summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2012-12-13 13:20:02 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2012-12-13 13:20:02 -0800
commit8d9ea7172edd2e52da26b9485b4c97969a0d2648 (patch)
treef3359dbcecca68963961a3840b9b6221554c7642 /net
parentf6e858a00af788bab0fd4c0b7f5cd788000edc18 (diff)
parenteca2a43bb0d2c6ebd528be6acb30a88435abe307 (diff)
downloadlinux-8d9ea7172edd2e52da26b9485b4c97969a0d2648.tar.bz2
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: "A pile of fixes in response to yesterday's big merge. The SCTP HMAC thing hasn't been addressed yet, I'll take care of that myself if Neil and Vlad don't show signs of life by tomorrow. 1) Use after free of SKB in tuntap code. Fix by Eric Dumazet, reported by Dave Jones. 2) NFC LLCP code emits annoying kernel log message, triggerable by the user. From Dave Jones. 3) Fix several endianness bugs noticed by sparse in the bridging code, from Stephen Hemminger. 4) Ipv6 NDISC code doesn't take padding into account properly, fix from YOSHIFUJI Hideaki. 5) Add missing docs to ethtool_flow_ext struct, from Yan Burman." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: bridge: fix icmpv6 endian bug and other sparse warnings net: ethool: Document struct ethtool_flow_ext ndisc: Fix padding error in link-layer address option. tuntap: dont use skb after netif_rx_ni(skb) nfc: remove noisy message from llcp_sock_sendmsg
Diffstat (limited to 'net')
-rw-r--r--net/bridge/br_multicast.c10
-rw-r--r--net/ipv6/ndisc.c2
-rw-r--r--net/nfc/llcp/sock.c4
3 files changed, 7 insertions, 9 deletions
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 977c3ee02e65..1093c89095d8 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -622,7 +622,7 @@ out:
struct net_bridge_port_group *br_multicast_new_port_group(
struct net_bridge_port *port,
struct br_ip *group,
- struct net_bridge_port_group *next)
+ struct net_bridge_port_group __rcu *next)
{
struct net_bridge_port_group *p;
@@ -632,7 +632,7 @@ struct net_bridge_port_group *br_multicast_new_port_group(
p->addr = *group;
p->port = port;
- p->next = next;
+ rcu_assign_pointer(p->next, next);
hlist_add_head(&p->mglist, &port->mglist);
setup_timer(&p->timer, br_multicast_port_group_expired,
(unsigned long)p);
@@ -1138,7 +1138,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
struct sk_buff *skb)
{
const struct ipv6hdr *ip6h = ipv6_hdr(skb);
- struct mld_msg *mld = (struct mld_msg *) icmp6_hdr(skb);
+ struct mld_msg *mld;
struct net_bridge_mdb_entry *mp;
struct mld2_query *mld2q;
struct net_bridge_port_group *p;
@@ -1165,6 +1165,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
if (max_delay)
group = &mld->mld_mca;
} else if (skb->len >= sizeof(*mld2q)) {
+ u16 mrc;
if (!pskb_may_pull(skb, sizeof(*mld2q))) {
err = -EINVAL;
goto out;
@@ -1172,7 +1173,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
mld2q = (struct mld2_query *)icmp6_hdr(skb);
if (!mld2q->mld2q_nsrcs)
group = &mld2q->mld2q_mca;
- max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(mld2q->mld2q_mrc) : 1;
+ mrc = ntohs(mld2q->mld2q_mrc);
+ max_delay = mrc ? MLDV2_MRC(mrc) : 1;
}
if (!group)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 4c02e6ab96e7..f2a007b7bde3 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -151,8 +151,8 @@ static inline int ndisc_opt_addr_space(struct net_device *dev)
static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
unsigned short addr_type)
{
- int space = NDISC_OPT_SPACE(data_len);
int pad = ndisc_addr_option_pad(addr_type);
+ int space = NDISC_OPT_SPACE(data_len + pad);
opt[0] = type;
opt[1] = space>>3;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 0fa1e92ceac8..fea22eb41b82 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -614,10 +614,6 @@ static int llcp_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
if (msg->msg_namelen < sizeof(*addr)) {
release_sock(sk);
-
- pr_err("Invalid socket address length %d\n",
- msg->msg_namelen);
-
return -EINVAL;
}