- 07 Jan, 2013 1 commit
-
-
Eric Dumazet authored
commit 35f9c09f (tcp: tcp_sendpages() should call tcp_push() once) added an internal flag : MSG_SENDPAGE_NOTLAST meant to be set on all frags but the last one for a splice() call. The condition used to set the flag in pipe_to_sendpage() relied on splice() user passing the exact number of bytes present in the pipe, or a smaller one. But some programs pass an arbitrary high value, and the test fails. The effect of this bug is a lack of tcp_push() at the end of a splice(pipe -> socket) call, and possibly very slow or erratic TCP sessions. We should both test sd->total_len and fact that another fragment is in the pipe (pipe->nrbufs > 1) Many thanks to Willy for providing very clear bug report, bisection and test programs. Reported-by:
Willy Tarreau <w@1wt.eu> Bisected-by:
Willy Tarreau <w@1wt.eu> Tested-by:
Willy Tarreau <w@1wt.eu> Signed-off-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- 04 Jan, 2013 6 commits
-
-
Philippe De Muyter authored
Up to now, the debug and info messages from the ipconfig subsytem claim to display the IP address of the DHCP/BOOTP server but display instead the IP address of the bootserver. Fix that. Signed-off-by:
Philippe De Muyter <phdm@macqel.be> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
stephen hemminger authored
Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Alexander Aring authored
When using nanosleep() in an userspace application we get a ratelimit warning NOHZ: local_softirq_pending 08 for 10 times. This patch replaces netif_rx() with netif_rx_ni() which has to be used from process/softirq context. The process/softirq context will be called from fakelb driver. See linux-kernel commit 481a8199 for similar fix. Signed-off-by:
Alexander Aring <alex.aring@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Hannes Frederic Sowa authored
I slipped in a new sysctl without proper documentation. I would like to make up for this now. Signed-off-by:
Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
John W. Linville authored
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
-
Vladimir Kondratiev authored
Ath9k consists of 2 different sub-modules: ATH9K and ATH9K_HTC. Both uses common Atheros code from ath.ko and need ATH_COMMON. However, while ATH9K selects ATH_COMMON, ATH9K_HTC does not. As result, if ATH9K_HTC is the only Atheros card selected, compilation fails with unresolved symbols. This patch moves ATH_COMMON selection to the common part for both ATH9K and ATH9K_HTC Signed-off-by:
Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
- 03 Jan, 2013 3 commits
-
-
Rami Rosen authored
This patch adds empty br_mdb_init() and br_mdb_uninit() definitions in br_private.h to avoid build failure when CONFIG_BRIDGE_IGMP_SNOOPING is not set. These methods were moved from br_multicast.c to br_netlink.c by commit 3ec8e9f0Signed-off-by:
Rami Rosen <ramirose@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
stephen hemminger authored
The VXLAN pseudo-device doesn't care if the mac address changes when device is up. Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Reviewed-by:
Jiri Pirko <jiri@resnulli.us> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Vlad Yasevich authored
Commit 63233159: bridge: Do not unregister all PF_BRIDGE rtnl operations introduced a bug where a removal of a single bridge from a multi-bridge system would remove MDB netlink handlers. The handlers should only be removed once all bridges are gone, but since we don't keep track of the number of bridge interfaces, it's simpler to do it when the bridge module is unloaded. To make it consistent, move the registration code into module initialization code path. Signed-off-by:
Vlad Yasevich <vyasevic@redhat.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- 02 Jan, 2013 18 commits
-
-
Hante Meuleman authored
RSN IEs got incorrectly parsed and therefore ap mode using WPA2 security was not working. Cc: stable@vger.kernel.org Reviewed-by:
Arend Van Spriel <arend@broadcom.com> Reviewed-by:
Pieter-Paul Giesberts <pieterpg@broadcom.com> Signed-off-by:
Hante Meuleman <meuleman@broadcom.com> Signed-off-by:
Arend van Spriel <arend@broadcom.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Arend van Spriel authored
