summaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)Author
2010-07-21Bluetooth: Disconnect early if mode is not supportedGustavo F. Padovan
When mode is mandatory we shall not send connect request and report this to the userspace as well. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Remove check for supported modeGustavo F. Padovan
Since now we have checks for the supported mode before on l2cap_info_rsp we can remove the check for it here. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Refuse ConfigRsp with different modeGustavo F. Padovan
If our mode is Basic Mode we have to refuse any ConfigRsp that proposes a different mode. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Actively send request for Basic ModeGustavo F. Padovan
The Profile Tuning Suite requires that we send a RFC containing the Basic Mode configuration when requesting Basic Mode. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Prefer Basic Mode on receipt of ConfigReqGustavo F. Padovan
If we choose to use Basic Mode then we have to refuse the received mode and propose Basic Mode again. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Disconnect the channel if we don't want the proposed modeGustavo F. Padovan
If the device is a STATE 2 then it should disconnect the channel if the remote device propose a mode different from its mandatory mode. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Change the way we set ERTM mode as mandatoryGustavo F. Padovan
If the socket type is SOCK_STREAM we set Enhanced Retransmisson Mode or Streaming Mode as mandatory. That means that we will close the channel if the other side doesn't support or request the the mandatory mode. Basic mode can't be set as mandatory. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Tweaks to l2cap_send_i_or_rr_or_rnr() flowGustavo F. Padovan
l2cap_send_sframe() already set the F-bit if we set L2CAP_CONN_SEND_FBIT and unset L2CAP_CONN_SEND_FBIT after send the F-bit. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Add debug output to ERTM codeGustavo F. Padovan
Use the dynamic debug to output info about ERTM protocol stuff. The following script can be used to enable debug for ERTM: DEBUGFS="/sys/kernel/debug/dynamic_debug/control" echo -n 'func l2cap_send_disconn_req +p' > $DEBUGFS echo -n 'func l2cap_monitor_timeout +p' > $DEBUGFS echo -n 'func l2cap_retrans_timeout +p' > $DEBUGFS echo -n 'func l2cap_busy_work +p' > $DEBUGFS echo -n 'func l2cap_push_rx_skb +p' > $DEBUGFS echo -n 'func l2cap_data_channel_iframe +p' > $DEBUGFS echo -n 'func l2cap_data_channel_rrframe +p' > $DEBUGFS echo -n 'func l2cap_data_channel_rejframe +p' > $DEBUGFS echo -n 'func l2cap_data_channel_srejframe +p' > $DEBUGFS echo -n 'func l2cap_data_channel_rnrframe +p' > $DEBUGFS Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix ERTM error reporting to the userspaceGustavo F. Padovan
If any error occurs during transfers we have to tell userspace that something wrong happened. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix missing retransmission action with RR(P=1)Gustavo F. Padovan
The Bluetooth SIG Profile Tuning Suite Software uses the CSA1 spec to run the L2CAP tests. The new 3.0 spec has a missing Retransmit-I-Frames action when the Remote side is Busy. We still start the retransmission timer if Remote is Busy and unacked frames > 0. We do everything we did before this change plus the Retransmission of I-frames. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Check packet FCS earlierGustavo F. Padovan
This way, if FCS is enabled and the packet is corrupted, we just drop it without read it len, which could be corrupted. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Check the tx_window size on setsockoptGustavo F. Padovan
We have to check if the proposed tx_window value is not greater that maximum value supported. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix handle of received P-bitGustavo F. Padovan
ERTM spec mandates that after receive a P-bit we shall send an F-bit in response. This patch fixes this for retransmitted packets, on retransmitting we were missing to check for a pending F-bit to be sent. Also we were missing some annotation to send a F-bit. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Update buffer_seq before retransmit framesGustavo F. Padovan
Updating buffer_seq first make us able to ack the last I-frame received. This is also a requirement of the Profile Tuning Suite software. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Stop ack_timer if ERTM enters in Local Busy or SREJ_SENTGustavo F. Padovan
The ack_timer is implemation specific, disabling it in such situation avoids some potencial errors in the ERTM protocol. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Reassigned copyright to Code Aurora ForumRon Shaffer
Qualcomm, Inc. has reassigned rights to Code Aurora Forum. Accordingly, as files are modified by Code Aurora Forum members, the copyright statement will be updated. Signed-off-by: Ron Shaffer <rshaffer@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Add debugfs support for showing the blacklistJohan Hedberg
