreliable) [c000000175cab610] [c0000000005a365c] .panic+0x80/0x1b4 [c000000175cab6a0] [c00000000002fbcc] .die+0x21c/0x2a0 [c000000175cab750] [c000000000030000] ._exception+0x110/0x220 [c000000175cab910] [c000000000004b9c] program_check_common+0x11c/0x180 Signed-off-by: David S. Miller <[email protected]>
2011-03-08Merge branch 'master' of ↵David S. Miller1-0/+14
master.kernel.org:/pub/scm/linux/kernel/git/jkirsher/net-next-2.6
2011-03-08ipv4: Fix scope value used in route src-address caching.David S. Miller1-2/+3
We have to use cfg->fc_scope not the final nh_scope value. Reported-by: Julian Anastasov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-08netfilter: ipset: fix the compile warning in ip_set_createShan Wei1-1/+1
net/netfilter/ipset/ip_set_core.c:615: warning: ‘clash’ may be used uninitialized in this function Signed-off-by: Shan Wei <[email protected]> Signed-off-by: Jozsef Kadlecsik <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2011-03-07ipv4: Cache source address in nexthop entries.David S. Miller2-7/+26
When doing output route lookups, we have to select the source address if the user has not specified an explicit one. First, if the route has an explicit preferred source address specified, then we use that. Otherwise we search the route's outgoing interface for a suitable address. This search can be precomputed and cached at route insertion time. The only missing part is that we have to refresh this precomputed value any time addresses are added or removed from the interface, and this is accomplished by fib_update_nh_saddrs(). Signed-off-by: David S. Miller <[email protected]>
2011-03-07vlan: add support to ndo_fcoe_ddp_target()Yi Zou1-0/+14
Add the new target ddp offload support ndo_fcoe_ddp_target(). Signed-off-by: Yi Zou <[email protected]> Signed-off-by: Kiran Patil <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]>
2011-03-08KEYS: Add a key type op to permit the key description to be vettedDavid Howells1-0/+19
Add a key type operation to permit the key type to vet the description of a new key that key_alloc() is about to allocate. The operation may reject the description if it wishes with an error of its choosing. If it does this, the key will not be allocated. Signed-off-by: David Howells <[email protected]> Reviewed-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2011-03-07af_unix: remove unused struct sockaddr_un cruftHagen Paul Pfeifer1-2/+0
Signed-off-by: Hagen Paul Pfeifer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07sctp: several declared/set but unused fixesHagen Paul Pfeifer6-18/+1
Signed-off-by: Hagen Paul Pfeifer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07af_packet: struct socket declared/assigned but unusedHagen Paul Pfeifer1-3/+0
Signed-off-by: Hagen Paul Pfeifer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07mcast: net_device dev not usedHagen Paul Pfeifer1-6/+0
ip6_mc_source(), ip6_mc_msfilter() as well as ip6_mc_msfget() declare and assign dev but do not use the variable afterwards. Signed-off-by: Hagen Paul Pfeifer <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07net: allow handlers to be processed for orig_devJiri Pirko1-1/+2
This was there before, I forgot about this. Allows deliveries to ptype_base handlers registered for orig_dev. I presume this is still desired. Signed-off-by: Jiri Pirko <[email protected]> Reviewed-by: Nicolas de Pesloüan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07net: fix multithreaded signal handling in unix recv routinesRainer Weikusat1-4/+13
The unix_dgram_recvmsg and unix_stream_recvmsg routines in net/af_unix.c utilize mutex_lock(&u->readlock) calls in order to serialize read operations of multiple threads on a single socket. This implies that, if all n threads of a process block in an AF_UNIX recv call trying to read data from the same socket, one of these threads will be sleeping in state TASK_INTERRUPTIBLE and all others in state TASK_UNINTERRUPTIBLE. Provided that a particular signal is supposed to be handled by a signal handler defined by the process and that none of this threads is blocking the signal, the complete_signal routine in kernel/signal.c will select the 'first' such thread it happens to encounter when deciding which thread to notify that a signal is supposed to be handled and if this is one of the TASK_UNINTERRUPTIBLE threads, the signal won't be handled until the one thread not blocking on the u->readlock mutex is woken up because some data to process has arrived (if this ever happens). The included patch fixes this by changing mutex_lock to mutex_lock_interruptible and handling possible error returns in the same way interruptions are handled by the actual receive-code. Signed-off-by: Rainer Weikusat <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07ipv4: Inline fib_semantic_match into check_leafDavid S. Miller3-75/+51
This elimiates a lot of pure overhead due to parameter passing. Signed-off-by: David S. Miller <[email protected]>
2011-03-07ipv4: Validate route entry type at insert instead of every lookup.David S. Miller1-26/+28
fib_semantic_match() requires that if the type doesn't signal an automatic error, it must be of type RTN_UNICAST, RTN_LOCAL, RTN_BROADCAST, RTN_ANYCAST, or RTN_MULTICAST. Checking this every route lookup is pointless work. Instead validate it during route insertion, via fib_create_info(). Also, there was nothing making sure the type value was less than RTN_MAX, so add that missing check while we're here. Signed-off-by: David S. Miller <[email protected]>
