* [PATCH 4/32] [TIPC] Corrected potential misuse of tipc_media_addr structure.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
include/net/tipc/tipc_bearer.h | 12 ++++++++++--
net/tipc/eth_media.c | 4 +++-
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/include/net/tipc/tipc_bearer.h b/include/net/tipc/tipc_bearer.h
index 098607c..e07136d 100644
--- a/include/net/tipc/tipc_bearer.h
+++ b/include/net/tipc/tipc_bearer.h
@@ -49,10 +49,18 @@ #include <linux/spinlock.h>
#define TIPC_MEDIA_TYPE_ETH 1
+/*
+ * Destination address structure used by TIPC bearers when sending messages
+ *
+ * IMPORTANT: The fields of this structure MUST be stored using the specified
+ * byte order indicated below, as the structure is exchanged between nodes
+ * as part of a link setup process.
+ */
+
struct tipc_media_addr {
- __u32 type;
+ __u32 type; /* bearer type (network byte order) */
union {
- __u8 eth_addr[6]; /* Ethernet bearer */
+ __u8 eth_addr[6]; /* 48 bit Ethernet addr (byte array) */
#if 0
/* Prototypes for other possible bearer types */
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index b646619..3ecb100 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -254,7 +254,9 @@ int tipc_eth_media_start(void)
if (eth_started)
return -EINVAL;
- memset(&bcast_addr, 0xff, sizeof(bcast_addr));
+ bcast_addr.type = htonl(TIPC_MEDIA_TYPE_ETH);
+ memset(&bcast_addr.dev_addr, 0xff, ETH_ALEN);
+
memset(eth_bearers, 0, sizeof(eth_bearers));
res = tipc_register_media(TIPC_MEDIA_TYPE_ETH, "eth",
--
1.4.0
^ permalink raw reply related
* [PATCH 5/32] [TIPC] Allow ports to receive multicast messages through native API.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
This fix prevents a kernel panic if an application mistakenly sends a
multicast message to TIPC's topology service or configuration service.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/port.c | 26 ++++++++++++++++----------
1 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 67e96cb..360920b 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -810,18 +810,20 @@ static void port_dispatcher_sigh(void *d
void *usr_handle;
int connected;
int published;
+ u32 message_type;
struct sk_buff *next = buf->next;
struct tipc_msg *msg = buf_msg(buf);
u32 dref = msg_destport(msg);
+ message_type = msg_type(msg);
+ if (message_type > TIPC_DIRECT_MSG)
+ goto reject; /* Unsupported message type */
+
p_ptr = tipc_port_lock(dref);
- if (!p_ptr) {
- /* Port deleted while msg in queue */
- tipc_reject_msg(buf, TIPC_ERR_NO_PORT);
- buf = next;
- continue;
- }
+ if (!p_ptr)
+ goto reject; /* Port deleted while msg in queue */
+
orig.ref = msg_origport(msg);
orig.node = msg_orignode(msg);
up_ptr = p_ptr->user_port;
@@ -832,7 +834,7 @@ static void port_dispatcher_sigh(void *d
if (unlikely(msg_errcode(msg)))
goto err;
- switch (msg_type(msg)) {
+ switch (message_type) {
case TIPC_CONN_MSG:{
tipc_conn_msg_event cb = up_ptr->conn_msg_cb;
@@ -874,6 +876,7 @@ static void port_dispatcher_sigh(void *d
&orig);
break;
}
+ case TIPC_MCAST_MSG:
case TIPC_NAMED_MSG:{
tipc_named_msg_event cb = up_ptr->named_msg_cb;
@@ -886,7 +889,8 @@ static void port_dispatcher_sigh(void *d
goto reject;
dseq.type = msg_nametype(msg);
dseq.lower = msg_nameinst(msg);
- dseq.upper = dseq.lower;
+ dseq.upper = (message_type == TIPC_NAMED_MSG)
+ ? dseq.lower : msg_nameupper(msg);
skb_pull(buf, msg_hdr_sz(msg));
cb(usr_handle, dref, &buf, msg_data(msg),
msg_data_sz(msg), msg_importance(msg),
@@ -899,7 +903,7 @@ static void port_dispatcher_sigh(void *d
buf = next;
continue;
err:
- switch (msg_type(msg)) {
+ switch (message_type) {
case TIPC_CONN_MSG:{
tipc_conn_shutdown_event cb =
@@ -931,6 +935,7 @@ err:
msg_data_sz(msg), msg_errcode(msg), &orig);
break;
}
+ case TIPC_MCAST_MSG:
case TIPC_NAMED_MSG:{
tipc_named_msg_err_event cb =
up_ptr->named_err_cb;
@@ -940,7 +945,8 @@ err:
break;
dseq.type = msg_nametype(msg);
dseq.lower = msg_nameinst(msg);
- dseq.upper = dseq.lower;
+ dseq.upper = (message_type == TIPC_NAMED_MSG)
+ ? dseq.lower : msg_nameupper(msg);
skb_pull(buf, msg_hdr_sz(msg));
cb(usr_handle, dref, &buf, msg_data(msg),
msg_data_sz(msg), msg_errcode(msg), &dseq);
--
1.4.0
^ permalink raw reply related
* [PATCH 3/32] [TIPC] Use correct upper bound when validating network zone number.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/core.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 3d0a8ee..31c7dd5 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -198,7 +198,7 @@ static int __init tipc_init(void)
tipc_max_publications = 10000;
tipc_max_subscriptions = 2000;
tipc_max_ports = delimit(CONFIG_TIPC_PORTS, 127, 65536);
- tipc_max_zones = delimit(CONFIG_TIPC_ZONES, 1, 511);
+ tipc_max_zones = delimit(CONFIG_TIPC_ZONES, 1, 255);
tipc_max_clusters = delimit(CONFIG_TIPC_CLUSTERS, 1, 1);
tipc_max_nodes = delimit(CONFIG_TIPC_NODES, 8, 2047);
tipc_max_slaves = delimit(CONFIG_TIPC_SLAVE_NODES, 0, 2047);
--
1.4.0
^ permalink raw reply related
* [PATCH 7/32] [TIPC] Multicast link failure now resets all links to "nacking" node.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
This fix prevents node from crashing.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/bcast.c | 32 +++++++++++---
net/tipc/link.c | 124 +++++++++++++++++++++++++++++++++++++++++++++---------
2 files changed, 128 insertions(+), 28 deletions(-)
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 2c4ecbe..00691b7 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -49,13 +49,19 @@ #include "bearer.h"
#include "name_table.h"
#include "bcast.h"
-
#define MAX_PKT_DEFAULT_MCAST 1500 /* bcast link max packet size (fixed) */
#define BCLINK_WIN_DEFAULT 20 /* bcast link window size (default) */
#define BCLINK_LOG_BUF_SIZE 0
+/*
+ * Loss rate for incoming broadcast frames; used to test retransmission code.
+ * Set to N to cause every N'th frame to be discarded; 0 => don't discard any.
+ */
+
+#define TIPC_BCAST_LOSS_RATE 0
+
/**
* struct bcbearer_pair - a pair of bearers used by broadcast link
* @primary: pointer to primary bearer
@@ -165,21 +171,18 @@ static int bclink_ack_allowed(u32 n)
* @after: sequence number of last packet to *not* retransmit
* @to: sequence number of last packet to retransmit
*
- * Called with 'node' locked, bc_lock unlocked
+ * Called with bc_lock locked
*/
static void bclink_retransmit_pkt(u32 after, u32 to)
{
struct sk_buff *buf;
- spin_lock_bh(&bc_lock);
buf = bcl->first_out;
while (buf && less_eq(buf_seqno(buf), after)) {
buf = buf->next;
}
- if (buf != NULL)
- tipc_link_retransmit(bcl, buf, mod(to - after));
- spin_unlock_bh(&bc_lock);
+ tipc_link_retransmit(bcl, buf, mod(to - after));
}
/**
@@ -399,7 +402,10 @@ int tipc_bclink_send_msg(struct sk_buff
*/
void tipc_bclink_recv_pkt(struct sk_buff *buf)
-{
+{
+#if (TIPC_BCAST_LOSS_RATE)
+ static int rx_count = 0;
+#endif
struct tipc_msg *msg = buf_msg(buf);
struct node* node = tipc_node_find(msg_prevnode(msg));
u32 next_in;
@@ -420,9 +426,13 @@ void tipc_bclink_recv_pkt(struct sk_buff
tipc_node_lock(node);
tipc_bclink_acknowledge(node, msg_bcast_ack(msg));
tipc_node_unlock(node);
+ spin_lock_bh(&bc_lock);
bcl->stats.recv_nacks++;
+ bcl->owner->next = node; /* remember requestor */
bclink_retransmit_pkt(msg_bcgap_after(msg),
msg_bcgap_to(msg));
+ bcl->owner->next = NULL;
+ spin_unlock_bh(&bc_lock);
} else {
tipc_bclink_peek_nack(msg_destnode(msg),
msg_bcast_tag(msg),
@@ -433,6 +443,14 @@ void tipc_bclink_recv_pkt(struct sk_buff
return;
}
+#if (TIPC_BCAST_LOSS_RATE)
+ if (++rx_count == TIPC_BCAST_LOSS_RATE) {
+ rx_count = 0;
+ buf_discard(buf);
+ return;
+ }
+#endif
+
tipc_node_lock(node);
receive:
deferred = node->bclink.deferred_head;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 955b87d..ba7d3f1 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1604,40 +1604,121 @@ void tipc_link_push_queue(struct link *l
tipc_bearer_schedule(l_ptr->b_ptr, l_ptr);
}
+static void link_reset_all(unsigned long addr)
+{
+ struct node *n_ptr;
+ char addr_string[16];
+ u32 i;
+
+ read_lock_bh(&tipc_net_lock);
+ n_ptr = tipc_node_find((u32)addr);
+ if (!n_ptr) {
+ read_unlock_bh(&tipc_net_lock);
+ return; /* node no longer exists */
+ }
+
+ tipc_node_lock(n_ptr);
+
+ warn("Resetting all links to %s\n",
+ addr_string_fill(addr_string, n_ptr->addr));
+
+ for (i = 0; i < MAX_BEARERS; i++) {
+ if (n_ptr->links[i]) {
+ link_print(n_ptr->links[i], TIPC_OUTPUT,
+ "Resetting link\n");
+ tipc_link_reset(n_ptr->links[i]);
+ }
+ }
+
+ tipc_node_unlock(n_ptr);
+ read_unlock_bh(&tipc_net_lock);
+}
+
+static void link_retransmit_failure(struct link *l_ptr, struct sk_buff *buf)
+{
+ struct tipc_msg *msg = buf_msg(buf);
+
+ warn("Retransmission failure on link <%s>\n", l_ptr->name);
+ tipc_msg_print(TIPC_OUTPUT, msg, ">RETR-FAIL>");
+
+ if (l_ptr->addr) {
+
+ /* Handle failure on standard link */
+
+ link_print(l_ptr, TIPC_OUTPUT, "Resetting link\n");
+ tipc_link_reset(l_ptr);
+
+ } else {
+
+ /* Handle failure on broadcast link */
+
+ struct node *n_ptr;
+ char addr_string[16];
+
+ tipc_printf(TIPC_OUTPUT, "Msg seq number: %u, ", msg_seqno(msg));
+ tipc_printf(TIPC_OUTPUT, "Outstanding acks: %u\n", (u32)TIPC_SKB_CB(buf)->handle);
+
+ n_ptr = l_ptr->owner->next;
+ tipc_node_lock(n_ptr);
+
+ addr_string_fill(addr_string, n_ptr->addr);
+ tipc_printf(TIPC_OUTPUT, "Multicast link info for %s\n", addr_string);
+ tipc_printf(TIPC_OUTPUT, "Supported: %d, ", n_ptr->bclink.supported);
+ tipc_printf(TIPC_OUTPUT, "Acked: %u\n", n_ptr->bclink.acked);
+ tipc_printf(TIPC_OUTPUT, "Last in: %u, ", n_ptr->bclink.last_in);
+ tipc_printf(TIPC_OUTPUT, "Gap after: %u, ", n_ptr->bclink.gap_after);
+ tipc_printf(TIPC_OUTPUT, "Gap to: %u\n", n_ptr->bclink.gap_to);
+ tipc_printf(TIPC_OUTPUT, "Nack sync: %u\n\n", n_ptr->bclink.nack_sync);
+
+ tipc_k_signal((Handler)link_reset_all, (unsigned long)n_ptr->addr);
+
+ tipc_node_unlock(n_ptr);
+
+ l_ptr->stale_count = 0;
+ }
+}
+
void tipc_link_retransmit(struct link *l_ptr, struct sk_buff *buf,
u32 retransmits)
{
struct tipc_msg *msg;
+ if (!buf)
+ return;
+
+ msg = buf_msg(buf);
+
dbg("Retransmitting %u in link %x\n", retransmits, l_ptr);
- if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr) && buf && !skb_cloned(buf)) {
- msg_dbg(buf_msg(buf), ">NO_RETR->BCONG>");
- dbg_print_link(l_ptr, " ");
- l_ptr->retransm_queue_head = msg_seqno(buf_msg(buf));
- l_ptr->retransm_queue_size = retransmits;
- return;
+ if (tipc_bearer_congested(l_ptr->b_ptr, l_ptr)) {
+ if (!skb_cloned(buf)) {
+ msg_dbg(msg, ">NO_RETR->BCONG>");
+ dbg_print_link(l_ptr, " ");
+ l_ptr->retransm_queue_head = msg_seqno(msg);
+ l_ptr->retransm_queue_size = retransmits;
+ return;
+ } else {
+ /* Don't retransmit if driver already has the buffer */
+ }
+ } else {
+ /* Detect repeated retransmit failures on uncongested bearer */
+
+ if (l_ptr->last_retransmitted == msg_seqno(msg)) {
+ if (++l_ptr->stale_count > 100) {
+ link_retransmit_failure(l_ptr, buf);
+ return;
+ }
+ } else {
+ l_ptr->last_retransmitted = msg_seqno(msg);
+ l_ptr->stale_count = 1;
+ }
}
+
while (retransmits && (buf != l_ptr->next_out) && buf && !skb_cloned(buf)) {
msg = buf_msg(buf);
msg_set_ack(msg, mod(l_ptr->next_in_no - 1));
msg_set_bcast_ack(msg, l_ptr->owner->bclink.last_in);
if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
- /* Catch if retransmissions fail repeatedly: */
- if (l_ptr->last_retransmitted == msg_seqno(msg)) {
- if (++l_ptr->stale_count > 100) {
- tipc_msg_print(TIPC_CONS, buf_msg(buf), ">RETR>");
- info("...Retransmitted %u times\n",
- l_ptr->stale_count);
- link_print(l_ptr, TIPC_CONS, "Resetting Link\n");
- tipc_link_reset(l_ptr);
- break;
- }
- } else {
- l_ptr->stale_count = 0;
- }
- l_ptr->last_retransmitted = msg_seqno(msg);
-
msg_dbg(buf_msg(buf), ">RETR>");
buf = buf->next;
retransmits--;
@@ -1650,6 +1731,7 @@ void tipc_link_retransmit(struct link *l
return;
}
}
+
l_ptr->retransm_queue_head = l_ptr->retransm_queue_size = 0;
}
--
1.4.0
^ permalink raw reply related
* [PATCH 6/32] [TIPC] Links now validate destination node specified by incoming messages.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
This fix prevents link flopping and name table inconsistency problems arising
when a node is assigned a different <Z.C.N> value than it used previously.
(Changing the <Z.C.N> value causes other nodes to have two link endpoints
sending to the same MAC address using two different destination <Z.C.N> values,
requiring the receiving node to filter out the unwanted messages.)
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/link.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 784b24b..955b87d 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1720,6 +1720,11 @@ #endif
link_recv_non_seq(buf);
continue;
}
+
+ if (unlikely(!msg_short(msg) &&
+ (msg_destnode(msg) != tipc_own_addr)))
+ goto cont;
+
n_ptr = tipc_node_find(msg_prevnode(msg));
if (unlikely(!n_ptr))
goto cont;
--
1.4.0
^ permalink raw reply related
* [PATCH 8/32] [TIPC] Allow compilation when CONFIG_TIPC_DEBUG is not set.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/core.h | 19 ++++++++++++++-----
1 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 1f2e8b2..d1edb7a 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -2,7 +2,7 @@
* net/tipc/core.h: Include file for TIPC global declarations
*
* Copyright (c) 2005-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -111,10 +111,6 @@ #endif
#else
-#ifndef DBG_OUTPUT
-#define DBG_OUTPUT NULL
-#endif
-
/*
* TIPC debug support not included:
* - system messages are printed to system console
@@ -129,6 +125,19 @@ #define dbg(fmt, arg...) do {} while (0)
#define msg_dbg(msg,txt) do {} while (0)
#define dump(fmt,arg...) do {} while (0)
+
+/*
+ * TIPC_OUTPUT is defined to be the system console, while DBG_OUTPUT is
+ * the null print buffer. Thes ensures that any system or debug messages
+ * that are generated without using the above macros are handled correctly.
+ */
+
+#undef TIPC_OUTPUT
+#define TIPC_OUTPUT TIPC_CONS
+
+#undef DBG_OUTPUT
+#define DBG_OUTPUT NULL
+
#endif
--
1.4.0
^ permalink raw reply related
* [PATCH 2/32] [TIPC] Prevent name table corruption if no room for new publication
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Now exits cleanly if attempt to allocate larger array of subsequences fails,
without losing track of pointer to existing array.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/name_table.c | 18 +++++++++---------
1 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index d129422..0511436 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -284,18 +284,18 @@ static struct publication *tipc_nameseq_
/* Ensure there is space for new sub-sequence */
if (nseq->first_free == nseq->alloc) {
- struct sub_seq *sseqs = nseq->sseqs;
- nseq->sseqs = tipc_subseq_alloc(nseq->alloc * 2);
- if (nseq->sseqs != NULL) {
- memcpy(nseq->sseqs, sseqs,
- nseq->alloc * sizeof (struct sub_seq));
- kfree(sseqs);
- dbg("Allocated %u sseqs\n", nseq->alloc);
- nseq->alloc *= 2;
- } else {
+ struct sub_seq *sseqs = tipc_subseq_alloc(nseq->alloc * 2);
+
+ if (!sseqs) {
warn("Memory squeeze; failed to create sub-sequence\n");
return NULL;
}
+ dbg("Allocated %u more sseqs\n", nseq->alloc);
+ memcpy(sseqs, nseq->sseqs,
+ nseq->alloc * sizeof(struct sub_seq));
+ kfree(nseq->sseqs);
+ nseq->sseqs = sseqs;
+ nseq->alloc *= 2;
}
dbg("Have %u sseqs for type %u\n", nseq->alloc, type);
--
1.4.0
^ permalink raw reply related
* [PATCH 10/32] [TIPC] Fixed privilege checking typo in dest_name_check().
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
This patch originated by Stephane Ouellette <ouellettes@videotron.ca>.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 648a734..eaf4d69 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -426,7 +426,7 @@ static int dest_name_check(struct sockad
if (copy_from_user(&hdr, m->msg_iov[0].iov_base, sizeof(hdr)))
return -EFAULT;
- if ((ntohs(hdr.tcm_type) & 0xC000) & (!capable(CAP_NET_ADMIN)))
+ if ((ntohs(hdr.tcm_type) & 0xC000) && (!capable(CAP_NET_ADMIN)))
return -EACCES;
return 0;
--
1.4.0
^ permalink raw reply related
* [PATCH 9/32] [TIPC] Fix for NULL pointer dereference
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Eric Sesterhenn
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Eric Sesterhenn <snakebyte@gmx.de>
This fixes a bug spotted by the coverity checker, bug id #366. If
(mod(seqno - prev) != 1) we set buf to NULL, dereference it in the for
case, and set it to whatever value happes to be at adress 0+next, if it
happens to be non-zero, we even stay in the loop. It seems that the author
intended to break there.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/bcast.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 00691b7..44645f5 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -349,8 +349,10 @@ static void tipc_bclink_peek_nack(u32 de
for (; buf; buf = buf->next) {
u32 seqno = buf_seqno(buf);
- if (mod(seqno - prev) != 1)
+ if (mod(seqno - prev) != 1) {
buf = NULL;
+ break;
+ }
if (seqno == gap_after)
break;
prev = seqno;
--
1.4.0
^ permalink raw reply related
* [PATCH 1/32] [TIPC] Improved tolerance to promiscuous mode interface
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Jon Maloy
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/eth_media.c | 20 +++++++++++---------
1 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 7a25278..b646619 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -98,17 +98,19 @@ static int recv_msg(struct sk_buff *buf,
u32 size;
if (likely(eb_ptr->bearer)) {
- size = msg_size((struct tipc_msg *)buf->data);
- skb_trim(buf, size);
- if (likely(buf->len == size)) {
- buf->next = NULL;
- tipc_recv_msg(buf, eb_ptr->bearer);
- } else {
- kfree_skb(buf);
+ if (likely(!dev->promiscuity) ||
+ !memcmp(buf->mac.raw,dev->dev_addr,ETH_ALEN) ||
+ !memcmp(buf->mac.raw,dev->broadcast,ETH_ALEN)) {
+ size = msg_size((struct tipc_msg *)buf->data);
+ skb_trim(buf, size);
+ if (likely(buf->len == size)) {
+ buf->next = NULL;
+ tipc_recv_msg(buf, eb_ptr->bearer);
+ return TIPC_OK;
+ }
}
- } else {
- kfree_skb(buf);
}
+ kfree_skb(buf);
return TIPC_OK;
}
--
1.4.0
^ permalink raw reply related
* [PATCH 16/32] [TIPC] Implied connect now saves dest name for retrieval as ancillary data.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 758b2d2..98550b9 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -470,6 +470,10 @@ static int send_msg(struct kiocb *iocb,
if ((tsock->p->published) ||
((sock->type == SOCK_STREAM) && (total_len != 0)))
return -EOPNOTSUPP;
+ if (dest->addrtype == TIPC_ADDR_NAME) {
+ tsock->p->conn_type = dest->addr.name.name.type;
+ tsock->p->conn_instance = dest->addr.name.name.instance;
+ }
}
if (down_interruptible(&tsock->sem))
@@ -1269,10 +1273,6 @@ static int connect(struct socket *sock,
msg = buf_msg(buf);
res = auto_connect(sock, tsock, msg);
if (!res) {
- if (dst->addrtype == TIPC_ADDR_NAME) {
- tsock->p->conn_type = dst->addr.name.name.type;
- tsock->p->conn_instance = dst->addr.name.name.instance;
- }
if (!msg_data_sz(msg))
advance_queue(tsock);
}
--
1.4.0
^ permalink raw reply related
* [PATCH 12/32] [TIPC] Added support for MODULE_VERSION capability.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/core.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 31c7dd5..5003acb 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -2,7 +2,7 @@
* net/tipc/core.c: TIPC module code
*
* Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -57,7 +57,7 @@ void tipc_socket_stop(void);
int tipc_netlink_start(void);
void tipc_netlink_stop(void);
-#define MOD_NAME "tipc_start: "
+#define TIPC_MOD_VER "1.6.1"
#ifndef CONFIG_TIPC_ZONES
#define CONFIG_TIPC_ZONES 3
@@ -224,6 +224,7 @@ module_exit(tipc_exit);
MODULE_DESCRIPTION("TIPC: Transparent Inter Process Communication");
MODULE_LICENSE("Dual BSD/GPL");
+MODULE_VERSION(TIPC_MOD_VER);
/* Native TIPC API for kernel-space applications (see tipc.h) */
--
1.4.0
^ permalink raw reply related
* [PATCH 17/32] [TIPC] Can now return destination name of form {0,x,y} via ancillary data.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 98550b9..361dc34 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -731,6 +731,7 @@ static int anc_data_recv(struct msghdr *
u32 anc_data[3];
u32 err;
u32 dest_type;
+ int has_name;
int res;
if (likely(m->msg_controllen == 0))
@@ -755,24 +756,27 @@ static int anc_data_recv(struct msghdr *
dest_type = msg ? msg_type(msg) : TIPC_DIRECT_MSG;
switch (dest_type) {
case TIPC_NAMED_MSG:
+ has_name = 1;
anc_data[0] = msg_nametype(msg);
anc_data[1] = msg_namelower(msg);
anc_data[2] = msg_namelower(msg);
break;
case TIPC_MCAST_MSG:
+ has_name = 1;
anc_data[0] = msg_nametype(msg);
anc_data[1] = msg_namelower(msg);
anc_data[2] = msg_nameupper(msg);
break;
case TIPC_CONN_MSG:
+ has_name = (tport->conn_type != 0);
anc_data[0] = tport->conn_type;
anc_data[1] = tport->conn_instance;
anc_data[2] = tport->conn_instance;
break;
default:
- anc_data[0] = 0;
+ has_name = 0;
}
- if (anc_data[0] &&
+ if (has_name &&
(res = put_cmsg(m, SOL_SOCKET, TIPC_DESTNAME, 12, anc_data)))
return res;
--
1.4.0
^ permalink raw reply related
* [PATCH 11/32] [TIPC] Fix misleading comment in buf_discard() routine.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/core.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/tipc/core.h b/net/tipc/core.h
index d1edb7a..86f54f3 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -318,7 +318,7 @@ static inline struct sk_buff *buf_acquir
* buf_discard - frees a TIPC message buffer
* @skb: message buffer
*
- * Frees a new buffer. If passed NULL, just returns.
+ * Frees a message buffer. If passed NULL, just returns.
*/
static inline void buf_discard(struct sk_buff *skb)
--
1.4.0
^ permalink raw reply related
* [PATCH 26/32] [TIPC] Fixed memory leak in tipc_link_send() when destination is unreachable
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/link.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index ba7d3f1..ff40c91 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1135,9 +1135,13 @@ int tipc_link_send(struct sk_buff *buf,
if (n_ptr) {
tipc_node_lock(n_ptr);
l_ptr = n_ptr->active_links[selector & 1];
- dbg("tipc_link_send: found link %x for dest %x\n", l_ptr, dest);
if (l_ptr) {
+ dbg("tipc_link_send: found link %x for dest %x\n", l_ptr, dest);
res = tipc_link_send_buf(l_ptr, buf);
+ } else {
+ dbg("Attempt to send msg to unreachable node:\n");
+ msg_dbg(buf_msg(buf),">>>");
+ buf_discard(buf);
}
tipc_node_unlock(n_ptr);
} else {
--
1.4.0
^ permalink raw reply related
* [PATCH 23/32] [TIPC] Optimized argument validation done by connect().
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 17 +++++++++++++----
1 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 6d4d2b0..32d7784 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -455,7 +455,8 @@ static int send_msg(struct kiocb *iocb,
if (unlikely(!dest))
return -EDESTADDRREQ;
- if (unlikely(dest->family != AF_TIPC))
+ if (unlikely((m->msg_namelen < sizeof(*dest)) ||
+ (dest->family != AF_TIPC)))
return -EINVAL;
needs_conn = (sock->state != SS_READY);
@@ -1245,7 +1246,8 @@ static int connect(struct socket *sock,
if (sock->state == SS_READY)
return -EOPNOTSUPP;
- /* MOVE THE REST OF THIS ERROR CHECKING TO send_msg()? */
+ /* Issue Posix-compliant error code if socket is in the wrong state */
+
if (sock->state == SS_LISTENING)
return -EOPNOTSUPP;
if (sock->state == SS_CONNECTING)
@@ -1253,13 +1255,20 @@ static int connect(struct socket *sock,
if (sock->state != SS_UNCONNECTED)
return -EISCONN;
- if ((destlen < sizeof(*dst)) || (dst->family != AF_TIPC) ||
- ((dst->addrtype != TIPC_ADDR_NAME) && (dst->addrtype != TIPC_ADDR_ID)))
+ /*
+ * Reject connection attempt using multicast address
+ *
+ * Note: send_msg() validates the rest of the address fields,
+ * so there's no need to do it here
+ */
+
+ if (dst->addrtype == TIPC_ADDR_MCAST)
return -EINVAL;
/* Send a 'SYN-' to destination */
m.msg_name = dest;
+ m.msg_namelen = destlen;
if ((res = send_msg(NULL, sock, &m, 0)) < 0) {
sock->state = SS_DISCONNECTING;
return res;
--
1.4.0
^ permalink raw reply related
* [PATCH 18/32] [TIPC] Connected send now checks socket state when retrying congested send.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 16 ++++++++--------
1 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 361dc34..9c834fc 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -565,15 +565,15 @@ static int send_packet(struct kiocb *ioc
return -ERESTARTSYS;
}
- if (unlikely(sock->state != SS_CONNECTED)) {
- if (sock->state == SS_DISCONNECTING)
- res = -EPIPE;
- else
- res = -ENOTCONN;
- goto exit;
- }
-
do {
+ if (unlikely(sock->state != SS_CONNECTED)) {
+ if (sock->state == SS_DISCONNECTING)
+ res = -EPIPE;
+ else
+ res = -ENOTCONN;
+ goto exit;
+ }
+
res = tipc_send(tsock->p->ref, m->msg_iovlen, m->msg_iov);
if (likely(res != -ELINKCONG)) {
exit:
--
1.4.0
^ permalink raw reply related
* [PATCH 20/32] [TIPC] Improved performance of error checking during socket creation.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 9 +++------
1 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 8cefacb..a1f2210 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -169,12 +169,6 @@ static int tipc_create(struct socket *so
struct sock *sk;
u32 ref;
- if ((sock->type != SOCK_STREAM) &&
- (sock->type != SOCK_SEQPACKET) &&
- (sock->type != SOCK_DGRAM) &&
- (sock->type != SOCK_RDM))
- return -EPROTOTYPE;
-
if (unlikely(protocol != 0))
return -EPROTONOSUPPORT;
@@ -199,6 +193,9 @@ static int tipc_create(struct socket *so
sock->ops = &msg_ops;
sock->state = SS_READY;
break;
+ default:
+ tipc_deleteport(ref);
+ return -EPROTOTYPE;
}
sk = sk_alloc(AF_TIPC, GFP_KERNEL, &tipc_proto, 1);
--
1.4.0
^ permalink raw reply related
* [PATCH 21/32] [TIPC] recvmsg() now returns TIPC ancillary data using correct level (SOL_TIPC)
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index a1f2210..abecf2d 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -744,10 +744,10 @@ static int anc_data_recv(struct msghdr *
if (unlikely(err)) {
anc_data[0] = err;
anc_data[1] = msg_data_sz(msg);
- if ((res = put_cmsg(m, SOL_SOCKET, TIPC_ERRINFO, 8, anc_data)))
+ if ((res = put_cmsg(m, SOL_TIPC, TIPC_ERRINFO, 8, anc_data)))
return res;
if (anc_data[1] &&
- (res = put_cmsg(m, SOL_SOCKET, TIPC_RETDATA, anc_data[1],
+ (res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1],
msg_data(msg))))
return res;
}
@@ -778,7 +778,7 @@ static int anc_data_recv(struct msghdr *
has_name = 0;
}
if (has_name &&
- (res = put_cmsg(m, SOL_SOCKET, TIPC_DESTNAME, 12, anc_data)))
+ (res = put_cmsg(m, SOL_TIPC, TIPC_DESTNAME, 12, anc_data)))
return res;
return 0;
--
1.4.0
^ permalink raw reply related
* [PATCH 24/32] [TIPC] Withdrawing all names from nameless port now returns success, not error
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/port.c | 3 ---
1 files changed, 0 insertions(+), 3 deletions(-)
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 360920b..899e08e 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -1171,8 +1171,6 @@ int tipc_withdraw(u32 ref, unsigned int
p_ptr = tipc_port_lock(ref);
if (!p_ptr)
return -EINVAL;
- if (!p_ptr->publ.published)
- goto exit;
if (!seq) {
list_for_each_entry_safe(publ, tpubl,
&p_ptr->publications, pport_list) {
@@ -1199,7 +1197,6 @@ int tipc_withdraw(u32 ref, unsigned int
}
if (list_empty(&p_ptr->publications))
p_ptr->publ.published = 0;
-exit:
tipc_port_unlock(p_ptr);
return res;
}
--
1.4.0
^ permalink raw reply related
* [PATCH 22/32] [TIPC] Simplify code for returning partial success of stream send request.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index abecf2d..6d4d2b0 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -969,7 +969,7 @@ static int recv_stream(struct kiocb *ioc
restart:
if (unlikely((skb_queue_len(&sock->sk->sk_receive_queue) == 0) &&
(flags & MSG_DONTWAIT))) {
- res = (sz_copied == 0) ? -EWOULDBLOCK : 0;
+ res = -EWOULDBLOCK;
goto exit;
}
@@ -1060,7 +1060,7 @@ restart:
exit:
up(&tsock->sem);
- return res ? res : sz_copied;
+ return sz_copied ? sz_copied : res;
}
/**
--
1.4.0
^ permalink raw reply related
* [PATCH 25/32] [TIPC] Added missing warning for out-of-memory condition
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/port.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 899e08e..99846a1 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -1061,6 +1061,7 @@ int tipc_createport(u32 user_ref,
up_ptr = (struct user_port *)kmalloc(sizeof(*up_ptr), GFP_ATOMIC);
if (up_ptr == NULL) {
+ warn("Port creation failed, no memory\n");
return -ENOMEM;
}
ref = tipc_createport_raw(NULL, port_dispatcher, port_wakeup, importance);
--
1.4.0
^ permalink raw reply related
* [PATCH 14/32] [TIPC] Non-operation-affecting corrections to comments & function definitions.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 12 +++++++-----
1 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index eaf4d69..0923213 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -437,7 +437,7 @@ static int dest_name_check(struct sockad
* @iocb: (unused)
* @sock: socket structure
* @m: message to send
- * @total_len: (unused)
+ * @total_len: length of message
*
* Message must have an destination specified explicitly.
* Used for SOCK_RDM and SOCK_DGRAM messages,
@@ -538,7 +538,7 @@ exit:
* @iocb: (unused)
* @sock: socket structure
* @m: message to send
- * @total_len: (unused)
+ * @total_len: length of message
*
* Used for SOCK_SEQPACKET messages and SOCK_STREAM data.
*
@@ -1386,7 +1386,7 @@ exit:
/**
* shutdown - shutdown socket connection
* @sock: socket structure
- * @how: direction to close (always treated as read + write)
+ * @how: direction to close (unused; always treated as read + write)
*
* Terminates connection (if necessary), then purges socket's receive queue.
*
@@ -1469,7 +1469,8 @@ restart:
* Returns 0 on success, errno otherwise
*/
-static int setsockopt(struct socket *sock, int lvl, int opt, char *ov, int ol)
+static int setsockopt(struct socket *sock,
+ int lvl, int opt, char __user *ov, int ol)
{
struct tipc_sock *tsock = tipc_sk(sock->sk);
u32 value;
@@ -1525,7 +1526,8 @@ static int setsockopt(struct socket *soc
* Returns 0 on success, errno otherwise
*/
-static int getsockopt(struct socket *sock, int lvl, int opt, char *ov, int *ol)
+static int getsockopt(struct socket *sock,
+ int lvl, int opt, char __user *ov, int *ol)
{
struct tipc_sock *tsock = tipc_sk(sock->sk);
int len;
--
1.4.0
^ permalink raw reply related
* [PATCH 13/32] [TIPC] Validate entire interface name when locating bearer to enable.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
This fix prevents a bearer from being enabled using the wrong interface.
For example, specifying "eth:eth14" might enable "eth:eth1" by mistake.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/eth_media.c | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 3ecb100..682da4a 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -2,7 +2,7 @@
* net/tipc/eth_media.c: Ethernet bearer support for TIPC
*
* Copyright (c) 2001-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -127,8 +127,7 @@ static int enable_bearer(struct tipc_bea
/* Find device with specified name */
- while (dev && dev->name &&
- (memcmp(dev->name, driver_name, strlen(dev->name)))) {
+ while (dev && dev->name && strncmp(dev->name, driver_name, IFNAMSIZ)) {
dev = dev->next;
}
if (!dev)
--
1.4.0
^ permalink raw reply related
* [PATCH 15/32] [TIPC] Fixed connect() to detect a dest address that is missing or too short.
From: Per Liden @ 2006-06-22 13:59 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Allan Stephens
In-Reply-To: <Pine.LNX.4.64.0606221233570.15853@ulinpc219.uab.ericsson.se>
From: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: Per Liden <per.liden@ericsson.com>
---
net/tipc/socket.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 0923213..758b2d2 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1244,7 +1244,7 @@ static int connect(struct socket *sock,
if (sock->state != SS_UNCONNECTED)
return -EISCONN;
- if ((dst->family != AF_TIPC) ||
+ if ((destlen < sizeof(*dst)) || (dst->family != AF_TIPC) ||
((dst->addrtype != TIPC_ADDR_NAME) && (dst->addrtype != TIPC_ADDR_ID)))
return -EINVAL;
--
1.4.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox