As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header matches.
When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.
Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.
With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.
When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.
Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
When I generalized __assign_irq_vector I failed to pay attention
to what happens when you access a per cpu data structure for
a cpu that is not online. It is an undefined case making any
code that does it have undefined behavior as well.
The code still needs to be able to allocate a vector across cpus
that are not online to properly handle combinations like lowest
priority interrupt delivery and cpu_hotplug. Not that we can do
that today but the infrastructure shouldn't prevent it.
So this patch updates the places where we touch per cpu data
to only touch online cpus, it makes cpu vector allocation
an atomic operation with respect to cpu hotplug, and it updates
the cpu start code to properly initialize vector_irq so we
don't have inconsistencies.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Andi Kleen <ak@suse.de>
There is no reason to remember a per cpu position of which vector
to try. Keeping a global position is simpler and more likely to
result in a global vector allocation even if I don't need or require
it. For level triggered interrupts this means we are less likely to
acknowledge another cpus irq, and cause the level triggered irq to
harmlessly refire.
This simplification makes it easier to only access data structures
of online cpus, by having fewer special cases to deal with.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Andi Kleen <ak@suse.de>
xfrm_state_num needs to be increased for XFRM_STATE_ACQ states created
by xfrm_state_find() to prevent the counter from going negative when
the state is destroyed.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
memcpy 4 bytes to address of auto unsigned long variable followed
by comparison with u32 is a bloody bad idea.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Account for the interface being closed before disabling polling
on a device, to fix shutdown on some systems that explcitly close
the netdevice before calling shutdown.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Move the length (rx_bytes counter) adjustment of 4 bytes down to after the
TBI_ACCEPT workaround.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
82571 and newer chispets don't need to limit desc. length to 4kb and can
handle 8kb sizes.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Allocations using alloc_page are taking too long for normal MTU, so
use LPE only for jumbo frames.
Signed-off-bu: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Threshold bitmasks for prefetch, host and writeback were clearing
bits that they were not supposed to. The leftmost 2 bits in the byte
for each threshold are reserved.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
The MANC register should not be read for PCI-E adapters at all, as well as
82543 and older where 82543 would master abort when this register was
accessed.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
The PXA255 has 84 GPIO lines available. This patch allows access to 81-84
Signed-off-by: Craig Hughes <craig@gumstix.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
HAS_TOUCHSCREEN_ADS7843_LH7 and HAS_TOUCHSCREEN_ADC_LH7 are referenced
but not defined in the LH7A40x configuration. Comment them out to
prevent them causing warnings.
Marc Singer said:
Feel free to remove the Kconfig lines. I'll add it back with
the rest of the config entries.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Fix module loading:
corgi_bl: module license 'GPLv2' taints kernel.
corgi_bl: Unknown symbol platform_driver_unregister
corgi_bl: Unknown symbol __symbol_get
corgi_bl: Unknown symbol platform_driver_register
Cc: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: pHilipp Zabel <philipp.zabel@gmail.com>
Signed-off-by: Anton Vorontsov <cbou@mail.ru>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Fix module compiling:
WARNING: drivers/video/backlight/corgi_bl.o - Section mismatch:
reference to .init.text: from .data between '$d' (at offset 0x0) and
'bl_mutex'
Cc: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Anton Vorontsov <cbou@mail.ru>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
only allow specific type-3 packets to pass the verifier instead of all for r100/r200 as others might be unsafe (r300 already does this), and add checking for these we need but aren't safe. Check the RADEON_CP_INDX_BUFFER packet on both r200 and r300 as it isn't safe neither.
Signed-off-by: Dave Airlie <airlied@linux.ie>
In commit 4e8a520150 ("[PKT_SCHED] netem:
Orphan SKB when adding to queue.") Davem mistakenly also included a
temporary diff in his tree that disabled the pci_fixup_video VGA quirk,
which broke sparc64.
This reverts that part of the commit. Sayeth Davem:
"Greg KH has a patch coming to you soon which will move that VGA code
back into x86/x86_64/IA64 specific areas and will fix the sparc64
problem properly."
Special thanks to Claudio Martins <ctpm@ist.utl.pt> for noticing the
error in the first place.
Cc: Claudio Martins <ctpm@ist.utl.pt>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Eliminate more __must_check madness.
The return code from device_for_each_child() depends on the values
which the helper function returns. If the helper function always
returns zero, it's utterly pointless to check the return code from
device_for_each_child().
The only code which knows if the return value should be checked is
the caller itself, so forcing the return code to always be checked
is silly. Hence, remove the __must_check annotation.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/perex/alsa:
[ALSA] hda-intel - Add check of MSI availabity
[ALSA] version 1.0.13
[ALSA] Fix addition of user-defined boolean controls
[ALSA] Fix AC97 power-saving mode
[ALSA] Fix re-use of va_list
[ALSA] hda_intel: add ATI RS690 HDMI audio support
[ALSA] hda-codec - Add model entry for ASUS U5F laptop
[ALSA] Fix dependency of snd-adlib driver in Kconfig
[ALSA] Various fixes for suspend/resume of ALSA PCI drivers
[ALSA] hda-codec - Fix assignment of PCM devices for Realtek codecs
[ALSA] sound/isa/opti9xx/opti92x-ad1848.c: check kmalloc() return value
[ALSA] sound/isa/ad1816a/ad1816a.c: check kmalloc() return value
[ALSA] sound/isa/cmi8330.c: check kmalloc() return value
[ALSA] sound/isa/gus/interwave.c: check kmalloc() return value
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[PKT_SCHED] netem: Orphan SKB when adding to queue.
[NET]: kernel-doc fix for sock.h
[NET]: Reduce sizeof(struct flowi) by 20 bytes.
[IPv6] fib: initialize tb6_lock in common place to give lockdep a key
[ATM] nicstar: Fix a bogus casting warning
[ATM] firestream: handle thrown error
[ATM]: No need to return void
[ATM]: handle sysfs errors
[DCCP] ipv6: Fix opt_skb leak.
[DCCP]: Fix Oops in DCCPv6
Check the availability of MSI and turn off MSI automatically when it's
not available on the hardware. MSI seems broken on some hardwares
but the kernel doesn't know exactly, thus we have to turn the MSI
feature off on the sound driver manually.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
In ucc_fast.c and ucc_slow.c, "illegal" is twice spelled "illagal".
Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Don't require that the wrapper script be executable when building
zImage.initrds. This has already been fixed for zImages.
Signed-off-by: Mark A. Greer <mgreer@mvista.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
low_cpu_die is called from the CPU hotplug code on 32-bit powermacs,
but it is only defined if CONFIG_PM || CONFIG_CPU_FREQ_PMAC. This
changes the ifdef so it is defined for CONFIG_HOTPLUG_CPU on 32-bit
machines.
Signed-off-by: Srinivasa DS <srinivasa@in.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
This fixes the warning message from the return value of function
get_property(), by making sure that the variable that receives the
value is marked as const.
Signed-off-by: Roy Zang <tie-fei.zang@freescale.com>
--
Signed-off-by: Paul Mackerras <paulus@samba.org>
In calculating stolen time, we were trying to actually account for time
spent in the hypervisor. We don't really have enough information to do
that accurately, so don't try. Instead, we now calculate stolen time as
time that the current cpu thread is not actually dispatching instructions.
On chips without a PURR, we cannot do this, so stolen time will always
be zero. On chips with a PURR, this is merely the difference between
the elapsed PURR values and the elapsed TB values.
This gives us much more sane vaules from tools such as mpstat, even if
they are still a bit strange e.g. 2 busy threads on one cpu will both
appear to have 50% user time and 50% stolen time while 1 busy thread on
a cpu will look like 100% user on one of them and 100% idle on the other.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Otherwise we get a ton of unaligned exceptions, for cases such
as compat_sys_msgrcv() which go:
p = compat_alloc_user_space(second + sizeof(struct msgbuf));
and here 'second' can for example be an arbitrary odd value.
Based upon a bug report from Jurij Smakov.
Signed-off-by: David S. Miller <davem@davemloft.net>
The networking emulator can queue SKBs for a very long
time, so if you're using netem on the sender side for
large bandwidth/delay product testing, the SKB socket
send queue sizes become artificially larger.
Correct this by calling skb_orphan() in netem_enqueue().
Signed-off-by: David S. Miller <davem@davemloft.net>
Fix kernel-doc warning in include/net/sock.h:
Warning(/var/linsrc/linux-2619-rc1-pv//include/net/sock.h:894): No description found for parameter 'rcu'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Fixed the addition of user-defined boolean controls, the private
data size is corrected to be handled properly.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix the bug in AC97 power-saving mode that the power isn't turned on
when power_save is set to 1 via sysfs during the power off state.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
The va_list is designed to be used only once. The current code
may pass va_list arguments multiple times and may cause Oops.
Copy/release the arguments temporarily to avoid this problem.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
This patch adds support for the HDMI codec of the ATI RS690 IGP northbridge.
Signed-off-by: Felix Kuehling <fkuehlin@ati.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Added the missing dependency on CONFIG_SND for snd-adlib driver.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
- Check the return value of pci_enable_device() and request_irq()
in the suspend. If any error occurs there, disable the device
using snd_card_disconnect().
- Call pci_set_power_state() properly with pci_choose_state().
- Fix the order to call pci_set_power_state().
- Removed obsolete house-made PM codes in some drivers.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
David S. Miller