From b5505c6e1071b32176c7548a3aaf0be49f7c763e Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Mon, 14 May 2007 02:15:47 -0700 Subject: [PATCH 1/5] [IPSEC]: Check validity of direction in xfrm_policy_byid The function xfrm_policy_byid takes a dir argument but finds the policy using the index instead. We only use the dir argument to update the policy count for that direction. Since the user can supply any value for dir, this can corrupt our policy count. I know this is the problem because a few days ago I was deleting policies by hand using indicies and accidentally typed in the wrong direction. It still deleted the policy and at the time I thought that was cool. In retrospect it isn't such a good idea :) I decided against letting it delete the policy anyway just in case we ever remove the connection between indicies and direction. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/xfrm/xfrm_policy.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 95271e8426a1..d0882e53b6fc 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -796,6 +796,10 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete, struct hlist_head *chain; struct hlist_node *entry; + *err = -ENOENT; + if (xfrm_policy_id2dir(id) != dir) + return NULL; + *err = 0; write_lock_bh(&xfrm_policy_lock); chain = xfrm_policy_byidx + idx_hash(id); From 6253db055eb62a1bd0a18a1d8489565303b2b1dd Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Mon, 14 May 2007 02:19:11 -0700 Subject: [PATCH 2/5] [IPSEC]: Don't warn if high-order hash resize fails Multi-page allocations are always likely to fail. Since such failures are expected and non-critical in xfrm_hash_alloc, we shouldn't warn about them. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/xfrm/xfrm_hash.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_hash.c b/net/xfrm/xfrm_hash.c index 37643bb8768a..55ab5792af56 100644 --- a/net/xfrm/xfrm_hash.c +++ b/net/xfrm/xfrm_hash.c @@ -22,7 +22,8 @@ struct hlist_head *xfrm_hash_alloc(unsigned int sz) n = __vmalloc(sz, GFP_KERNEL, PAGE_KERNEL); else n = (struct hlist_head *) - __get_free_pages(GFP_KERNEL, get_order(sz)); + __get_free_pages(GFP_KERNEL | __GFP_NOWARN, + get_order(sz)); if (n) memset(n, 0, sz); From 3e5c2d3bdbe2c047b9853c4248f881f5ac645c89 Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Mon, 14 May 2007 02:57:19 -0700 Subject: [PATCH 3/5] [NET_SCHED]: prio qdisc boundary condition This fixes an out-of-boundary condition when the classified band equals q->bands. Caught by Alexey Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller --- net/sched/sch_prio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c index 269a6e17c6c4..6d7542c26e47 100644 --- a/net/sched/sch_prio.c +++ b/net/sched/sch_prio.c @@ -75,7 +75,7 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) band = res.classid; } band = TC_H_MIN(band) - 1; - if (band > q->bands) + if (band >= q->bands) return q->queues[q->prio2band[0]]; return q->queues[band]; From ae7bf20a6316272acfcaef5d265b18aaa54b41e4 Mon Sep 17 00:00:00 2001 From: Corey Mutter Date: Mon, 14 May 2007 03:00:27 -0700 Subject: [PATCH 4/5] [IPV6]: Reverse sense of promisc tests in ip6_mc_input Reverse the sense of the promiscuous-mode tests in ip6_mc_input(). Signed-off-by: Corey Mutter Signed-off-by: David L Stevens Signed-off-by: David S. Miller --- net/ipv6/ip6_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c index be0ee8a34f9b..30a5cb1b203e 100644 --- a/net/ipv6/ip6_input.c +++ b/net/ipv6/ip6_input.c @@ -235,7 +235,7 @@ int ip6_mc_input(struct sk_buff *skb) IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS); hdr = ipv6_hdr(skb); - deliver = likely(!(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI))) || + deliver = unlikely(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI)) || ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL); /* From d831666e98b4f1e19ebdd2349735f47bf37cd293 Mon Sep 17 00:00:00 2001 From: Mitsuru Chinen Date: Mon, 14 May 2007 03:07:30 -0700 Subject: [PATCH 5/5] [IPV4] SNMP: Display new statistics at /proc/net/netstat This displays the statistics specified in the updated IP-MIB RFC (RFC4293) in /proc/net/netstat. The reason why these are not displayed in /proc/net/snmp is that some existing utilities are developed under the assumption which ipstat items in /proc/net/snmp is unchanged. Signed-off-by: Mitsuru Chinen Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller --- net/ipv4/proc.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c index 37ab5802ca08..cdbc6c135849 100644 --- a/net/ipv4/proc.c +++ b/net/ipv4/proc.c @@ -109,6 +109,17 @@ static const struct snmp_mib snmp4_ipstats_list[] = { SNMP_MIB_SENTINEL }; +/* Following RFC4293 items are displayed in /proc/net/netstat */ +static const struct snmp_mib snmp4_ipextstats_list[] = { + SNMP_MIB_ITEM("InNoRoutes", IPSTATS_MIB_INNOROUTES), + SNMP_MIB_ITEM("InTruncatedPkts", IPSTATS_MIB_INTRUNCATEDPKTS), + SNMP_MIB_ITEM("InMcastPkts", IPSTATS_MIB_INMCASTPKTS), + SNMP_MIB_ITEM("OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS), + SNMP_MIB_ITEM("InBcastPkts", IPSTATS_MIB_INBCASTPKTS), + SNMP_MIB_ITEM("OutBcastPkts", IPSTATS_MIB_OUTBCASTPKTS), + SNMP_MIB_SENTINEL +}; + static const struct snmp_mib snmp4_icmp_list[] = { SNMP_MIB_ITEM("InMsgs", ICMP_MIB_INMSGS), SNMP_MIB_ITEM("InErrors", ICMP_MIB_INERRORS), @@ -338,6 +349,16 @@ static int netstat_seq_show(struct seq_file *seq, void *v) snmp_fold_field((void **)net_statistics, snmp4_net_list[i].entry)); + seq_puts(seq, "\nIpExt:"); + for (i = 0; snmp4_ipextstats_list[i].name != NULL; i++) + seq_printf(seq, " %s", snmp4_ipextstats_list[i].name); + + seq_puts(seq, "\nIpExt:"); + for (i = 0; snmp4_ipextstats_list[i].name != NULL; i++) + seq_printf(seq, " %lu", + snmp_fold_field((void **)ip_statistics, + snmp4_ipextstats_list[i].entry)); + seq_putc(seq, '\n'); return 0; }