kernel.git/net/x25, branch linux-2.6.27.y

x25: Do not reference freed memory.

2011-04-30T14:53:09Z

commit 96642d42f076101ba98866363d908cab706d156c upstream. In x25_link_free(), we destroy 'nb' before dereferencing 'nb->dev'. Don't do this, because 'nb' might be freed by then. Reported-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

x25: decrement netdev reference counts on unload

2011-04-30T14:53:03Z

commit 171995e5d82dcc92bea37a7d2a2ecc21068a0f19 upstream. x25 does not decrement the network device reference counts on module unload. Thus unregistering any pre-existing interface after unloading the x25 module hangs and results in unregister_netdevice: waiting for tap0 to become free. Usage count = 1 This patch decrements the reference counts of all interfaces in x25_link_free, the way it is already done in x25_link_device_down for NETDEV_DOWN events. Signed-off-by: Apollon Oikonomopoulos Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

x25: Prevent crashing when parsing bad X.25 facilities

2010-12-09T21:24:21Z

commit 5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f upstream. Now with improved comma support. On parsing malformed X.25 facilities, decrementing the remaining length may cause it to underflow. Since the length is an unsigned integer, this will result in the loop continuing until the kernel crashes. This patch adds checks to ensure decrementing the remaining length does not cause it to wrap around. Signed-off-by: Dan Rosenberg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

memory corruption in X.25 facilities parsing

2010-12-09T21:24:21Z

commit a6331d6f9a4298173b413cf99a40cc86a9d92c37 upstream. Signed-of-by: Andrew Hendry Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.

2010-12-09T21:24:20Z

commit f5eb917b861828da18dc28854308068c66d1449a upstream. Here is a patch to stop X.25 examining fields beyond the end of the packet. For example, when a simple CALL ACCEPTED was received: 10 10 0f x25_parse_facilities was attempting to decode the FACILITIES field, but this packet contains no facilities field. Signed-off-by: John Hughes Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

x25: Fix sleep from timer on socket destroy.

2009-07-30T23:06:13Z

[ Upstream commit 14ebaf81e13ce66bff275380b246796fd16cbfa1 ] If socket destuction gets delayed to a timer, we try to lock_sock() from that timer which won't work. Use bh_lock_sock() in that case. Signed-off-by: David S. Miller Tested-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman

af_rose/x25: Sanity check the maximum user frame size

2009-05-02T17:24:04Z

upstream commit: 83e0bbcbe2145f160fbaa109b0439dae7f4a38a9 CVE-2009-0795. Otherwise we can wrap the sizes and end up sending garbage. Closes #10423 Signed-off-by: Alan Cox Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

netns: Use net_eq() to compare net-namespaces for optimization.

2008-07-20T05:34:43Z

Without CONFIG_NET_NS, namespace is always &init_net. Compiler will be able to omit namespace comparisons with this patch. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

x25: Use sock_orphan() instead of open-coded (and buggy) variant.

2008-06-17T10:05:13Z

It doesn't grab the sk_callback_lock, it doesn't NULL out the sk->sk_sleep waitqueue pointer, etc. Signed-off-by: David S. Miller

x25: Use sock_graft() and remove bogus sk_socket and sk_sleep init.

2008-06-17T09:44:35Z

This is the x25 variant of changeset 9375cb8a1232d2a15fe34bec4d3474872e02faec ("ax25: Use sock_graft() and remove bogus sk_socket and sk_sleep init.") Signed-off-by: David S. Miller