Commit Graph

32873 Commits

Author SHA1 Message Date
Andreas Herrmann
f6c0e7a7b3 [SCSI] zfcp: minor erp bug fixes
Bug fixes for zfcp's erp:
- trigger adapter reopen if do_QDIO fails
- avoid erp deadlock if registration of scsi target or remote port hang
- do not treat as error if exchange port data fails
- decrease timeout for target reset and aborts
- mark unit failed if slave_destroy is called

Additionally some code cleanup was done:
- made some functions void when retval is not of interest
- shortened initialization of zfcp's host_template
- corrected some comments

Signed-off-by: Andreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:31:17 -05:00
Volker Sameske
fea9d6c7bc [SCSI] zfcp: improve management of request IDs
Improve request handling. Use hash table to manage request IDs.

Signed-off-by: Volker Sameske <sameske@de.ibm.com>
Signed-off-by: Andreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:31:00 -05:00
Andrew Vasquez
c2602c48b5 [SCSI] qla2xxx: Update version number to 8.01.05-k4.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:30:41 -05:00
Vladislav Bolkhovitin
b0328beed0 [SCSI] qla2xxx: Fix to allow to reset devices using sg interface (sg_reset).
Currently it is impossible to reset provided by Qlogic QLA2xxx driver
SCSI devices externally using corresponding sg devices, particularly via
sg_reset utility, because qla2xxx driver in qla2xxx_eh_device_reset()
function checks if the input scsi_cmnd has its private data (CMD_SP())
attached. Then the found pointer isn't used anywhere inside of
qla2xxx_eh_device_reset(). If the RESET request comes from sg device, it
doesn't have such private data.

The attached patch removes check for non-NULL CMD_SP() from
qla2xxx_eh_device_reset(), hence allows to reset QLA2xxx's devices using
corresponding sg devices.

AV: change applies to bus/host reset handlers as well.

Signed-off-by: Vladislav Bolkhovitin <vst@vlnb.net>
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:30:28 -05:00
Andrew Vasquez
45ebeb5605 [SCSI] qla2xxx: Log Trace/Diagonostic asynchronous events.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:30:10 -05:00
Shyam Sundar
b797b6de9d [SCSI] qla2xxx: Correct endianess problem while issuing a Marker IOCB on ISP24xx.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:29:45 -05:00
James Smart
416780d3a7 [SCSI] lpfc 8.1.7 : Change version number to 8.1.8
Change version number to 8.1.8

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:29:11 -05:00
James Smart
dca9479be8 [SCSI] lpfc 8.1.7 : ID String and Message fixes
ID String and Message fixes
 - Fix switch symbolic name registration to match cross-OS values
 - Replace printk's with more standard lpfc_printf_log calls
 - Make all lpfc_printf_log message numbers unique

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:28:55 -05:00
James Smart
8f6d98d2e0 [SCSI] lpfc 8.1.7 : Short bug fixes
Short bug fixes:
 - Fix iocbq list corruption due to missing list_del's in ct handling
 - Missing unlock in lpfc_sli_next_iotag()
 - Fix initialization of can_queue value
 - Differentiate sysfs mailbox errors with different codes.

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:28:41 -05:00
James Smart
1c067a4241 [SCSI] lpfc 8.1.7 : Fix race condition between lpfc_sli_issue_mbox and lpfc_online
Fix race condition between lpfc_sli_issue_mbox and lpfc_online

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:28:22 -05:00
James Smart
a309a6b6e6 [SCSI] lpfc 8.1.7 : Fix failing firmware download due to mailbox delays needing to be longer
Fix failing firmware download due to mailbox delays needing to be longer.