2011-03-07net: Enter net/ipv6/ even if CONFIG_IPV6=nThomas Graf1-3/+1
exthdrs_core.c and addrconf_core.c in net/ipv6/ contain bits which must be made available even if IPv6 is disabled. net/ipv6/Makefile already correctly includes them if CONFIG_IPV6=n but net/Makefile prevents entering the subdirectory. Signed-off-by: Thomas Graf <[email protected]> Acked-by: Randy Dunlap <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-03-07mac80211: fix scan race, simplify codeJohannes Berg1-40/+24
The scan code has a race that Michael reported he ran into, but it's easy to fix while at the same time simplifying the code. The race resulted in the following warning: ------------[ cut here ]------------ WARNING: at net/mac80211/scan.c:310 ieee80211_rx_bss_free+0x20c/0x4b8 [mac80211]() Modules linked in: [...] [<c0033edc>] (unwind_backtrace+0x0/0xe0) from [<c004f2a4>] (warn_slowpath_common+0x4c/0x64) [... backtrace wasn't useful ...] Reported-by: Michael Buesch <[email protected]> Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-03-07mac80211: Add log message to ieee80211_restart_hw()Michael Buesch1-0/+3
Add a log message to ieee80211_restart_hw() to highlight that special codepath in the logs. This helps debugging bugs in the rarely tested restart code. Signed-off-by: Michael Buesch <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-03-07mac80211: remove unused macrosShan Wei3-5/+0
Compile test only. Signed-off-by: Shan Wei <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-03-07Merge branch 'batman-adv/next' of git://git.open-mesh.org/ecsv/linux-mergeDavid S. Miller24-1232/+1634
2011-03-05Merge branch 'for-linus' of ↵Linus Torvalds2-22/+67
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: no .snap inside of snapped namespace libceph: fix msgr standby handling libceph: fix msgr keepalive flag libceph: fix msgr backoff libceph: retry after authorization failure libceph: fix handling of short returns from get_user_pages ceph: do not clear I_COMPLETE from d_release ceph: do not set I_COMPLETE Revert "ceph: keep reference to parent inode on ceph_dentry"
2011-03-05batman-adv: Disallow regular interface as mesh deviceSven Eckelmann3-12/+36
When trying to associate a net_device with another net_device which already exists, batman-adv assumes that this interface is a fully initialized batman mesh interface without checking it. The behaviour when accessing data behind netdev_priv of a random net_device is undefined and potentially dangerous. Reported-by: Linus Lüssing <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: Remove unused hdr_size variable in route_unicast_packet()Linus Lüssing3-7/+5
Signed-off-by: Linus Lüssing <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: rename batman_if struct to hard_ifaceMarek Lindner18-330/+335
Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: rename global if_list to hardif_listMarek Lindner6-22/+22
Batman-adv works with "hard interfaces" as well as "soft interfaces". The new name should better make clear which kind of interfaces this list stores. Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: remove orig_hash spinlockMarek Lindner7-148/+38
Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: increase refcount in create_neighbor to be consistentMarek Lindner2-37/+30
Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: Correct rcu refcounting for orig_nodeMarek Lindner9-36/+49
It might be possible that 2 threads access the same data in the same rcu grace period. The first thread calls call_rcu() to decrement the refcount and free the data while the second thread increases the refcount to use the data. To avoid this race condition all refcount operations have to be atomic. Reported-by: Sven Eckelmann <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: remove extra layer between hash and hash element - hash bucketMarek Lindner10-294/+298
Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: separate ethernet comparing calls from hash functionsMarek Lindner8-42/+51
Note: The function compare_ether_addr() provided by the Linux kernel requires aligned memory. Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: Fix possible buffer overflow in softif neigh list outputLinus Lüssing1-21/+1
When printing the soft interface table the number of entries in the softif neigh list are first being counted and a fitting buffer allocated. After that the softif neigh list gets locked again and the buffer printed - which has the following two issues: For one thing, the softif neigh list might have grown when reacquiring the rcu lock, which results in writing outside of the allocated buffer. Furthermore 31 Bytes are not enough for printing an entry with a vid of more than 2 digits. The manual buffering is unnecessary, we can safely print to the seq directly during the rcu_read_lock(). Signed-off-by: Linus Lüssing <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
2011-03-05batman-adv: Increase orig_node refcount before releasing rcu read lockLinus Lüssing2-3/+5
When unicast_send_skb() is increasing the orig_node's refcount another thread might have been freeing this orig_node already. We need to increase the refcount in the rcu read lock protected area to avoid that. Signed-off-by: Linus Lüssing <[email protected]> Signed-off-by: Marek Lindner <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.