* Re: [patch 4/9] secmark: Add SELinux exports
From: David Miller @ 2006-06-09 7:28 UTC (permalink / raw)
To: akpm; +Cc: netdev, jmorris
In-Reply-To: <200606090520.k595KtvV032092@shell0.pdx.osdl.net>
From: akpm@osdl.org
Date: Thu, 08 Jun 2006 22:20:54 -0700
> From: James Morris <jmorris@namei.org>
>
> Add and export new functions to the in-kernel SELinux API in support of the
> new secmark-based packet controls.
>
> Signed-off-by: James Morris <jmorris@namei.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
Applied to net-2.6.18, thanks.
^ permalink raw reply
* Re: [patch 5/9] secmark: Add secmark support to core networking.
From: David Miller @ 2006-06-09 7:29 UTC (permalink / raw)
To: akpm; +Cc: netdev, jmorris
In-Reply-To: <200606090520.k595KtAs032095@shell0.pdx.osdl.net>
From: akpm@osdl.org
Date: Thu, 08 Jun 2006 22:20:55 -0700
> Add a secmark field to the skbuff structure, to allow security subsystems to
> place security markings on network packets. This is similar to the nfmark
> field, except is intended for implementing security policy, rather than than
> networking policy.
>
> This patch was already acked in principle by Dave Miller.
>
> Signed-off-by: James Morris <jmorris@namei.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
Applied to net-2.6.18, thanks.
Remember James, you're on the hook now to shrink sk_buff
when you get a chance :-)
Thanks again.
^ permalink raw reply
* Re: [patch 6/9] secmark: Add xtables SECMARK target
From: David Miller @ 2006-06-09 7:31 UTC (permalink / raw)
To: akpm; +Cc: netdev, jmorris
In-Reply-To: <200606090520.k595KutY032098@shell0.pdx.osdl.net>
From: akpm@osdl.org
Date: Thu, 08 Jun 2006 22:20:56 -0700
> Add a SECMARK target to xtables, allowing the admin to apply security marks to
> packets via both iptables and ip6tables.
>
> The target currently handles SELinux security marking, but can be extended
> for other purposes as needed.
>
> Signed-off-by: James Morris <jmorris@namei.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
Applied to net-2.6.18, thanks.
^ permalink raw reply
* Re: [patch 7/9] secmark: Add secmark support to conntrack
From: David Miller @ 2006-06-09 7:32 UTC (permalink / raw)
To: akpm; +Cc: netdev, jmorris
In-Reply-To: <200606090520.k595KvVd032101@shell0.pdx.osdl.net>
From: akpm@osdl.org
Date: Thu, 08 Jun 2006 22:20:57 -0700
> Add a secmark field to IP and NF conntracks, so that security markings on
> packets can be copied to their associated connections, and also copied back to
> packets as required. This is similar to the network mark field currently used
> with conntrack, although it is intended for enforcement of security policy
> rather than network policy.
>
> Signed-off-by: James Morris <jmorris@namei.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
Applied to net-2.6.18, thanks.
^ permalink raw reply
* Re: [patch 8/9] secmark: Add CONNSECMARK xtables target
From: David Miller @ 2006-06-09 7:32 UTC (permalink / raw)
To: akpm; +Cc: netdev, jmorris
In-Reply-To: <200606090520.k595KwnD032104@shell0.pdx.osdl.net>
From: akpm@osdl.org
Date: Thu, 08 Jun 2006 22:20:58 -0700
> Add a new xtables target, CONNSECMARK, which is used to specify rules for
> copying security marks from packets to connections, and for copyying security
> marks back from connections to packets. This is similar to the CONNMARK
> target, but is more limited in scope in that it only allows copying of
> security marks to and from packets, as this is all it needs to do.
>
> A typical scenario would be to apply a security mark to a 'new' packet with
> SECMARK, then copy that to its conntrack via CONNMARK, and then restore the
> security mark from the connection to established and related packets on that
> connection.
>
> Signed-off-by: James Morris <jmorris@namei.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
Applied to net-2.6.18, thanks.
^ permalink raw reply
* Re: [patch 9/9] secmark: Add new packet controls to SELinux
From: David Miller @ 2006-06-09 7:33 UTC (permalink / raw)
To: akpm; +Cc: netdev, jmorris, sds
In-Reply-To: <200606090520.k595Kx8J032108@shell0.pdx.osdl.net>
From: akpm@osdl.org
Date: Thu, 08 Jun 2006 22:20:59 -0700
> Add new per-packet access controls to SELinux, replacing the old packet
> controls.
...
> Signed-off-by: James Morris <jmorris@namei.org>
> Cc: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
Applied to net-2.6.18, thanks a lot.