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:28:03 -05:00
James Smart
64ba881829 [SCSI] lpfc 8.1.7 : Add statistics reset callback for FC transport
Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-08-06 11:27:31 -05:00
Christoph Hellwig
0dfda7751e [SCSI] fix simscsi
On Thu, Jul 27, 2006 at 01:03:24AM -0700, Andrew Morton wrote:
> arch/ia64/hp/sim/simscsi.c: In function `simscsi_sg_readwrite':
> arch/ia64/hp/sim/simscsi.c:154: error: structure has no member named `buffer'
> arch/ia64/hp/sim/simscsi.c: In function `simscsi_fillresult':
> arch/ia64/hp/sim/simscsi.c:247: error: structure has no member named `buffer'
> arch/ia64/hp/sim/simscsi.c: At top level:
> arch/ia64/hp/sim/simscsi.c:87: warning: 'simscsi_setup' defined but not used

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 13:39:49 -05:00
Ju, Seokmann
0b4972d591 [SCSI] megaraid_{mm,mbox}: a fix on "kernel unaligned access address" issue
There was an issue in the data structure defined by megaraid driver
casuing "kernel unaligned access.." messages to be displayed during
IOCTL on IA64 platform.

The issue has been reported/fixed by Sakurai Hiroomi
[sakurai_hiro@soft.fujitsu.com].

Signed-Off By: Seokmann Ju <seokmann.ju@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 13:19:12 -05:00
Ju, Seokmann
aa677bc744 [SCSI] megaraid_{mm,mbox}: a fix on INQUIRY with EVPD
With this patch, driver will protect data corruption created by
INQUIRY with EVPD request to megaraid controllers.  As specified in
the changelog, megaraid F/W already has fixed the issue and being
under process of release. Meanwhile, driver will protect the system
with this patch.

Signed-Off By: Seokmann Ju <seokmann.ju@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 13:13:50 -05:00
Ju, Seokmann
fbf6080225 [SCSI] megaraid_{mm,mbox}: 64-bit DMA capability checker
This patch contains
- a fix for 64-bit DMA capability check in megaraid_{mm,mbox} driver.
- includes changes (going back to 32-bit DMA mask if 64-bit DMA mask
failes) suggested by James with previous patch.
- addition of SATA 150-4/6 as commented by Vasily Averin.

With patch, the driver access PCIconfiguration space with dedicated
offset to read a signature. If the signature read, it means that the
controller has capability to handle 64-bit DMA.
Without this patch, the driver used to blindly claim 64-bit DMA
capability.
The issue has been reported by Vasily Averin [vvs@sw.ru].
Thank you Vasily for the reporting.

Signed-Off By: Seokmann Ju <seokmann.ju@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 13:10:23 -05:00
Mike Christie
f4246b33c7 [SCSI] iscsi bugfixes: update and move version number
The version info is useful for iscsi tcp, iser and qla4xxx so move to
transport class.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:50:18 -05:00
Mike Christie
f3ff0c3627 [SCSI] iscsi bugfixes: fix mem leaks in libiscsi
We were leaking some strings. This patch just frees them.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:50:02 -05:00
Mike Christie
40527afea1 [SCSI] iscsi bugfixes: pass errors from complete_pdu to caller
Must pass ISCSI_ERR values from the recv path and propogate them
upwards.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:49:50 -05:00
Mike Christie
c8dc1e523b [SCSI] iscsi bugfixes: reduce memory allocations
We currently try to allocate a max_recv_data_segment_length
which can be very large (default is 64K), and common uses
are up to 1MB. It is very very difficult to allocte this
much contiguous memory and it turns out we never even use it.
We really only need a couple of pages, so this patch has us
allocates just what we know what we need today.

Later if vendors start adding vendor specific data and
we need to handle large buffers we can do this, but for
the last 4 years we have not seen anyone do this or request
it.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:49:34 -05:00
Mike Christie
9aaa2b4621 [SCSI] iscsi bugfixes: dont use GFP_KERNEL for sending errors
iscsi_tcp can send error events from soft irq context so we
cannot use GFP_KERNEL.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:49:20 -05:00
Mike Christie
63f75cc8a7 [SCSI] iscsi bugfixes: fix oops when removing session
We are touching the cls_session after we have freed
it. This causes a oops.

Signed-off-by: Or Gerlitz  <ogerlitz@voltaire.com>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:49:01 -05:00
Mike Christie
1c83469d36 [SCSI] iscsi bugfixes: fix oops when iser is flushing io
When we enter recovery and flush the running commands
we cannot freee the connection before flushing the commands.
Some commands may have a reference to the connection
that needs to be released before. iscsi_stop was forcing
the term and suspend too early and was causing a oops
in iser, so this patch removes those callbacks all together
and allows the LLD to handle that detail.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:48:32 -05:00
Mike Christie
7ea8b82847 [SCSI] iscsi bugfixes: fix abort handling
Abort handler fixes.

If a connection is dropped and reconnected while an abort is
running then we should assume the recovery code will clean up
the abort. Not doing so causes a oops.

And if a command completes then we get the status for the abort, we do not
need to call into the LLD to cleanup the resources. Doing this causes
and oops in iser because it ends up freeing some resources twice.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:48:16 -05:00
Mike Christie
275fd7d129 [SCSI] iscsi bugfixes: handle data rsp errors
if iscsi_data_rsp fails we must bail out. Since the pdu values like
data length are invalid we cannot continue to process the data since
it could over run buffers.

This fixes a bug with cisco 5428s where that target is sending
too much data.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:48:01 -05:00
Mike Christie
b6c395ed03 [SCSI] iscsi bugfixes: fix r2t handling
The iscsi tcp code can pluck multiple rt2s from the tasks's r2tqueue
in the xmit code. This can result in the task being queued on the xmit queue
but gettting completed at the same time.

This patch fixes the above bug by making the fifo a list so
we always remove the entry on the list del.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:47:40 -05:00
Mike Christie
d82967c706 [SCSI] iscsi bugfixes: send correct error values to userspace
In the xmit patch we are sending a -EXXX value to iscsi_conn_failure
which is causing userspace to get confused.

We should be sending a ISCSI_ERR_* value that userspace understands.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:47:23 -05:00
HighPoint Linux Team
8d4fbd3f97 [SCSI] hptiop: wrong register used in hptiop_reset_hba()
IOP reset message should be posted to inbound message register
instead of outbound message register.

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:47:02 -05:00
Grant Grundler
b2b3c12107 [SCSI] sym2: claim only "Storage" class
The follow patch fixes a problem for Matt Taggart.
The Compaq system he had (dl380?) has a SmartArray device that exposes
the 53c1510 device in both RAID and "normal" modes. The difference
is in RAID mode, the smart array driver (IIRC) should claim the
device instead of sym2 driver. Patch below prevents sym2 from
claiming the device when the RAID "daughter board" is attached.

Signed-off-by: Grant Grundler <grundler@parisc-linux.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2006-07-28 11:46:38 -05:00
Christoph Hellwig
64821324ca [PATCH] fix compile regression for a few scsi drivers
This fixes three drivers to compile again after my patch that removes
the data_cmnd member from struct scsi_cmnd.

The fas216 change is trivial, it should have been using ->cmnd all the
time.

NCR53C9 (which seem to be mostly duplicate driver with esp.c!) is doing
something odd, it should only have looked at ->cmnd before not the saved
copy that is kept for the error handlers sake.  Note that it really
should deal with the sync setting themselves but use the generic domain
validation code that get this right - but that's for later let's push
this simple compile fix for now.

And sorry for the late fix for this, I have been busy with OLS and
associated activities last week.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-26 07:30:45 -07:00
Linus Torvalds
dab5025ca2 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SCSI] esp: Fix build.
  [SPARC]: Fix SA_STATIC_ALLOC value.
  [SPARC64]: Explicitly print return PC when the kernel fault PC is bogus.
2006-07-26 07:22:36 -07:00
Linus Torvalds
761a126017 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV4/IPV6]: Setting 0 for unused port field in RAW IP recvmsg().
  [IPV4] ipmr: ip multicast route bug fix.
  [TG3]: Update version and reldate
  [TG3]: Handle tg3_init_rings() failures
  [TG3]: Add tg3_restart_hw()
  [IPV4]: Clear the whole IPCB, this clears also IPCB(skb)->flags.
  [IPV6]: Clean skb cb on IPv6 input.
  [NETFILTER]: Demote xt_sctp to EXPERIMENTAL
  [NETFILTER]: bridge netfilter: add deferred output hooks to feature-removal-schedule
  [NETFILTER]: xt_pkttype: fix mismatches on locally generated packets
  [NETFILTER]: SNMP NAT: fix byteorder confusion
  [NETFILTER]: conntrack: fix SYSCTL=n compile
  [NETFILTER]: nf_queue: handle NF_STOP and unknown verdicts in nf_reinject
  [NETFILTER]: H.323 helper: fix possible NULL-ptr dereference
2006-07-26 07:22:10 -07:00
Arjan van de Ven
153d7f3fca [PATCH] Reorganize the cpufreq cpu hotplug locking to not be totally bizare
The patch below moves the cpu hotplugging higher up in the cpufreq
layering; this is needed to avoid recursive taking of the cpu hotplug
lock and to otherwise detangle the mess.

The new rules are:
1. you must do lock_cpu_hotplug() around the following functions:
   __cpufreq_driver_target
   __cpufreq_governor (for CPUFREQ_GOV_LIMITS operation only)
   __cpufreq_set_policy
2. governer methods (.governer) must NOT take the lock_cpu_hotplug()
   lock in any way; they are called with the lock taken already
3. if your governer spawns a thread that does things, like calling
   __cpufreq_driver_target, your thread must honor rule #1.
4. the policy lock and other cpufreq internal locks nest within
   the lock_cpu_hotplug() lock.

I'm not entirely happy about how the __cpufreq_governor rule ended up
(conditional locking rule depending on the argument) but basically all
callers pass this as a constant so it's not too horrible.

The patch also removes the cpufreq_governor() function since during the
locking audit it turned out to be entirely unused (so no need to fix it)

The patch works on my testbox, but it could use more testing
(otoh... it can't be much worse than the current code)

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-26 07:21:40 -07:00
Tetsuo Handa
f59fc7f30b [IPV4/IPV6]: Setting 0 for unused port field in RAW IP recvmsg().
From: Tetsuo Handa from-linux-kernel@i-love.sakura.ne.jp

The recvmsg() for raw socket seems to return random u16 value
from the kernel stack memory since port field is not initialized.
But I'm not sure this patch is correct.
Does raw socket return any information stored in port field?

[ BSD defines RAW IP recvmsg to return a sin_port value of zero.
  This is described in Steven's TCP/IP Illustrated Volume 2 on
  page 1055, which is discussing the BSD rip_input() implementation. ]
    
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-25 17:05:35 -07:00
Alexey Kuznetsov
7228749092 [IPV4] ipmr: ip multicast route bug fix.
IP multicast route code was reusing an skb which causes use after free
and double free.

From: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>

Note, it is real skb_clone(), not alloc_skb(). Equeued skb contains
the whole half-prepared netlink message plus room for the rest.
It could be also skb_copy(), if we want to be puristic about mangling
cloned data, but original copy is really not going to be used.  

Acked-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-25 16:45:12 -07:00
Michael Chan
b6e77a5346 [TG3]: Update version and reldate
Update version to 3.63.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-25 16:39:12 -07:00
Michael Chan
32d8c5724b [TG3]: Handle tg3_init_rings() failures
Handle dev_alloc_skb() failures when initializing the RX rings.
Without proper handling, the driver will crash when using a partial
ring.

Thanks to Stephane Doyon <sdoyon@max-t.com> for reporting the bug and
providing the initial patch.

Howie Xu <howie@vmware.com> also reported the same issue.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-25 16:38:29 -07:00
Michael Chan
b9ec6c1b91 [TG3]: Add tg3_restart_hw()
Add tg3_restart_hw() to handle failures when re-initializing the
device.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-25 16:37:27 -07:00
Jens Axboe
44eb123126 [PATCH] cfq-iosched: don't use a hard jiffies value, translate from msecs
The CIC_SEEKY() test really wants to use the minimum of either:

- 2 msecs (not jiffies)

- or, the pending slice time

So code it like that.

Signed-off-by: Jens Axboe <axboe@suse.de>
2006-07-25 15:05:21 +02:00
Milton Miller
ad01b1ca79 [PATCH] blktrace: fix read-ahead bit
It should be toggling the same bit on and off, fix it up.

Signed-off-by: Jens Axboe <axboe@suse.de>
2006-07-25 15:04:13 +02:00
Jens Axboe
7b30f09245 [PATCH] cciss: fix stall with softirq handling and CFQ
We need to postpone the queue startup until after the softirq
handler has actually finished some requests, otherwise we could
be racing with cciss_softirq_done() and not actually restart
the queue handling.

Signed-off-by: Jens Axboe <axboe@suse.de>
2006-07-25 15:02:48 +02:00
Guillaume Chazarain
d569f1d72f [IPV4]: Clear the whole IPCB, this clears also IPCB(skb)->flags.
Signed-off-by: Guillaume Chazarain <guichaz@yahoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 23:45:16 -07:00
Guillaume Chazarain
6b7fdc3ae1 [IPV6]: Clean skb cb on IPv6 input.
Clear the accumulated junk in IP6CB when starting to handle an IPV6
packet.

Signed-off-by: Guillaume Chazarain <guichaz@yahoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 23:44:44 -07:00
Patrick McHardy
d5af981e93 [NETFILTER]: Demote xt_sctp to EXPERIMENTAL
After the recent problems with all the SCTP stuff it seems reasonable
to mark this as experimental.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:55:29 -07:00
Patrick McHardy
10ea6ac895 [NETFILTER]: bridge netfilter: add deferred output hooks to feature-removal-schedule
Add bridge netfilter deferred output hooks to feature-removal-schedule
and disable them by default. Until their removal they will be
activated by the physdev match when needed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:54:55 -07:00
Phil Oester
28658c8967 [NETFILTER]: xt_pkttype: fix mismatches on locally generated packets
Locally generated broadcast and multicast packets have pkttype set to
PACKET_LOOPBACK instead of PACKET_BROADCAST or PACKET_MULTICAST. This
causes the pkttype match to fail to match packets of either type.

The below patch remedies this by using the daddr as a hint as to
broadcast|multicast. While not pretty, this seems like the only way
to solve the problem short of just noting this as a limitation of the
match.

This resolves netfilter bugzilla #484

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:54:14 -07:00
Patrick McHardy
8cf8fb5687 [NETFILTER]: SNMP NAT: fix byteorder confusion
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:53:35 -07:00
Adrian Bunk
72b5582359 [NETFILTER]: conntrack: fix SYSCTL=n compile
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:53:12 -07:00
Patrick McHardy
3bc38712e3 [NETFILTER]: nf_queue: handle NF_STOP and unknown verdicts in nf_reinject
In case of an unknown verdict or NF_STOP the packet leaks. Unknown verdicts
can happen when userspace is buggy. Reinject the packet in case of NF_STOP,
drop on unknown verdicts.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:52:47 -07:00
Patrick McHardy
083edca05a [NETFILTER]: H.323 helper: fix possible NULL-ptr dereference
An RCF message containing a timeout results in a NULL-ptr dereference if
no RRQ has been seen before.

Noticed by the "SATURN tool", reported by Thomas Dillig <tdillig@stanford.edu>
and Isil Dillig <isil@stanford.edu>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-24 22:52:10 -07:00