From e214a8cc7a81f20ed7cb4f6373cf15048556bbac Mon Sep 17 00:00:00 2001 From: Remi Denis-Courmont Date: Sun, 26 Oct 2008 23:06:31 -0700 Subject: Phonet: include generic link-layer header size in MAX_PHONET_HEADER This fixes an OOPS in hard_header if a Phonet address is assigned to a non-Phonet network interface. Signed-off-by: Remi Denis-Courmont Signed-off-by: David S. Miller --- include/net/phonet/phonet.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h index d4e7250..c6a2451 100644 --- a/include/net/phonet/phonet.h +++ b/include/net/phonet/phonet.h @@ -27,7 +27,7 @@ * The lower layers may not require more space, ever. Make sure it's * enough. */ -#define MAX_PHONET_HEADER 8 +#define MAX_PHONET_HEADER (8 + MAX_HEADER) /* * Every Phonet* socket has this structure first in its -- cgit v1.1 From c3a90c788b743303c4d824780a3a7271693fb64a Mon Sep 17 00:00:00 2001 From: Remi Denis-Courmont Date: Sun, 26 Oct 2008 23:07:25 -0700 Subject: Phonet: do not reply to indication reset packets This fixes a potential error packet loop. Signed-off-by: Remi Denis-Courmont Signed-off-by: David S. Miller --- include/linux/phonet.h | 1 + net/phonet/af_phonet.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/include/linux/phonet.h b/include/linux/phonet.h index c9609f9..4157faa 100644 --- a/include/linux/phonet.h +++ b/include/linux/phonet.h @@ -72,6 +72,7 @@ struct phonetmsg { } pn_msg_u; }; #define PN_COMMON_MESSAGE 0xF0 +#define PN_COMMGR 0x10 #define PN_PREFIX 0xE0 /* resource for extended messages */ #define pn_submsg_id pn_msg_u.base.pn_submsg_id #define pn_e_submsg_id pn_msg_u.ext.pn_e_submsg_id diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c index b9d97ef..defeb7a 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -261,6 +261,8 @@ static inline int can_respond(struct sk_buff *skb) return 0; /* we are not the destination */ if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5)) return 0; + if (ph->pn_res == PN_COMMGR) /* indications */ + return 0; ph = pn_hdr(skb); /* re-acquires the pointer */ pm = pn_msg(skb); @@ -309,7 +311,8 @@ static int send_reset_indications(struct sk_buff *rskb) return pn_raw_send(data, sizeof(data), rskb->dev, pn_object(oph->pn_sdev, 0x00), - pn_object(oph->pn_rdev, oph->pn_robj), 0x10); + pn_object(oph->pn_rdev, oph->pn_robj), + PN_COMMGR); } -- cgit v1.1 From cbfd24a75f98fe731547d3bc995f3a1f1fed6b20 Mon Sep 17 00:00:00 2001 From: Sergio Luis Date: Sun, 26 Oct 2008 23:08:48 -0700 Subject: btsdio: free sk_buff with kfree_skb free sk_buff with kfree_skb, instead of kree Signed-off-by: Sergio Luis Signed-off-by: David S. Miller --- drivers/bluetooth/btsdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c index 58630cc..cda6c7c 100644 --- a/drivers/bluetooth/btsdio.c +++ b/drivers/bluetooth/btsdio.c @@ -152,7 +152,7 @@ static int btsdio_rx_packet(struct btsdio_data *data) err = sdio_readsb(data->func, skb->data, REG_RDAT, len - 4); if (err < 0) { - kfree(skb); + kfree_skb(skb); return err; } -- cgit v1.1 From b700a98c70401c2a48e509b91b47f58a883806bc Mon Sep 17 00:00:00 2001 From: Sergio Luis Date: Sun, 26 Oct 2008 23:09:27 -0700 Subject: libertas: free sk_buff with kfree_skb free sk_buff with kfree_skb, instead of kree Signed-off-by: Sergio Luis Signed-off-by: David S. Miller --- drivers/net/wireless/libertas/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c index 5749f22..079e6aa 100644 --- a/drivers/net/wireless/libertas/rx.c +++ b/drivers/net/wireless/libertas/rx.c @@ -328,7 +328,7 @@ static int process_rxed_802_11_packet(struct lbs_private *priv, lbs_deb_rx("rx err: frame received with bad length\n"); priv->stats.rx_length_errors++; ret = -EINVAL; - kfree(skb); + kfree_skb(skb); goto done; } -- cgit v1.1 From 8b5f12d04b2e93842f3dda01f029842047bf3f81 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Sun, 26 Oct 2008 23:10:12 -0700 Subject: syncookies: fix inclusion of tcp options in syn-ack David Miller noticed that commit 33ad798c924b4a1afad3593f2796d465040aadd5 '(tcp: options clean up') did not move the req->cookie_ts check. This essentially disabled commit 4dfc2817025965a2fc78a18c50f540736a6b5c24 '[Syncookies]: Add support for TCP options via timestamps.'. This restores the original logic. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller --- net/ipv4/tcp_output.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index e4c5ac9..ba85d88 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2279,6 +2279,11 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst, } memset(&opts, 0, sizeof(opts)); +#ifdef CONFIG_SYN_COOKIES + if (unlikely(req->cookie_ts)) + TCP_SKB_CB(skb)->when = cookie_init_timestamp(req); + else +#endif TCP_SKB_CB(skb)->when = tcp_time_stamp; tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, &md5) + @@ -2304,11 +2309,6 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst, /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */ th->window = htons(min(req->rcv_wnd, 65535U)); -#ifdef CONFIG_SYN_COOKIES - if (unlikely(req->cookie_ts)) - TCP_SKB_CB(skb)->when = cookie_init_timestamp(req); - else -#endif tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location); th->doff = (tcp_header_size >> 2); TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS); -- cgit v1.1