^ permalink raw reply
* [1/3] [NET]: Clean up skb_linearize
From: Herbert Xu @ 2006-06-09 7:42 UTC (permalink / raw)
To: David S. Miller, netdev
[-- Attachment #1: Type: text/plain, Size: 1051 bytes --]
Hi:
The following patches are based on net-2.6.18.
[NET]: Clean up skb_linearize
The linearisation operation doesn't need to be super-optimised. So we can
replace __skb_linearize with __pskb_pull_tail which does the same thing but
is more general.
Also, most users of skb_linearize end up testing whether the skb is linear
or not so it helps to make skb_linearize do just that.
Some callers of skb_linearize also use it to copy cloned data, so it's
useful to have a new function skb_linearize_cow to copy the data if it's
either non-linear or cloned.
Last but not least, I've removed the gfp argument since nobody uses it
anymore. If it's ever needed we can easily add it back.
Misc bugs fixed by this patch:
* via-velocity error handling (also, no SG => no frags)
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[-- Attachment #2: p1.patch --]
[-- Type: text/plain, Size: 8249 bytes --]
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -116,8 +116,7 @@ aoenet_rcv(struct sk_buff *skb, struct n
skb = skb_share_check(skb, GFP_ATOMIC);
if (skb == NULL)
return 0;
- if (skb_is_nonlinear(skb))
- if (skb_linearize(skb, GFP_ATOMIC) < 0)
+ if (skb_linearize(skb))
goto exit;
if (!is_aoe_netif(ifp))
goto exit;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1200,7 +1200,7 @@ static int mv643xx_eth_start_xmit(struct
}
if (has_tiny_unaligned_frags(skb)) {
- if ((skb_linearize(skb, GFP_ATOMIC) != 0)) {
+ if (__skb_linearize(skb)) {
stats->tx_dropped++;
printk(KERN_DEBUG "%s: failed to linearize tiny "
"unaligned fragment\n", dev->name);
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1899,6 +1899,13 @@ static int velocity_xmit(struct sk_buff
int pktlen = skb->len;
+#ifdef VELOCITY_ZERO_COPY_SUPPORT
+ if (skb_shinfo(skb)->nr_frags > 6 && __skb_linearize(skb)) {
+ kfree_skb(skb);
+ return 0;
+ }
+#endif
+
spin_lock_irqsave(&vptr->lock, flags);
index = vptr->td_curr[qnum];
@@ -1914,8 +1921,6 @@ static int velocity_xmit(struct sk_buff
*/
if (pktlen < ETH_ZLEN) {
/* Cannot occur until ZC support */
- if(skb_linearize(skb, GFP_ATOMIC))
- return 0;
pktlen = ETH_ZLEN;
memcpy(tdinfo->buf, skb->data, skb->len);
memset(tdinfo->buf + skb->len, 0, ETH_ZLEN - skb->len);
@@ -1933,7 +1938,6 @@ static int velocity_xmit(struct sk_buff
int nfrags = skb_shinfo(skb)->nr_frags;
tdinfo->skb = skb;
if (nfrags > 6) {
- skb_linearize(skb, GFP_ATOMIC);
memcpy(tdinfo->buf, skb->data, skb->len);
tdinfo->skb_dma[0] = tdinfo->buf_dma;
td_ptr->tdesc0.pktsize =
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1165,18 +1165,34 @@ static inline int skb_can_coalesce(struc
return 0;
}
+static inline int __skb_linearize(struct sk_buff *skb)
+{
+ return __pskb_pull_tail(skb, skb->data_len) ? 0 : -ENOMEM;
+}
+
/**
* skb_linearize - convert paged skb to linear one
* @skb: buffer to linarize
- * @gfp: allocation mode
*
* If there is no free memory -ENOMEM is returned, otherwise zero
* is returned and the old skb data released.
*/
-extern int __skb_linearize(struct sk_buff *skb, gfp_t gfp);
-static inline int skb_linearize(struct sk_buff *skb, gfp_t gfp)
+static inline int skb_linearize(struct sk_buff *skb)
+{
+ return skb_is_nonlinear(skb) ? __skb_linearize(skb) : 0;
+}
+
+/**
+ * skb_linearize_cow - make sure skb is linear and writable
+ * @skb: buffer to process
+ *
+ * If there is no free memory -ENOMEM is returned, otherwise zero
+ * is returned and the old skb data released.
+ */
+static inline int skb_linearize_cow(struct sk_buff *skb)
{
- return __skb_linearize(skb, gfp);
+ return skb_is_nonlinear(skb) || skb_cloned(skb) ?
+ __skb_linearize(skb) : 0;
}
/**
diff --git a/net/core/dev.c b/net/core/dev.c
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1220,64 +1220,6 @@ static inline int illegal_highdma(struct
#define illegal_highdma(dev, skb) (0)
#endif
-/* Keep head the same: replace data */
-int __skb_linearize(struct sk_buff *skb, gfp_t gfp_mask)
-{
- unsigned int size;
- u8 *data;
- long offset;
- struct skb_shared_info *ninfo;
- int headerlen = skb->data - skb->head;
- int expand = (skb->tail + skb->data_len) - skb->end;
-
- if (skb_shared(skb))
- BUG();
-
- if (expand <= 0)
- expand = 0;
-
- size = skb->end - skb->head + expand;
- size = SKB_DATA_ALIGN(size);
- data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
- if (!data)
- return -ENOMEM;
-
- /* Copy entire thing */
- if (skb_copy_bits(skb, -headerlen, data, headerlen + skb->len))
- BUG();
-
- /* Set up shinfo */
- ninfo = (struct skb_shared_info*)(data + size);
- atomic_set(&ninfo->dataref, 1);
- ninfo->tso_size = skb_shinfo(skb)->tso_size;
- ninfo->tso_segs = skb_shinfo(skb)->tso_segs;
- ninfo->nr_frags = 0;
- ninfo->frag_list = NULL;
-
- /* Offset between the two in bytes */
- offset = data - skb->head;
-
- /* Free old data. */
- skb_release_data(skb);
-
- skb->head = data;
- skb->end = data + size;
-
- /* Set up new pointers */
- skb->h.raw += offset;
- skb->nh.raw += offset;
- skb->mac.raw += offset;
- skb->tail += offset;
- skb->data += offset;
-
- /* We are no longer a clone, even if we were. */
- skb->cloned = 0;
-
- skb->tail += skb->data_len;
- skb->data_len = 0;
- return 0;
-}
-
#define HARD_TX_LOCK(dev, cpu) { \
if ((dev->features & NETIF_F_LLTX) == 0) { \
spin_lock(&dev->xmit_lock); \
@@ -1326,7 +1268,7 @@ int dev_queue_xmit(struct sk_buff *skb)
if (skb_shinfo(skb)->frag_list &&
!(dev->features & NETIF_F_FRAGLIST) &&
- __skb_linearize(skb, GFP_ATOMIC))
+ __skb_linearize(skb))
goto out_kfree_skb;
/* Fragmented skb is linearized if device does not support SG,
@@ -1335,7 +1277,7 @@ int dev_queue_xmit(struct sk_buff *skb)
*/
if (skb_shinfo(skb)->nr_frags &&
(!(dev->features & NETIF_F_SG) || illegal_highdma(dev, skb)) &&
- __skb_linearize(skb, GFP_ATOMIC))
+ __skb_linearize(skb))
goto out_kfree_skb;
/* If packet is not checksummed and device does not support
@@ -3473,7 +3415,6 @@ subsys_initcall(net_dev_init);
EXPORT_SYMBOL(__dev_get_by_index);
EXPORT_SYMBOL(__dev_get_by_name);
EXPORT_SYMBOL(__dev_remove_pack);
-EXPORT_SYMBOL(__skb_linearize);
EXPORT_SYMBOL(dev_valid_name);
EXPORT_SYMBOL(dev_add_pack);
EXPORT_SYMBOL(dev_alloc_name);
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -801,8 +801,7 @@ got_it:
* We linearize everything except data segments here.