This patch adds a debugfs blacklist entry for each HCI device which can be used to list the current content of the blacklist. Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Add blacklist support for incoming connectionsJohan Hedberg
In some circumstances it could be desirable to reject incoming connections on the baseband level. This patch adds this feature through two new ioctl's: HCIBLOCKADDR and HCIUNBLOCKADDR. Both take a simple Bluetooth address as a parameter. BDADDR_ANY can be used with HCIUNBLOCKADDR to remove all devices from the blacklist. Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix L2CAP control bit field corruptionGustavo F. Padovan
When resending an I-frame, ERTM was reusing the control bits from the last time it was sent, that was causing a corruption in the new control field due to it dirty fields. This patches extracts only the SAR bits from the old field and reuse it to resend the packet, the others bits should be reset and receive the updated value. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Proper shutdown ERTM when closing the channelGustavo F. Padovan
Fix a crash regarding the Monitor Timeout, it was running even after the shutdown of the ACL connection, which doesn't make sense. The same code also fixes another issue, before this patch L2CAP was sending many Disconnections Requests while we have to send only one. The issues are related to each other, a expired Monitor Timeout can trigger a Disconnection Request and then we may have a crash if the link was already deleted. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix bug with ERTM minimum packet lengthNathan Holstein
ERTM and streaming mode L2CAP sockets have no minimum packet length. Only basic mode connections have minimum length. Instead, validate the packet containing all necessary control, FCS, and SAR fields. The patch fixes the drop of valid packets with length lower than 4. Signed-off-by: Nathan Holstein <ngh@isomerica.net> Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix SREJ_QUEUE corruption in L2CAPJoão Paulo Rechi Vita
Since all TxSeq values are modulo, we shall not compare them directly. We have to compare their offset inside the TxWindow instead. Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Acked-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix bug in l2cap_ertm_send() behaviorGustavo F. Padovan
This patch makes l2cap_ertm_send() similar to the Send-Data action of the ERTM spec. We shall not check for RemoteBusy or WAIT_F state inside l2cap_ertm_send(). Such checks were causing a bug in the retransmission logic of ERTM and making ERTM stalls until the ACL is dropped. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Only check SAR bits if frame is an I-frameGustavo F. Padovan
The SAR bits doesn't make sense for an S-frame. It doesn't use SAR. Checking SAR for a S-frames can lead to L2CAP errors, it could close the channel with an invalid packet length, since we was removing the 2 of the of any frame that match SAR start bits, without check if it is an I-frame. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix bug with ERTM vars incrementGustavo F. Padovan
All ERTM operations regarding the txWindow should be modulo 64, otherwise we confuse the ERTM logic and connections will break. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Fix drop of packets with invalid req_seq/tx_seqGustavo F. Padovan
We shall not use an unsigned var since we are expecting negatives value there. Using unsigned causes ERTM connection to close due to invalid ReqSeq numbers. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Remove L2CAP Extended Features from KconfigGustavo F. Padovan
This reverts commit 84fb0a6334af0ccad3544f6972c055d90fbb9fbe which adds the L2CAP Extended Features to the Kconfig, that is actually not needed. One can use other mechanisms to enable L2CAP Extended Features. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-21Bluetooth: Remove max_tx and tx_window module paramenters from L2CAPGustavo F. Padovan
We don't need these parameters anymore since we have socket options for them. Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2010-07-20Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/vhost/net.c net/bridge/br_device.c Fix merge conflict in drivers/vhost/net.c with guidance from Stephen Rothwell. Revert the effects of net-2.6 commit 573201f36fd9c7c6d5218cdcd9948cee700b277d since net-next-2.6 has fixes that make bridge netpoll work properly thus we don't need it disabled. Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-20drop_monitor: convert some kfree_skb call sites to consume_skbNeil Horman
Convert a few calls from kfree_skb to consume_skb Noticed while I was working on dropwatch that I was detecting lots of internal skb drops in several places. While some are legitimate, several were not, freeing skbs that were at the end of their life, rather than being discarded due to an error. This patch converts those calls sites from using kfree_skb to consume_skb, which quiets the in-kernel drop_monitor code from detecting them as drops. Tested successfully by myself Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-20drop_monitor: Add error code to detect duplicate state changesNeil Horman
Patch to add -EAGAIN error to dropwatch netlink message handling code. -EAGAIN will be returned anytime userspace attempts to transition the state of the drop monitor service to a state that its already in. That allows user space to detect this condition, so it doesn't wait for a success ACK that will never arrive. Tested successfully by me Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-20__dst_free(): put EXPORT_SYMBOLS after the fctNicolas Dichtel
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-19bridge: Partially disable netpoll supportHerbert Xu
The new netpoll code in bridging contains use-after-free bugs that are non-trivial to fix. This patch fixes this by removing the code that uses skbs after they're freed. As a consequence, this means that we can no longer call bridge from the netpoll path, so this patch also removes the controller function in order to disable netpoll. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Thanks, Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-19net: this_cpu_xxx conversionsEric Dumazet
Use modern this_cpu_xxx() api, saving few bytes on x86 Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-19tcp: fix crash in tcp_xmit_retransmit_queueIlpo Järvinen
It can happen that there are no packets in queue while calling tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns NULL and that gets deref'ed to get sacked into a local var. There is no work to do if no packets are outstanding so we just exit early. This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out guard to make joining diff nicer). Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Reported-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de> Tested-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-19net: 64bit stats for netdev_queueEric Dumazet
Since struct netdev_queue tx_bytes/tx_packets/tx_dropped are already protected by _xmit_lock, its easy to convert these fields to u64 instead of unsigned long. This completes 64bit stats for devices using them (vlan, macvlan, ...) Strictly, we could avoid the locking in dev_txq_stats_fold() on 64bit arches, but its slow path and we prefer keep it simple. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18sch_atm: Convert to use standard list_head facilities.David S. Miller
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18net: support time stamping in phy devices.Richard Cochran
This patch adds a new networking option to allow hardware time stamps from PHY devices. When enabled, likely candidates among incoming and outgoing network packets are offered to the PHY driver for possible time stamping. When accepted by the PHY driver, incoming packets are deferred for later delivery by the driver. The patch also adds phylib driver methods for the SIOCSHWTSTAMP ioctl and callbacks for transmit and receive time stamping. Drivers may optionally implement these functions. Signed-off-by: Richard Cochran <richard.cochran@omicron.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18net: preserve ifreq parameter when calling generic phy_mii_ioctl().Richard Cochran
The phy_mii_ioctl() function unnecessarily throws away the original ifreq. We need access to the ifreq in order to support PHYs that can perform hardware time stamping. Two maverick drivers filter the ioctl commands passed to phy_mii_ioctl(). This is unnecessary since phylib will check the command in any case. Signed-off-by: Richard Cochran <richard.cochran@omicron.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18vlan_dev: VLAN 0 should be treated as "no vlan tag" (802.1p packet)Pedro Garcia
- Without the 8021q module loaded in the kernel, all 802.1p packets (VLAN 0 but QoS tagging) are silently discarded (as expected, as the protocol is not loaded). - Without this patch in 8021q module, these packets are forwarded to the module, but they are discarded also if VLAN 0 is not configured, which should not be the default behaviour, as VLAN 0 is not really a VLANed packet but a 802.1p packet. Defining VLAN 0 makes it almost impossible to communicate with mixed 802.1p and non 802.1p devices on the same network due to arp table issues. - Changed logic to skip vlan specific code in vlan_skb_recv if VLAN is 0 and we have not defined a VLAN with ID 0, but we accept the packet with the encapsulated proto and pass it later to netif_rx. - In the vlan device event handler, added some logic to add VLAN 0 to HW filter in devices that support it (this prevented any traffic in VLAN 0 to reach the stack in e1000e with HW filter under 2.6.35, and probably also with other HW filtered cards, so we fix it here). - In the vlan unregister logic, prevent the elimination of VLAN 0 in devices with HW filter. - The default behaviour is to ignore the VLAN 0 tagging and accept the packet as if it was not tagged, but we can still define a VLAN 0 if desired (so it is backwards compatible). Signed-off-by: Pedro Garcia <pedro.netdev@dondevamos.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18net: Remove MAX_SOCK_ADDR constantTetsuo Handa
MAX_SOCK_ADDR is no longer used because commit 230b1839 "net: Use standard structures for generic socket address structures." replaced "char address[MAX_SOCK_ADDR];" with "struct sockaddr_storage address;". Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18net: dccp: fix sign bugKulikov Vasiliy
'gap' is unsigned, so this code is wrong: gap = -new_head; ... if (gap > 0) { ... } Make 'gap' signed. The semantic patch that finds this problem (many false-positive results): (http://coccinelle.lip6.fr/) // <smpl> @ r1 @ identifier f; @@ int f(...) { ... } @@ identifier r1.f; type T; unsigned T x; @@ *x = f(...) ... *x > 0 Signed-off-by: Kulikov Vasiliy <segooon@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-18IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input())Arnaud Ebalard
The input handler for Type 2 Routing Header (mip6_rthdr_input()) checks if the CoA in the packet matches the CoA in the XFRM state. Current check is buggy: it compares the adddress in the Type 2 Routing Header, i.e. the HoA, against the expected CoA in the state. The comparison should be made against the address in the destination field of the IPv6 header. The bug remained unnoticed because the main (and possibly only current) user of the code (UMIP MIPv6 Daemon) initializes the XFRM state with the unspecified address, i.e. explicitly allows everything. Yoshifuji-san, can you ack that one? Signed-off-by: Arnaud Ebalard <arno@natisbad.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-15ipmr: Don't leak memory if fib lookup fails.Ben Greear
This was detected using two mcast router tables. The pimreg for the second interface did not have a specific mrule, so packets received by it were handled by the default table, which had nothing configured. This caused the ipmr_fib_lookup to fail, causing the memory leak. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-15net: bridge: fix sign bugKulikov Vasiliy
ipv6_skip_exthdr() can return error code that is below zero. 'offset' is unsigned, so it makes no sense. ipv6_skip_exthdr() returns 'int' so we can painlessly change type of offset to int. Signed-off-by: Kulikov Vasiliy <segooon@gmail.com> Acked-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-14net: fix problem in reading sock TX queueTom Herbert
Fix problem in reading the tx_queue recorded in a socket. In dev_pick_tx, the TX queue is read by doing a check with sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get. The problem is that there is not mutual exclusion across these calls in the socket so it it is possible that the queue in the sock can be invalidated after sk_tx_queue_recorded is called so that sk_tx_queue get returns -1, which sets 65535 in queue_index and thus dev_pick_tx returns 65536 which is a bogus queue and can cause crash in dev_queue_xmit. We fix this by only calling sk_tx_queue_get which does the proper checks. The interface is that sk_tx_queue_get returns the TX queue if the sock argument is non-NULL and TX queue is recorded, else it returns -1. sk_tx_queue_recorded is no longer used so it can be completely removed. Signed-off-by: Tom Herbert <therbert@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-14Net: ethernet: pe2.c: fix EXPORT_SYMBOL macro code style issueChihau Chau
This patch fix a code style issue, if a function is exported, the EXPORT_SYMBOL macro for it should follow immediately after the closing function brace line. Signed-off-by: Chihau Chau <chihau@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-14net/core: neighbour update OopsDoug Kehn
When configuring DMVPN (GRE + openNHRP) and a GRE remote address is configured a kernel Oops is observed. The obserseved Oops is caused by a NULL header_ops pointer (neigh->dev->header_ops) in neigh_update_hhs() when void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) = neigh->dev->header_ops->cache_update; is executed. The dev associated with the NULL header_ops is the GRE interface. This patch guards against the possibility that header_ops is NULL. This Oops was first observed in kernel version 2.6.26.8. Signed-off-by: Doug Kehn <rdkehn@yahoo.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-14net/sched: potential data corruptionDan Carpenter
The reset_policy() does: memset(d->tcfd_defdata, 0, SIMP_MAX_DATA); strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); In the original code, the size of d->tcfd_defdata wasn't fixed and if strlen(defdata) was less than 31, reset_policy() would cause memory corruption. Please Note: The original alloc_defdata() assumes defdata is 32 characters and a NUL terminator while reset_policy() assumes defdata is 31 characters and a NUL. This patch updates alloc_defdata() to match reset_policy() (ie a shorter string). I'm not very familiar with this code so please review carefully. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.0.4) at 2025-06-05 00:24:04 +0000