Patches from Canonical involved the introduction of new source files debug.[ch]. That coincided with other patches from Broadcom introducing the same files. Cc: Seth Forshee <seth.forshee@canonical.com> Reviewed-by:
Pieter-Paul Giesberts <pieterpg@broadcom.com> Reviewed-by:
Piotr Haber <phaber@broadcom.com> Signed-off-by:
Arend van Spriel <arend@broadcom.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Larry Finger authored
Kernel 3.8 implements checking of all DMA mapping calls and issues a WARNING for the first it finds that is not checked. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Larry Finger authored
Kernel 3.8 implements checking of all DMA mapping calls and issues a WARNING for the first it finds that is not checked. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Larry Finger authored
Kernel 3.8 implements checking of all DMA mapping calls and issues a WARNING for the first it finds that is not checked. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Larry Finger authored
Kernel 3.8 implements checking of all DMA mapping calls and issues a WARNING for the first it finds that is not checked. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Larry Finger authored
Kernel 3.8 implements checking of all DMA mapping calls and issues a WARNING for the first it finds that is not checked. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Christian Lamparter authored
This patch adds USBIDs for: - DrayTek Vigor 530 - Zoom 4410a It also adds a note about Gemtek WUBI-100GW and SparkLAN WL-682 USBID conflict [WUBI-100GW is a ISL3886+NET2280 (LM86 firmare) solution, whereas WL-682 is a ISL3887 (LM87 firmware)] device. Source: <http://www.wikidevi.com/wiki/Intersil/p54/usb/windows> Cc: <stable@vger.kernel.org> Signed-off-by:
Christian Lamparter <chunkeey@googlemail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Jesper Juhl authored
We fail to release 'urb' if '_rtl_prep_rx_urb()' fails in _rtl_usb_receive(). This patch should take care of the leak. Signed-off-by:
Jesper Juhl <jj@chaosbits.net> Acked-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Sujith Manoharan authored
Populate iniModesRxGain with the correct initvals array for AR9485 v1.1 Cc: stable@vger.kernel.org Signed-off-by:
Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Rafał Miłecki authored
Signed-off-by:
Rafał Miłecki <zajec5@gmail.com> Acked-by:
Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Niels Ole Salscheider authored
wlc_lcnphy_rx_iq_cal_gain is called during initialization, i. e. when executing brcms_up. But brcms_up is called from brcms_ops_start while the latter holds a spin lock. Thus, we cannot use usleep_range but have to use udelay. This fixes: BUG: scheduling while atomic: NetworkManager/1652/0x00000200 [...] Call Trace: [<ffffffff81582522>] __schedule_bug+0x48/0x54 [<ffffffff815892b6>] __schedule+0x596/0x6d0 [<ffffffff81589719>] schedule+0x29/0x70 [<ffffffff8158893c>] schedule_hrtimeout_range_clock+0xfc/0x140 [<ffffffff81060f10>] ? update_rmtp+0x70/0x70 [<ffffffff81588993>] schedule_hrtimeout_range+0x13/0x20 [<ffffffff810495e0>] usleep_range+0x40/0x50 [<ffffffffa05dedcb>] wlc_lcnphy_rx_iq_cal.constprop.10+0x59b/0xa90 [brcmsmac] [<ffffffffa05df4ce>] wlc_lcnphy_periodic_cal+0x20e/0x220 [brcmsmac] [<ffffffffa05dce8d>] ? wlc_lcnphy_set_tx_pwr_ctrl+0x21d/0x3c0 [brcmsmac] [<ffffffffa05e0cfc>] wlc_phy_init_lcnphy+0xacc/0x1100 [brcmsmac] [<ffffffffa05e0230>] ? wlc_phy_txpower_recalc_target_lcnphy+0x90/0x90 [brcmsmac] [<ffffffffa05d7c7d>] wlc_phy_init+0xcd/0x170 [brcmsmac] [<ffffffffa05c9dfe>] brcms_b_bsinit.isra.65+0x12e/0x310 [brcmsmac] [<ffffffffa05d061b>] brcms_c_init+0x8fb/0x1170 [brcmsmac] [<ffffffffa05c3a0a>] brcms_init+0x5a/0x70 [brcmsmac] [<ffffffffa05ce76c>] brcms_c_up+0x1ac/0x4a0 [brcmsmac] [<ffffffffa05c3c65>] brcms_up+0x25/0x30 [brcmsmac] [<ffffffffa05c44c0>] brcms_ops_start+0xd0/0x100 [brcmsmac] [...] Signed-off-by:
Niels Ole Salscheider <niels_ole@salscheider-online.de> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Tomasz Guszkowski authored
Added USB ID for T-Com Sinus 154 data II. Cc: <stable@vger.kernel.org> Signed-off-by:
Tomasz Guszkowski <tsg@o2.pl> Acked-by:
Christian Lamparter <chunkeey@googlemail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Christian Lamparter authored
Sean reported that as of 3.7, his AR9170 device no longer works because the driver fails during initialization. He noted this is due to: "In carl9170/fw.c, ar->hw->wiphy is tagged with NL80211_IFTYPE_MESH_POINT support if the firmware has Content after Beacon Queuing. This is both in interface_modes and the only iface_combinations entry. If CONFIG_MAC80211_MESH is not set, ieee80211_register_hw removes NL80211_IFTYPE_MESH_POINT from interface_modes, but not iface_combinations. wiphy_register then checks to see if every interface type in every interface combination is in interface_modes. NL80211_IFTYPE_MESH_POINT was removed, so you get a WARN_ON warning and it returns -EINVAL, giving up." Unfortunately, the iface_combination (types) feature bitmap in ieee80211_iface_limit is part of a const member in the ieee80211_iface_combination struct. Hence, the MESH_POINT feature flag can't be masked by wiphy_register in the same way as interface_modes in ieee80211_register_hw. Cc: <stable@vger.kernel.org> Reported-by:
Sean Patrick Santos <quantheory@gmail.com> Signed-off-by:
Christian Lamparter <chunkeey@googlemail.com> Tested-by:
Sean Patrick Santos <quantheory@gmail.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Jussi Kivilinna authored
Incorrect use of usb_alloc_coherent memory as input buffer to usb_control_msg can cause problems in arch DMA code, for example kernel BUG at 'arch/arm/include/asm/dma-mapping.h:321' on ARM (linux-3.4). Change _usb_writeN_sync use kmalloc'd buffer instead. Cc: stable@vger.kernel.org Signed-off-by:
Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Acked-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Sujith Manoharan authored
Since ath9k makes use of mac80211's debugfs hooks to maintain station statistics, make ATH9K_DEBUGFS select MAC80211_DEBUGFS. This fixes the issue reported by Fengguang Wu: drivers/net/wireless/ath/ath9k/debug.c: In function 'ath9k_sta_add_debugfs': drivers/net/wireless/ath/ath9k/debug.c:1589:4: error: 'struct ath_node' has no member named 'node_stat' drivers/net/wireless/ath/ath9k/debug.c: In function 'ath9k_sta_remove_debugfs': drivers/net/wireless/ath/ath9k/debug.c:1599:19: error: 'struct ath_node' has no member named 'node_stat' Reported-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Geert Uytterhoeven authored
Commit ec43b08b ("ssb: add GPIO driver") added SSB_DRIVER_GPIO, which unconditionally selects GPIOLIB, causing a Kconfig warning: warning: (ARCH_REQUIRE_GPIOLIB && SSB_DRIVER_GPIO && BCMA_DRIVER_GPIO && MFD_TC6393XB && FB_VIA) selects GPIOLIB which has unmet direct dependencies (ARCH_WANT_OPTIONAL_GPIOLIB || ARCH_REQUIRE_GPIOLIB) and build failure for m68k/allmodconfig: In file included from drivers/ssb/ssb_private.h:5, from drivers/ssb/main.c:12: include/linux/ssb/ssb.h:440: error: field ‘gpio’ has incomplete type make[4]: *** [drivers/ssb/main.o] Error 1 make[3]: *** [drivers/ssb/] Error 2 Turn the select into a dependency to fix this. Signed-off-by:
Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Geert Uytterhoeven authored
Commit cf0936b0 ("bcma: add GPIO driver") added BCMA_DRIVER_GPIO, which unconditionally selects GPIOLIB, causing a Kconfig warning: warning: (ARCH_REQUIRE_GPIOLIB && SSB_DRIVER_GPIO && BCMA_DRIVER_GPIO && MFD_TC6393XB && FB_VIA) selects GPIOLIB which has unmet direct dependencies (ARCH_WANT_OPTIONAL_GPIOLIB || ARCH_REQUIRE_GPIOLIB) and build failure for m68k/allmodconfig: In file included from include/linux/bcma/bcma.h:8, from drivers/bcma/bcma_private.h:9, from drivers/bcma/main.c:9: include/linux/bcma/bcma_driver_chipcommon.h:582: error: field ‘gpio’ has incomplete type In file included from include/linux/bcma/bcma.h:12, from drivers/bcma/bcma_private.h:9, from drivers/bcma/main.c:9: include/linux/ssb/ssb.h:440: error: field ‘gpio’ has incomplete type make[4]: *** [drivers/bcma/main.o] Error 1 make[3]: *** [drivers/bcma/] Error 2 Turn the select into a dependency to fix this. Signed-off-by:
Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
- 28 Dec, 2012 3 commits
-
-
Larry Finger authored
With 3.8-rc1, the first call of pci_map_single() that is not checked with a corresponding pci_dma_mapping_error() call results in a warning with a splat as follows: WARNING: at lib/dma-debug.c:933 check_unmap+0x480/0x950() Hardware name: HP Pavilion dv2700 Notebook PC forcedeth 0000:00:0a.0: DMA-API: device driver failed to check map error[device address=0x00000000b176e002] [size=90 bytes] [mapped as single] Reviewed-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Bjørn Mork authored
also known as Alcatel One Touch L100V LTE The driver description files gives these names to the vendor specific functions on this modem: Application1: VID_1BBB&PID_011E&MI_00 Application2: VID_1BBB&PID_011E&MI_01 Modem: VID_1BBB&PID_011E&MI_03 Ethernet: VID_1BBB&PID_011E&MI_04 Reported-by:
Thomas Schäfer <tschaefer@t-online.de> Signed-off-by:
Bjørn Mork <bjorn@mork.no> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
git://1984.lsi.us.es/nfDavid S. Miller authored
Pablo Neira Ayuso says: ==================== The following batch contains Netfilter fixes for 3.8-rc1. They are a mixture of old bugs that have passed unnoticed (I'll pass these to stable) and more fresh ones from the previous merge window, they are: * Fix for MAC address in 6in4 tunnels via NFLOG that results in ulogd showing up wrong address, from Bob Hockney. * Fix a comment in nf_conntrack_ipv6, from Florent Fourcot. * Fix a leak an error path in ctnetlink while creating an expectation, from Jesper Juhl. * Fix missing ICMP time exceeded in the IPv6 defragmentation code, from Haibo Xi. * Fix inconsistent handling of routing changes in MASQUERADE for the new connections case, from Andrew Collins. * Fix a missing skb_reset_transport in ip[6]t_REJECT that leads to crashes in the ixgbe driver (since it seems to access the transport header with TSO enabled), from Mukund Jampala. * Recover obsoleted NOTRACK target by including it into the CT and spot a warning via printk about being obsoleted. Many people don't check the scheduled to be removal file under Documentation, so we follow some less agressive approach to kill this in a year or so. Spotted by Florian Westphal, patch from myself. * Fix race condition in xt_hashlimit that allows to create two or more entries, from myself. * Fix crash if the CT is used due to the recently added facilities to consult the dying and unconfirmed conntrack lists, from myself. ==================== Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- 27 Dec, 2012 3 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-stagingLinus Torvalds authored
Pull hwmon fixes from Guenter Roeck: - Report i2c errors to userspace in lm73 driver - Fix problem with DIV_ROUND_CLOSEST and unsigned divisors in emc6w201 driver * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (emc6w201) Fix DIV_ROUND_CLOSEST problem with unsigned divisors hwmon: (lm73} Detect and report i2c bus errors
-
git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespaceLinus Torvalds authored
Pull namespace fixes from Eric Biederman: "This tree includes two bug fixes for problems Oleg spotted on his review of the recent pid namespace work. A small fix to not enable bottom halves with irqs disabled, and a trivial build fix for f2fs with user namespaces enabled." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: f2fs: Don't assign e_id in f2fs_acl_from_disk proc: Allow proc_free_inum to be called from any context pidns: Stop pid allocation when init dies pidns: Outlaw thread creation after unshare(CLONE_NEWPID)
-
git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds authored
Pull networking fixes from David Miller: 1) GRE tunnel drivers don't set the transport header properly, they also blindly deref the inner protocol ipv4 and needs some checks. Fixes from Isaku Yamahata. 2) Fix sleeps while atomic in netdevice rename code, from Eric Dumazet. 3) Fix double-spinlock in solos-pci driver, from Dan Carpenter. 4) More ARP bug fixes. Fix lockdep splat in arp_solicit() and then the bug accidentally added by that fix. From Eric Dumazet and Cong Wang. 5) Remove some __dev* annotations that slipped back in, as well as all HOTPLUG references. From Greg KH 6) RDS protocol uses wrong interfaces to access scatter-gather elements, causing a regression. From Mike Marciniszyn. 7) Fix build error in cpts driver, from Richard Cochran. 8) Fix arithmetic in packet scheduler, from Stefan Hasko. 9) Similarly, fix association during calculation of random backoff in batman-adv. From Akinobu Mita. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (21 commits) ipv6/ip6_gre: set transport header correctly ipv4/ip_gre: set transport header correctly to gre header IB/rds: suppress incompatible protocol when version is known IB/rds: Correct ib_api use with gs_dma_address/sg_dma_len net/vxlan: Use the underlying device index when joining/leaving multicast groups tcp: should drop incoming frames without ACK flag set netprio_cgroup: define sk_cgrp_prioidx only if NETPRIO_CGROUP is enabled cpts: fix a run time warn_on. cpts: fix build error by removing useless code. batman-adv: fix random jitter calculation arp: fix a regression in arp_solicit() net: sched: integer overflow fix CONFIG_HOTPLUG removal from networking core Drivers: network: more __dev* removal bridge: call br_netpoll_disable in br_add_if ipv4: arp: fix a lockdep splat in arp_solicit() tuntap: dont use a private kmem_cache net: devnet_rename_seq should be a seqcount ip_gre: fix possible use after free ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally ...
-
- 26 Dec, 2012 6 commits
-
-
Isaku Yamahata authored
ip6gre_xmit2() incorrectly sets transport header to inner payload instead of GRE header. It seems copy-and-pasted from ipip.c. Set transport header to gre header. (In ipip case the transport header is the inner ip header, so that's correct.) Found by inspection. In practice the incorrect transport header doesn't matter because the skb usually is sent to another net_device or socket, so the transport header isn't referenced. Signed-off-by:
Isaku Yamahata <yamahata@valinux.co.jp> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Isaku Yamahata authored
ipgre_tunnel_xmit() incorrectly sets transport header to inner payload instead of GRE header. It seems copy-and-pasted from ipip.c. So set transport header to gre header. (In ipip case the transport header is the inner ip header, so that's correct.) Found by inspection. In practice the incorrect transport header doesn't matter because the skb usually is sent to another net_device or socket, so the transport header isn't referenced. Signed-off-by:
Isaku Yamahata <yamahata@valinux.co.jp> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Marciniszyn, Mike authored
Add an else to only print the incompatible protocol message when version hasn't been established. Signed-off-by:
Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Marciniszyn, Mike authored
0b088e00 ("RDS: Use page_remainder_alloc() for recv bufs") added uses of sg_dma_len() and sg_dma_address(). This makes RDS DOA with the qib driver. IB ulps should use ib_sg_dma_len() and ib_sg_dma_address respectively since some HCAs overload ib_sg_dma* operations. Signed-off-by:
Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Yan Burman authored
The socket calls from vxlan to join/leave multicast group aren't using the index of the underlying device, as a result the stack uses the first interface that is up. This results in vxlan being non functional over a device which isn't the 1st to be up. Fix this by providing the iflink field to the vxlan instance to the multicast calls. Signed-off-by:
Yan Burman <yanb@mellanox.com> Acked-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Eric Dumazet authored
In commit 96e0bf4b (tcp: Discard segments that ack data not yet sent) John Dykstra enforced a check against ack sequences. In commit 354e4aa3 (tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation) I added more safety tests. But we missed fact that these tests are not performed if ACK bit is not set. RFC 793 3.9 mandates TCP should drop a frame without ACK flag set. " fifth check the ACK field, if the ACK bit is off drop the segment and return" Not doing so permits an attacker to only guess an acceptable sequence number, evading stronger checks. Many thanks to Zhiyun Qian for bringing this issue to our attention. See : http://web.eecs.umich.edu/~zhiyunq/pub/ccs12_TCP_sequence_number_inference.pdfReported-by:
Zhiyun Qian <zhiyunq@umich.edu> Signed-off-by:
Eric Dumazet <edumazet@google.com> Cc: Nandita Dukkipati <nanditad@google.com> Cc: Neal Cardwell <ncardwell@google.com> Cc: John Dykstra <john.dykstra1@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-