*/
if (cb->nsp_flags & ~0x60) {
- if (unlikely(skb_is_nonlinear(skb)) &&
- skb_linearize(skb, GFP_ATOMIC) != 0)
+ if (unlikely(skb_linearize(skb)))
goto free_out;
}
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -629,8 +629,7 @@ int dn_route_rcv(struct sk_buff *skb, st
padlen);
if (flags & DN_RT_PKT_CNTL) {
- if (unlikely(skb_is_nonlinear(skb)) &&
- skb_linearize(skb, GFP_ATOMIC) != 0)
+ if (unlikely(skb_linearize(skb)))
goto dump_it;
switch(flags & DN_RT_CNTL_MSK) {
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -80,15 +80,12 @@ out:
static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
{
- int err = 0;
+ int err = -ENOMEM;
struct iphdr *iph;
struct ip_comp_hdr *ipch;
- if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&
- skb_linearize(skb, GFP_ATOMIC) != 0) {
- err = -ENOMEM;
+ if (skb_linearize_cow(skb))
goto out;
- }
skb->ip_summed = CHECKSUM_NONE;
@@ -158,10 +155,8 @@ static int ipcomp_output(struct xfrm_sta
goto out_ok;
}
- if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&
- skb_linearize(skb, GFP_ATOMIC) != 0) {
+ if (skb_linearize_cow(skb))
goto out_ok;
- }
err = ipcomp_compress(x, skb);
iph = skb->nh.iph;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -65,7 +65,7 @@ static LIST_HEAD(ipcomp6_tfms_list);
static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
{
- int err = 0;
+ int err = -ENOMEM;
struct ipv6hdr *iph;
struct ipv6_comp_hdr *ipch;
int plen, dlen;
@@ -74,11 +74,8 @@ static int ipcomp6_input(struct xfrm_sta
struct crypto_tfm *tfm;
int cpu;
- if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&
- skb_linearize(skb, GFP_ATOMIC) != 0) {
- err = -ENOMEM;
+ if (skb_linearize_cow(skb))
goto out;
- }
skb->ip_summed = CHECKSUM_NONE;
@@ -142,10 +139,8 @@ static int ipcomp6_output(struct xfrm_st
goto out_ok;
}
- if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&
- skb_linearize(skb, GFP_ATOMIC) != 0) {
+ if (skb_linearize_cow(skb))
goto out_ok;
- }
/* compression */
plen = skb->len - hdr_len;
^ permalink raw reply
* [2/3] [NET] ppp: Remove unnecessary pskb_may_pull
From: Herbert Xu @ 2006-06-09 7:43 UTC (permalink / raw)
To: David S. Miller, netdev
In-Reply-To: <20060609074234.GA17580@gondor.apana.org.au>
[-- Attachment #1: Type: text/plain, Size: 598 bytes --]
Hi:
[NET] ppp: Remove unnecessary pskb_may_pull
In ppp_receive_nonmp_frame, we call pskb_may_pull(skb, skb->len) if the
tailroom is >= 124. This is pointless because this pskb_may_pull is only
needed if the skb is non-linear. However, if it is non-linear then the
tailroom would be zero.
So it can be safely removed.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[-- Attachment #2: p2.patch --]
[-- Type: text/plain, Size: 336 bytes --]
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1609,8 +1609,6 @@ ppp_receive_nonmp_frame(struct ppp *ppp,
kfree_skb(skb);
skb = ns;
}
- else if (!pskb_may_pull(skb, skb->len))
- goto err;
else
skb->ip_summed = CHECKSUM_NONE;
^ permalink raw reply
* [3/3] [NET]: skb_trim audit
From: Herbert Xu @ 2006-06-09 7:44 UTC (permalink / raw)
To: David S. Miller, netdev
In-Reply-To: <20060609074234.GA17580@gondor.apana.org.au>
[-- Attachment #1: Type: text/plain, Size: 509 bytes --]
Hi:
[NET]: skb_trim audit
I found a few more spots where pskb_trim_rcsum could be used but were not.
This patch changes them to use it.
Also, sk_filter can get paged skb data. Therefore we must use pskb_trim
instead of skb_trim.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[-- Attachment #2: p3.patch --]
[-- Type: text/plain, Size: 2139 bytes --]
diff --git a/include/net/sock.h b/include/net/sock.h
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -873,10 +873,7 @@ static inline int sk_filter(struct sock
if (filter) {
unsigned int pkt_len = sk_run_filter(skb, filter->insns,
filter->len);
- if (!pkt_len)
- err = -EPERM;
- else
- skb_trim(skb, pkt_len);
+ err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
}
if (needlock)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -407,12 +407,8 @@ static unsigned int br_nf_pre_routing_ip
if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
goto inhdr_error;
- if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
- if (__pskb_trim(skb, pkt_len + sizeof(struct ipv6hdr)))
- goto inhdr_error;
- if (skb->ip_summed == CHECKSUM_HW)
- skb->ip_summed = CHECKSUM_NONE;
- }
+ if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
+ goto inhdr_error;
}
if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
goto inhdr_error;
@@ -495,11 +491,7 @@ static unsigned int br_nf_pre_routing(un
if (skb->len < len || len < 4 * iph->ihl)
goto inhdr_error;
- if (skb->len > len) {
- __pskb_trim(skb, len);
- if (skb->ip_summed == CHECKSUM_HW)
- skb->ip_summed = CHECKSUM_NONE;
- }
+ pskb_trim_rcsum(skb, len);
nf_bridge_put(skb->nf_bridge);
if (!nf_bridge_alloc(skb))
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -456,13 +456,9 @@ static int nf_ct_frag6_queue(struct nf_c
DEBUGP("queue: message is too short.\n");
goto err;
}
- if (end-offset < skb->len) {
- if (pskb_trim(skb, end - offset)) {
- DEBUGP("Can't trim\n");
- goto err;
- }
- if (skb->ip_summed != CHECKSUM_UNNECESSARY)
- skb->ip_summed = CHECKSUM_NONE;
+ if (pskb_trim_rcsum(skb, end - offset)) {
+ DEBUGP("Can't trim\n");
+ goto err;
}
/* Find out which fragments are in front and at the back of us
^ permalink raw reply
* [4/3] [NET]: Warn in __skb_trim if skb is paged
From: Herbert Xu @ 2006-06-09 7:55 UTC (permalink / raw)
To: David S. Miller, netdev
In-Reply-To: <20060609074234.GA17580@gondor.apana.org.au>
[-- Attachment #1: Type: text/plain, Size: 459 bytes --]
Hi:
[NET]: Warn in __skb_trim if skb is paged
It's better to warn and fail rather than rarely triggering BUG on paths
that incorrectly call skb_trim/__skb_trim on a non-linear skb.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[-- Attachment #2: p4.patch --]
[-- Type: text/plain, Size: 2332 bytes --]
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 197f2d2..6ceec04 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -971,15 +971,16 @@ #ifndef NET_SKB_PAD
#define NET_SKB_PAD 16
#endif
-extern int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc);
+extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
static inline void __skb_trim(struct sk_buff *skb, unsigned int len)
{
- if (!skb->data_len) {
- skb->len = len;
- skb->tail = skb->data + len;
- } else
- ___pskb_trim(skb, len, 0);
+ if (unlikely(skb->data_len)) {
+ WARN_ON(1);
+ return;
+ }
+ skb->len = len;
+ skb->tail = skb->data + len;
}
/**
@@ -989,6 +990,7 @@ static inline void __skb_trim(struct sk_
*
* Cut the length of a buffer down by removing data from the tail. If
* the buffer is already under the length specified it is not modified.
+ * The skb must be linear.
*/
static inline void skb_trim(struct sk_buff *skb, unsigned int len)
{
@@ -999,12 +1001,10 @@ static inline void skb_trim(struct sk_bu
static inline int __pskb_trim(struct sk_buff *skb, unsigned int len)
{
- if (!skb->data_len) {
- skb->len = len;
- skb->tail = skb->data+len;
- return 0;
- }
- return ___pskb_trim(skb, len, 1);
+ if (skb->data_len)
+ return ___pskb_trim(skb, len);
+ __skb_trim(skb, len);
+ return 0;
}
static inline int pskb_trim(struct sk_buff *skb, unsigned int len)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index fb3770f..0af4861 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -800,12 +800,10 @@ struct sk_buff *skb_pad(struct sk_buff *
return nskb;
}
-/* Trims skb to length len. It can change skb pointers, if "realloc" is 1.
- * If realloc==0 and trimming is impossible without change of data,
- * it is BUG().
+/* Trims skb to length len. It can change skb pointers.
*/
-int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc)
+int ___pskb_trim(struct sk_buff *skb, unsigned int len)
{
int offset = skb_headlen(skb);
int nfrags = skb_shinfo(skb)->nr_frags;
@@ -815,7 +813,6 @@ int ___pskb_trim(struct sk_buff *skb, un
int end = offset + skb_shinfo(skb)->frags[i].size;
if (end > len) {
if (skb_cloned(skb)) {
- BUG_ON(!realloc);
if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
return -ENOMEM;
}
^ permalink raw reply related
* Re: ipsec tunnel asymmetrical mtu
From: Marco Berizzi @ 2006-06-09 8:04 UTC (permalink / raw)
To: herbert; +Cc: netdev
In-Reply-To: <BAY103-F5BDFFFFDAB4CFB03007D9B2A60@phx.gbl>
Marco Berizzi wrote:
>Marco Berizzi wrote:
>
>>Herbert Xu wrote:
>>
>>>However, the fact that the tcpdump causes more chunky packets to
>>>make it through could be an indication that there is a bug somewhere
>>>in our NAT/IPsec code or at least a suboptimal memory allocation
>>>strategy that's somehow avoided when AF_PACKET pins the skb down.
>
>JFYI: same problem with 2.6.17-rc4-git5
JFYI: same problem with 2.6.17-rc6
^ permalink raw reply
* Re: [patch 5/9] secmark: Add secmark support to core networking.
From: James Morris @ 2006-06-09 8:18 UTC (permalink / raw)
To: David Miller; +Cc: akpm, netdev
In-Reply-To: <20060609.002953.70217215.davem@davemloft.net>
On Fri, 9 Jun 2006, David Miller wrote:
> Remember James, you're on the hook now to shrink sk_buff
> when you get a chance :-)
Yep, I remember.
--
James Morris
<jmorris@namei.org>
^ permalink raw reply
* Re: Using netconsole for debugging suspend/resume
From: Pavel Machek @ 2006-06-09 8:34 UTC (permalink / raw)
To: Jeremy Fitzhardinge; +Cc: Matt Mackall, Linux Kernel Mailing List, netdev
In-Reply-To: <44886381.9050506@goop.org>
On Čt 08-06-06 10:50:57, Jeremy Fitzhardinge wrote:
> I've been trying to get suspend/resume working well on my new laptop.
Suspend-to-disk or -to-ram? You know about suspend.sf.net, right?
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
^ permalink raw reply
* Re: [PATCH 2.6.17-rc6-mm1 ] net: RFC 3828-compliant UDP-Lite support
From: Gerrit Renker @ 2006-06-09 9:36 UTC (permalink / raw)
To: David Miller
Cc: jmorris, alan, kuznet, pekkas, yoshfuji, kaber, linux-kernel,
netdev
In-Reply-To: <20060608.151347.55505744.davem@davemloft.net>
Quoting David Miller:
| From: Gerrit Renker <gerrit@erg.abdn.ac.uk>
| Date: Thu, 8 Jun 2006 21:09:33 +0100
|
| > That is why I held back regarding the IPv6 port:
<snip>
|
| It's not like an ipv6 port is such a big pile of work.
|
I see the point and will port to v6 (have asked colleages for help).
Until then, I will keep an up-to-date (-mm) patch in the tarball
http://www.erg.abdn.ac.uk/users/gerrit/udp-lite/files/udplite_linux.tar.gz
This has applications as well. I would value any more input: the suggestion to
use SOCK_DGRAM has already been integrated and proved a really good idea (much less
to patch, cleaner code). Usually an update is there on the same day the new kernel
comes out.
Thank you for your replies and comments, I will be back when the v6 side is ready.
^ permalink raw reply
* Re: Using netconsole for debugging suspend/resume
From: Rafael J. Wysocki @ 2006-06-09 10:34 UTC (permalink / raw)
To: Jeremy Fitzhardinge; +Cc: Matt Mackall, Linux Kernel Mailing List, netdev
In-Reply-To: <4488D565.2020103@goop.org>
On Friday 09 June 2006 03:56, Jeremy Fitzhardinge wrote:
> Rafael J. Wysocki wrote:
> > Please try doing "echo 8 > /proc/sys/kernel/printk" before suspend.
> >
> Um, why? That would increase the amount of log output, but I don't see
> how it would help with netconsole preventing suspend, or not being able
> to see console messages on a blank screen after resume.
Ah, that's after resume. Sorry for the noise. :-)
Rafael
^ permalink raw reply
* [Fwd: Packet Lost] ip_rt_bug error
From: Vasantha Kumar Puttappa @ 2006-06-09 7:38 UTC (permalink / raw)
To: netdev
Hi,
I am working on a small application using iptables/libipq. In this, the
application would capture a specific packets based on the destination IP
address. Then I encapsulate this IP packet inside another new IP packet.
My problem is that the encapsulation part works fine in
kernel-2.6.11-6(mandriva 2005) and IPtables V 1.2.9.
(I can capture encapsulated packets using tcpdump at the sender side i.e,
packets are being put on to the network)
But this doesn't work in kernel-2.6.12-12(mandriva 2006) and the
IPtables-1.3.5(even though there are no erros after callig
ipq_set_verdict, the packets are not being put on to the channel. The
packets are getting lost after
the call to ipq_set_verdict)
/***
In my syslog I can see ip_rt_bug , but isn't ip_rt_bug occurs when
destiantion address is changed to local address ?
In my application I am changing destination IP to an another non-local IP
address.
****/
please let me know if you need more information
As you already have experience with these kinds of error plz help me out here
Thanx
^ permalink raw reply
* Re: Problem authenticating using WPA with bcm43xx-softmac
From: Johannes Berg @ 2006-06-09 11:44 UTC (permalink / raw)
To: Larry Finger; +Cc: Dan Williams, netdev, Jouni Malinen
In-Reply-To: <44871723.3040803@lwfinger.net>
[-- Attachment #1: Type: text/plain, Size: 895 bytes --]
On Wed, 2006-06-07 at 13:12 -0500, Larry Finger wrote:
> > (ie, add the "hh" before the x to tell the print that it's a char)
> >
> That doesn't work - the result is
>
> %hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx%hx
Looks like the kernel doesn't support that modifier.
> I changed the line to cast the output byte as a u8 as follows:
>
> dprintk("%.2x", (u8)mac->wpa.IE[i]);
>
> This produces the line
>
> generic IE set to dd160050f20101000050f20201000050f20201000050f202
>
> This is the WPA IE supplied by wpa_supplicant and it matches the one used in the ndiswrapper case.
> One mystery solved,
Yeah good :)
> but why doesn't it work?
No idea. If we had a dump maybe we could tell :/
> Johannes - should I submit the patch to fix this printout, or would you like to do it?
Please do.
johannes
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 793 bytes --]
^ permalink raw reply
* Re: [patch 1/8] myri10ge: alpha build fix
From: Brice Goglin @ 2006-06-09 11:46 UTC (permalink / raw)
To: akpm; +Cc: jeff, netdev
In-Reply-To: <200606090519.k595JfxP032014@shell0.pdx.osdl.net>
A similar fix is included in the myri10ge update that Jeff merged into
netdev yesterday.
thanks,
Brice
akpm@osdl.org wrote:
> From: Andrew Morton <akpm@osdl.org>
>
> drivers/net/myri10ge/myri10ge.c: In function 'myri10ge_submit_8rx':
> drivers/net/myri10ge/myri10ge.c:772: error: 'DMA_32BIT_MASK' undeclared (first use in this function)
> drivers/net/myri10ge/myri10ge.c:772: error: (Each undeclared identifier is reported only once
> drivers/net/myri10ge/myri10ge.c:772: error: for each function it appears in.)
> drivers/net/myri10ge/myri10ge.c: In function 'myri10ge_probe':
> drivers/net/myri10ge/myri10ge.c:2607: error: 'DMA_64BIT_MASK' undeclared (first use in this function)
> drivers/net/myri10ge/myri10ge.c:2612: error: 'DMA_32BIT_MASK' undeclared (first use in this function)
>
> Cc: Brice Goglin <brice@myri.com>
> Cc: Jeff Garzik <jeff@garzik.org>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> ---
>
> drivers/net/myri10ge/myri10ge.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff -puN drivers/net/myri10ge/myri10ge.c~myri10ge-alpha-build-fix drivers/net/myri10ge/myri10ge.c
> --- devel/drivers/net/myri10ge/myri10ge.c~myri10ge-alpha-build-fix 2006-06-03 21:13:30.000000000 -0700
> +++ devel-akpm/drivers/net/myri10ge/myri10ge.c 2006-06-03 21:13:43.000000000 -0700
> @@ -59,6 +59,8 @@
> #include <linux/crc32.h>
> #include <linux/moduleparam.h>
> #include <linux/io.h>
> +#include <linux/dma-mapping.h>
> +
> #include <net/checksum.h>
> #include <asm/byteorder.h>
> #include <asm/io.h>
> _
>
^ permalink raw reply
* Re: Firewall question
From: Lennart Sorensen @ 2006-06-09 13:12 UTC (permalink / raw)
To: Andi Kleen; +Cc: Alex Davis, netfilter, netdev
In-Reply-To: <200606090543.24401.ak@suse.de>
On Fri, Jun 09, 2006 at 05:43:24AM +0200, Andi Kleen wrote:
> No one out on the internet, but it would be trivial for someone outside
> his house. All his traffic will be on a long unsecured cable.
>
> That is why I would never bridge home ethernet traffic onto a DSL line.
Hmm, traffic sent between his machines would not go over the DSL since
the MAC address doesn't match the DSL modem (I would think so at
least). It would be a mess if the DSL modem tried to forwards all
traffic on an ethernet segment (well it doesn't have the bandwidth for
sure). Maybe I am incorrectly assuming the DSL modem only forwards the
PPPoE traffic being sent at it. I could see broadcast traffic being
forwarded, although arps and such are generally not that interesting.
Len Sorensen
^ permalink raw reply
* Re: [PATCH 2.6.17-rc6-mm1 ] net: RFC 3828-compliant UDP-Lite support
From: YOSHIFUJI Hideaki / 吉藤英明 @ 2006-06-09 13:29 UTC (permalink / raw)
To: gerrit
Cc: davem, jmorris, alan, kuznet, pekkas, kaber, linux-kernel, netdev,
yoshfuji
In-Reply-To: <200606091036.42075.gerrit@erg.abdn.ac.uk>
In article <200606091036.42075.gerrit@erg.abdn.ac.uk> (at Fri, 9 Jun 2006 10:36:41 +0100), Gerrit Renker <gerrit@erg.abdn.ac.uk> says:
> Thank you for your replies and comments, I will be back when the v6 side is ready.
Please fix the following as well.
1. Put your code in net/ipv4, probably as udplite.c, and remove net/udp-lite/.
Similarly, plasse put implementation as net/ipv6/udplite.c.
2. Eliminate any cosmetic changes (space, new-line, coding style etc.);
minimize diffs between udp.c udplite.c
BTW, I cannot find descriptions about fragmentation of
UDP-Lite in the spec. Is it yours?
--
YOSHIFUJI Hideaki @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG-FP : 9022 65EB 1ECF 3AD1 0BDF 80D8 4807 F894 E062 0EEA
^ permalink raw reply
* [PATCH] ehea: IBM eHEA Ethernet Device Driver - first full release
From: Jan-Bernd Themann @ 2006-06-09 13:02 UTC (permalink / raw)
To: netdev; +Cc: meder, raisch, schickhj, themann, tklein
Hello,
here is the URL for our device driver. It is a tarball containing
a patch set for kernel 2.6.17-rc6. This version should compile
without warning.
http://prdownloads.sourceforge.net/ibmehcad/ehea_EHEA_0005_2.6.17-rc6.tgz?download
Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Changelog-by: Jan-Bernd Themann <themann@de.ibm.com>
Differences to patch set http://www.spinics.net/lists/netdev/msg05889.html
Changelog:
- Added Kconfig and Makefile patch in drivers/net
- Changed tarball to patches instead of .c files
Jan-Bernd
> Patches and new drivers should always go to the mailing
> list...... except for the case where they are too big to
> be posted to the mailing list. For that special case,
> a URL to a patch should be posted.
>
> Jeff
^ permalink raw reply
* Re: [patch 6/8] drivers/char/hw_random.c: remove assert()'s
From: Jeff Garzik @ 2006-06-09 14:19 UTC (permalink / raw)
To: akpm; +Cc: netdev, bunk
In-Reply-To: <200606090519.k595JlHj032029@shell0.pdx.osdl.net>
akpm@osdl.org wrote:
> From: Adrian Bunk <bunk@stusta.de>
>
> Remove the assert()'s from drivers/char/hw_random.c since you both needed
> to enable a manual option in the driver source to make them effective and
> they only covered some obviously impossible cases.
>
> Signed-off-by: Adrian Bunk <bunk@stusta.de>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
100% NAK. They are there, obviously, for driver debugging and
development. Just like libata's debug stuff, you certainly have to
enable them manually.
Until this driver goes away (real soon, right?), the debugging facility
should stay.
Jeff
^ permalink raw reply
* Re: netif_tx_disable vs netif_stop_queue (possible races?)
From: Daniel Drake @ 2006-06-09 15:29 UTC (permalink / raw)
To: Herbert Xu; +Cc: netdev, david-b
In-Reply-To: <E1FoYoi-0001gg-00@gondolin.me.apana.org.au>
Herbert Xu wrote:
> Daniel Drake <dsd@gentoo.org> wrote:
>> More specifically, we're talking about drivers/usb/net/usbnet.c and the
>> usbnet_disconnect() function. The race I am highlighting is that
>> usbnet's hard_start_xmit handler (usbnet_start_xmit) may be running when
>> the disconnect happens.
>>
>> Is this a possible scenario?
>
> It should be safe, if only because of the synchronize_net that occurs
> before a netdev can be freed.
Can I interpret your response as: If the TX queue is disabled in
advance, no hard_start_xmit functions will be running on any CPU after
synchronize_net() has returned?
The synchronize_net() code doesn't make it very clear.
Thanks,
Daniel
^ permalink raw reply
* Re: Problem authenticating using WPA with bcm43xx-softmac
From: Larry Finger @ 2006-06-09 15:31 UTC (permalink / raw)
To: Johannes Berg; +Cc: Dan Williams, netdev, Jouni Malinen
In-Reply-To: <1149853494.3864.6.camel@johannes.berg>
Johannes Berg wrote:
> On Wed, 2006-06-07 at 13:12 -0500, Larry Finger wrote:
>> but why doesn't it work?
>
> No idea. If we had a dump maybe we could tell :/
Do you mean a special dump, or is the kernel debug output and wpa_supplicant debug output sufficient?
Larry
^ permalink raw reply
* Re: Problem authenticating using WPA with bcm43xx-softmac
From: Johannes Berg @ 2006-06-09 15:34 UTC (permalink / raw)
To: Larry Finger; +Cc: Dan Williams, netdev
In-Reply-To: <44899462.6070002@lwfinger.net>
[-- Attachment #1: Type: text/plain, Size: 284 bytes --]
On Fri, 2006-06-09 at 10:31 -0500, Larry Finger wrote:
> Do you mean a special dump, or is the kernel debug output and wpa_supplicant debug output sufficient?
I was thinking of packet dumps but earlier you said you couldn't create
any so I'm out of ideas for now.
johannes
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 793 bytes --]
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox