This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman [off-list ref]
Linux 4.9.92-rc1
Yunsheng Lin [off-list ref]
net: hns: Fix a skb used after free bug
Tom Herbert [off-list ref]
kcm: lock lower socket in kcm_attach
Florian Fainelli [off-list ref]
net: systemport: Rewrite __bcm_sysport_tx_reclaim()
Julian Wiedmann [off-list ref]
s390/qeth: on channel error, reject further cmd requests
Julian Wiedmann [off-list ref]
s390/qeth: lock read device while queueing next buffer
Julian Wiedmann [off-list ref]
s390/qeth: when thread completes, wake up all waiters
Julian Wiedmann [off-list ref]
s390/qeth: free netdevice when removing a card
Madalin Bucur [off-list ref]
soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
Arkadi Sharshevsky [off-list ref]
team: Fix double free in error path
Vinicius Costa Gomes [off-list ref]
skbuff: Fix not waking applications when errors are enqueued
David Ahern [off-list ref]
net: Only honor ifindex in IP_PKTINFO if non-0
Nicolas Dichtel [off-list ref]
netlink: avoid a double skb free in genlmsg_mcast()
Arvind Yadav [off-list ref]
net/iucv: Free memory obtained by kzalloc
Florian Fainelli [off-list ref]
net: fec: Fix unbalanced PM runtime calls
SZ Lin (林上智) [off-list ref]
net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface
Christophe JAILLET [off-list ref]
net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred
Eric Dumazet [off-list ref]
l2tp: do not accept arbitrary sockets
Lorenzo Bianconi [off-list ref]
ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
Alexey Kodanev [off-list ref]
dccp: check sk for closed state in dccp_sendmsg()
Kirill Tkhai [off-list ref]
net: Fix hlist corruptions in inet_evict_bucket()
Eric Dumazet [off-list ref]
net: use skb_to_full_sk() in skb_update_prio()
Eric Dumazet [off-list ref]
ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
Alexey Kodanev [off-list ref]
sch_netem: fix skb leak in netem_enqueue()
Paul Blakey [off-list ref]
rhashtable: Fix rhlist duplicates insertion
Guillaume Nault [off-list ref]
ppp: avoid loop in xmit recursion detection code
Roman Mashak [off-list ref]
net sched actions: return explicit error when tunnel_key mode is not specified
Marc Zyngier [off-list ref]
genirq: Track whether the trigger type has been set
Johannes Thumshirn [off-list ref]
scsi: sg: don't return bogus Sg_requests
-------------
Diffstat:
Makefile | 4 ++--
drivers/net/ethernet/arc/emac_rockchip.c | 6 +++--
drivers/net/ethernet/broadcom/bcmsysport.c | 33 ++++++++++++---------------
drivers/net/ethernet/broadcom/bcmsysport.h | 2 +-
drivers/net/ethernet/freescale/fec_main.c | 2 ++
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 22 ++++++++----------
drivers/net/ethernet/hisilicon/hns/hns_enet.h | 6 ++---
drivers/net/ethernet/ti/cpsw.c | 3 ++-
drivers/net/ppp/ppp_generic.c | 26 +++++++++++----------
drivers/net/team/team.c | 4 ++--
drivers/s390/net/qeth_core_main.c | 21 ++++++++++++-----
drivers/s390/net/qeth_l2_main.c | 2 +-
drivers/s390/net/qeth_l3_main.c | 2 +-
drivers/scsi/sg.c | 5 ++--
drivers/soc/fsl/qbman/qman.c | 28 ++++-------------------
include/linux/cgroup-defs.h | 4 ++--
include/linux/irq.h | 11 ++++++++-
include/linux/rhashtable.h | 4 +++-
include/net/sch_generic.h | 19 +++++++++++++++
kernel/irq/manage.c | 13 ++++++++++-
lib/rhashtable.c | 4 +++-
net/core/dev.c | 22 ++++++++++++------
net/core/skbuff.c | 2 +-
net/dccp/proto.c | 5 ++++
net/ieee802154/6lowpan/core.c | 12 ++++++----
net/ipv4/inet_fragment.c | 3 +++
net/ipv4/ip_sockglue.c | 6 +++--
net/ipv6/ndisc.c | 3 ++-
net/iucv/af_iucv.c | 4 +++-
net/kcm/kcmsock.c | 33 +++++++++++++++++++--------
net/l2tp/l2tp_core.c | 8 +++++--
net/netlink/genetlink.c | 2 +-
net/sched/act_tunnel_key.c | 1 +
net/sched/sch_netem.c | 2 +-
34 files changed, 202 insertions(+), 122 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <redacted>
commit 48ae8484e9fc324b4968d33c585e54bc98e44d61 upstream.
If the list search in sg_get_rq_mark() fails to find a valid request, we
return a bogus element. This then can later lead to a GPF in
sg_remove_scat().
So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case
the list search doesn't find a valid request.
Signed-off-by: Johannes Thumshirn <redacted>
Reported-by: Andrey Konovalov <redacted>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Doug Gilbert <dgilbert@interlog.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Doug Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <redacted>
Cc: Tony Battersby <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sg.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/scsi/sg.c+++ b/drivers/scsi/sg.c
@@ -2064,11 +2064,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)if((1==resp->done)&&(!resp->sg_io_owned)&&((-1==pack_id)||(resp->header.pack_id==pack_id))){resp->done=2;/* guard against other readers */-break;+write_unlock_irqrestore(&sfp->rq_list_lock,iflags);+returnresp;}}write_unlock_irqrestore(&sfp->rq_list_lock,iflags);-returnresp;+returnNULL;}/* always adds to end of list */
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <redacted>
commit 4f8413a3a799c958f7a10a6310a451e6b8aef5ad upstream.
When requesting a shared interrupt, we assume that the firmware
support code (DT or ACPI) has called irqd_set_trigger_type
already, so that we can retrieve it and check that the requester
is being reasonnable.
Unfortunately, we still have non-DT, non-ACPI systems around,
and these guys won't call irqd_set_trigger_type before requesting
the interrupt. The consequence is that we fail the request that
would have worked before.
We can either chase all these use cases (boring), or address it
in core code (easier). Let's have a per-irq_desc flag that
indicates whether irqd_set_trigger_type has been called, and
let's just check it when checking for a shared interrupt.
If it hasn't been set, just take whatever the interrupt
requester asks.
Fixes: 382bd4de6182 ("genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs")
Cc: stable@vger.kernel.org
Reported-and-tested-by: Petr Cvek <petrcvekcz@gmail.com>
Signed-off-by: Marc Zyngier <redacted>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/irq.h | 11 ++++++++++-
kernel/irq/manage.c | 13 ++++++++++++-
2 files changed, 22 insertions(+), 2 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <redacted>
[ Upstream commit 6d066734e9f09cdea4a3b9cb76136db3f29cfb02 ]
We already detect situations where a PPP channel sends packets back to
its upper PPP device. While this is enough to avoid deadlocking on xmit
locks, this doesn't prevent packets from looping between the channel
and the unit.
The problem is that ppp_start_xmit() enqueues packets in ppp->file.xq
before checking for xmit recursion. Therefore, __ppp_xmit_process()
might dequeue a packet from ppp->file.xq and send it on the channel
which, in turn, loops it back on the unit. Then ppp_start_xmit()
queues the packet back to ppp->file.xq and __ppp_xmit_process() picks
it up and sends it again through the channel. Therefore, the packet
will loop between __ppp_xmit_process() and ppp_start_xmit() until some
other part of the xmit path drops it.
For L2TP, we rapidly fill the skb's headroom and pppol2tp_xmit() drops
the packet after a few iterations. But PPTP reallocates the headroom
if necessary, letting the loop run and exhaust the machine resources
(as reported in https://bugzilla.kernel.org/show_bug.cgi?id=199109).
Fix this by letting __ppp_xmit_process() enqueue the skb to
ppp->file.xq, so that we can check for recursion before adding it to
the queue. Now ppp_xmit_process() can drop the packet when recursion is
detected.
__ppp_channel_push() is a bit special. It calls __ppp_xmit_process()
without having any actual packet to send. This is used by
ppp_output_wakeup() to re-enable transmission on the parent unit (for
implementations like ppp_async.c, where the .start_xmit() function
might not consume the skb, leaving it in ppp->xmit_pending and
disabling transmission).
Therefore, __ppp_xmit_process() needs to handle the case where skb is
NULL, dequeuing as many packets as possible from ppp->file.xq.
Reported-by: xu heng <redacted>
Fixes: 55454a565836 ("ppp: avoid dealock on recursive xmit")
Signed-off-by: Guillaume Nault <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ppp/ppp_generic.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
@@ -1416,13 +1415,14 @@ static void ppp_setup(struct net_device*//* Called to do any work queued up on the transmit side that can now be done */-staticvoid__ppp_xmit_process(structppp*ppp)+staticvoid__ppp_xmit_process(structppp*ppp,structsk_buff*skb){-structsk_buff*skb;-ppp_xmit_lock(ppp);if(!ppp->closing){ppp_push(ppp);++if(skb)+skb_queue_tail(&ppp->file.xq,skb);while(!ppp->xmit_pending&&(skb=skb_dequeue(&ppp->file.xq)))ppp_send_frame(ppp,skb);
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Blakey <redacted>
[ Upstream commit d3dcf8eb615537526bd42ff27a081d46d337816e ]
When inserting duplicate objects (those with the same key),
current rhlist implementation messes up the chain pointers by
updating the bucket pointer instead of prev next pointer to the
newly inserted node. This causes missing elements on removal and
travesal.
Fix that by properly updating pprev pointer to point to
the correct rhash_head next pointer.
Issue: 1241076
Change-Id: I86b2c140bcb4aeb10b70a72a267ff590bb2b17e7
Fixes: ca26893f05e8 ('rhashtable: Add rhlist interface')
Signed-off-by: Paul Blakey <redacted>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/rhashtable.h | 4 +++-
lib/rhashtable.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <redacted>
[ Upstream commit 35d889d10b649fda66121891ec05eca88150059d ]
When we exceed current packets limit and we have more than one
segment in the list returned by skb_gso_segment(), netem drops
only the first one, skipping the rest, hence kmemleak reports:
unreferenced object 0xffff880b5d23b600 (size 1024):
comm "softirq", pid 0, jiffies 4384527763 (age 2770.629s)
hex dump (first 32 bytes):
00 80 23 5d 0b 88 ff ff 00 00 00 00 00 00 00 00 ..#]............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d8a19b9d>] __alloc_skb+0xc9/0x520
[<000000001709b32f>] skb_segment+0x8c8/0x3710
[<00000000c7b9bb88>] tcp_gso_segment+0x331/0x1830
[<00000000c921cba1>] inet_gso_segment+0x476/0x1370
[<000000008b762dd4>] skb_mac_gso_segment+0x1f9/0x510
[<000000002182660a>] __skb_gso_segment+0x1dd/0x620
[<00000000412651b9>] netem_enqueue+0x1536/0x2590 [sch_netem]
[<0000000005d3b2a9>] __dev_queue_xmit+0x1167/0x2120
[<00000000fc5f7327>] ip_finish_output2+0x998/0xf00
[<00000000d309e9d3>] ip_output+0x1aa/0x2c0
[<000000007ecbd3a4>] tcp_transmit_skb+0x18db/0x3670
[<0000000042d2a45f>] tcp_write_xmit+0x4d4/0x58c0
[<0000000056a44199>] tcp_tasklet_func+0x3d9/0x540
[<0000000013d06d02>] tasklet_action+0x1ca/0x250
[<00000000fcde0b8b>] __do_softirq+0x1b4/0x5a3
[<00000000e7ed027c>] irq_exit+0x1e2/0x210
Fix it by adding the rest of the segments, if any, to skb 'to_free'
list. Add new __qdisc_drop_all() and qdisc_drop_all() functions
because they can be useful in the future if we need to drop segmented
GSO packets in other places.
Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Alexey Kodanev <redacted>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/sch_generic.h | 19 +++++++++++++++++++
net/sched/sch_netem.c | 2 +-
2 files changed, 20 insertions(+), 1 deletion(-)
@@ -793,6 +803,15 @@ static inline int qdisc_drop(struct sk_bqdisc_qstats_drop(sch);returnNET_XMIT_DROP;+}++staticinlineintqdisc_drop_all(structsk_buff*skb,structQdisc*sch,+structsk_buff**to_free)+{+__qdisc_drop_all(skb,to_free);+qdisc_qstats_drop(sch);++returnNET_XMIT_DROP;}/* Length to Time (L2T) lookup in a qdisc_rate_table, to determine how---a/net/sched/sch_netem.c+++b/net/sched/sch_netem.c
@@ -513,7 +513,7 @@ static int netem_enqueue(struct sk_buff}if(unlikely(sch->q.qlen>=sch->limit))-returnqdisc_drop(skb,sch,to_free);+returnqdisc_drop_all(skb,sch,to_free);qdisc_qstats_backlog_inc(sch,skb);
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <redacted>
[ Upstream commit ca0edb131bdf1e6beaeb2b8289fd6b374b74147d ]
A tun device type can trivially be set to arbitrary value using
TUNSETLINK ioctl().
Therefore, lowpan_device_event() must really check that ieee802154_ptr
is not NULL.
Fixes: 2c88b5283f60d ("ieee802154: 6lowpan: remove check on null")
Signed-off-by: Eric Dumazet <redacted>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <redacted>
Reported-by: syzbot <redacted>
Acked-by: Stefan Schmidt <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ieee802154/6lowpan/core.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <redacted>
[ Upstream commit 4dcb31d4649df36297296b819437709f5407059c ]
Andrei Vagin reported a KASAN: slab-out-of-bounds error in
skb_update_prio()
Since SYNACK might be attached to a request socket, we need to
get back to the listener socket.
Since this listener is manipulated without locks, add const
qualifiers to sock_cgroup_prioidx() so that the const can also
be used in skb_update_prio()
Also add the const qualifier to sock_cgroup_classid() for consistency.
Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <redacted>
Reported-by: Andrei Vagin <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/cgroup-defs.h | 4 ++--
net/core/dev.c | 22 +++++++++++++++-------
2 files changed, 17 insertions(+), 9 deletions(-)
@@ -609,13 +609,13 @@ struct sock_cgroup_data {*updatersandreturnpartofthepreviouspointerastheprioidxor*classid.Suchracesareshort-livedandtheresultisn'tcritical.*/-staticinlineu16sock_cgroup_prioidx(structsock_cgroup_data*skcd)+staticinlineu16sock_cgroup_prioidx(conststructsock_cgroup_data*skcd){/* fallback to 1 which is always the ID of the root cgroup */return(skcd->is_data&1)?skcd->prioidx:1;}-staticinlineu32sock_cgroup_classid(structsock_cgroup_data*skcd)+staticinlineu32sock_cgroup_classid(conststructsock_cgroup_data*skcd){/* fallback to 0 which is the unconfigured default classid */return(skcd->is_data&1)?skcd->classid:0;---a/net/core/dev.c+++b/net/core/dev.c
@@ -3179,15 +3179,23 @@ static inline int __dev_xmit_skb(struct#if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)staticvoidskb_update_prio(structsk_buff*skb){-structnetprio_map*map=rcu_dereference_bh(skb->dev->priomap);+conststructnetprio_map*map;+conststructsock*sk;+unsignedintprioidx;-if(!skb->priority&&skb->sk&&map){-unsignedintprioidx=-sock_cgroup_prioidx(&skb->sk->sk_cgrp_data);+if(skb->priority)+return;+map=rcu_dereference_bh(skb->dev->priomap);+if(!map)+return;+sk=skb_to_full_sk(skb);+if(!sk)+return;-if(prioidx<map->priomap_len)-skb->priority=map->priomap[prioidx];-}+prioidx=sock_cgroup_prioidx(&sk->sk_cgrp_data);++if(prioidx<map->priomap_len)+skb->priority=map->priomap[prioidx];}#else#define skb_update_prio(skb)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <redacted>
[ Upstream commit a560002437d3646dafccecb1bf32d1685112ddda ]
inet_evict_bucket() iterates global list, and
several tasks may call it in parallel. All of
them hash the same fq->list_evictor to different
lists, which leads to list corruption.
This patch makes fq be hashed to expired list
only if this has not been made yet by another
task. Since inet_frag_alloc() allocates fq
using kmem_cache_zalloc(), we may rely on
list_evictor is initially unhashed.
The problem seems to exist before async
pernet_operations, as there was possible to have
exit method to be executed in parallel with
inet_frags::frags_work, so I add two Fixes tags.
This also may go to stable.
Fixes: d1fe19444d82 "inet: frag: don't re-use chainlist for evictor"
Fixes: f84c6821aa54 "net: Convert pernet_subsys, registered from inet_init()"
Signed-off-by: Kirill Tkhai <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_fragment.c | 3 +++
1 file changed, 3 insertions(+)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <redacted>
[ Upstream commit 67f93df79aeefc3add4e4b31a752600f834236e2 ]
dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
therefore if DCCP socket is disconnected and dccp_sendmsg() is
called after it, it will cause a NULL pointer dereference in
dccp_write_xmit().
This crash and the reproducer was reported by syzbot. Looks like
it is reproduced if commit 69c64866ce07 ("dccp: CVE-2017-8824:
use-after-free in DCCP code") is applied.
Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com
Signed-off-by: Alexey Kodanev <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/proto.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/dccp/proto.c+++ b/net/dccp/proto.c
@@ -789,6 +789,11 @@ int dccp_sendmsg(struct sock *sk, structif(skb==NULL)gotoout_release;+if(sk->sk_state==DCCP_CLOSED){+rc=-ENOTCONN;+gotoout_discard;+}+skb_reserve(skb,sk->sk_prot->max_header);rc=memcpy_from_msg(skb_put(skb,len),msg,len);if(rc!=0)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <redacted>
[ Upstream commit 9f62c15f28b0d1d746734666d88a79f08ba1e43e ]
Fix the following slab-out-of-bounds kasan report in
ndisc_fill_redirect_hdr_option when the incoming ipv6 packet is not
linear and the accessed data are not in the linear data region of orig_skb.
[ 1503.122508] ==================================================================
[ 1503.122832] BUG: KASAN: slab-out-of-bounds in ndisc_send_redirect+0x94e/0x990
[ 1503.123036] Read of size 1184 at addr ffff8800298ab6b0 by task netperf/1932
[ 1503.123220] CPU: 0 PID: 1932 Comm: netperf Not tainted 4.16.0-rc2+ #124
[ 1503.123347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-2.fc27 04/01/2014
[ 1503.123527] Call Trace:
[ 1503.123579] <IRQ>
[ 1503.123638] print_address_description+0x6e/0x280
[ 1503.123849] kasan_report+0x233/0x350
[ 1503.123946] memcpy+0x1f/0x50
[ 1503.124037] ndisc_send_redirect+0x94e/0x990
[ 1503.125150] ip6_forward+0x1242/0x13b0
[...]
[ 1503.153890] Allocated by task 1932:
[ 1503.153982] kasan_kmalloc+0x9f/0xd0
[ 1503.154074] __kmalloc_track_caller+0xb5/0x160
[ 1503.154198] __kmalloc_reserve.isra.41+0x24/0x70
[ 1503.154324] __alloc_skb+0x130/0x3e0
[ 1503.154415] sctp_packet_transmit+0x21a/0x1810
[ 1503.154533] sctp_outq_flush+0xc14/0x1db0
[ 1503.154624] sctp_do_sm+0x34e/0x2740
[ 1503.154715] sctp_primitive_SEND+0x57/0x70
[ 1503.154807] sctp_sendmsg+0xaa6/0x1b10
[ 1503.154897] sock_sendmsg+0x68/0x80
[ 1503.154987] ___sys_sendmsg+0x431/0x4b0
[ 1503.155078] __sys_sendmsg+0xa4/0x130
[ 1503.155168] do_syscall_64+0x171/0x3f0
[ 1503.155259] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1503.155436] Freed by task 1932:
[ 1503.155527] __kasan_slab_free+0x134/0x180
[ 1503.155618] kfree+0xbc/0x180
[ 1503.155709] skb_release_data+0x27f/0x2c0
[ 1503.155800] consume_skb+0x94/0xe0
[ 1503.155889] sctp_chunk_put+0x1aa/0x1f0
[ 1503.155979] sctp_inq_pop+0x2f8/0x6e0
[ 1503.156070] sctp_assoc_bh_rcv+0x6a/0x230
[ 1503.156164] sctp_inq_push+0x117/0x150
[ 1503.156255] sctp_backlog_rcv+0xdf/0x4a0
[ 1503.156346] __release_sock+0x142/0x250
[ 1503.156436] release_sock+0x80/0x180
[ 1503.156526] sctp_sendmsg+0xbb0/0x1b10
[ 1503.156617] sock_sendmsg+0x68/0x80
[ 1503.156708] ___sys_sendmsg+0x431/0x4b0
[ 1503.156799] __sys_sendmsg+0xa4/0x130
[ 1503.156889] do_syscall_64+0x171/0x3f0
[ 1503.156980] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1503.157158] The buggy address belongs to the object at ffff8800298ab600
which belongs to the cache kmalloc-1024 of size 1024
[ 1503.157444] The buggy address is located 176 bytes inside of
1024-byte region [ffff8800298ab600, ffff8800298aba00)
[ 1503.157702] The buggy address belongs to the page:
[ 1503.157820] page:ffffea0000a62a00 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0
[ 1503.158053] flags: 0x4000000000008100(slab|head)
[ 1503.158171] raw: 4000000000008100 0000000000000000 0000000000000000 00000001800e000e
[ 1503.158350] raw: dead000000000100 dead000000000200 ffff880036002600 0000000000000000
[ 1503.158523] page dumped because: kasan: bad access detected
[ 1503.158698] Memory state around the buggy address:
[ 1503.158816] ffff8800298ab900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1503.158988] ffff8800298ab980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1503.159165] >ffff8800298aba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1503.159338] ^
[ 1503.159436] ffff8800298aba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1503.159610] ffff8800298abb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1503.159785] ==================================================================
[ 1503.159964] Disabling lock debugging due to kernel taint
The test scenario to trigger the issue consists of 4 devices:
- H0: data sender, connected to LAN0
- H1: data receiver, connected to LAN1
- GW0 and GW1: routers between LAN0 and LAN1. Both of them have an
ethernet connection on LAN0 and LAN1
On H{0,1} set GW0 as default gateway while on GW0 set GW1 as next hop for
data from LAN0 to LAN1.
Moreover create an ip6ip6 tunnel between H0 and H1 and send 3 concurrent
data streams (TCP/UDP/SCTP) from H0 to H1 through ip6ip6 tunnel (send
buffer size is set to 16K). While data streams are active flush the route
cache on HA multiple times.
I have not been able to identify a given commit that introduced the issue
since, using the reproducer described above, the kasan report has been
triggered from 4.14 and I have not gone back further.
Reported-by: Jianlin Shi <redacted>
Reviewed-by: Stefano Brivio <redacted>
Reviewed-by: Eric Dumazet <redacted>
Signed-off-by: Lorenzo Bianconi <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ndisc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <redacted>
[ Upstream commit 17cfe79a65f98abe535261856c5aef14f306dff7 ]
syzkaller found an issue caused by lack of sufficient checks
in l2tp_tunnel_create()
RAW sockets can not be considered as UDP ones for instance.
In another patch, we shall replace all pr_err() by less intrusive
pr_debug() so that syzkaller can find other bugs faster.
Acked-by: Guillaume Nault <redacted>
Acked-by: James Chapman <jchapman@katalix.com>
==================================================================
BUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69
dst_release: dst:00000000d53d0d0f refcnt:-1
Write of size 1 at addr ffff8801d013b798 by task syz-executor3/6242
CPU: 1 PID: 6242 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #253
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
print_address_description+0x73/0x250 mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report+0x23b/0x360 mm/kasan/report.c:412
__asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435
setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69
l2tp_tunnel_create+0x1354/0x17f0 net/l2tp/l2tp_core.c:1596
pppol2tp_connect+0x14b1/0x1dd0 net/l2tp/l2tp_ppp.c:707
SYSC_connect+0x213/0x4a0 net/socket.c:1640
SyS_connect+0x24/0x30 net/socket.c:1621
do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Eric Dumazet <redacted>
Reported-by: syzbot <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <redacted>
[ Upstream commit 00777fac28ba3e126b9e63e789a613e8bd2cab25 ]
If the optional regulator is deferred, we must release some resources.
They will be re-allocated when the probe function will be called again.
Fixes: 6eacf31139bf ("ethernet: arc: Add support for Rockchip SoC layer device tree bindings")
Signed-off-by: Christophe JAILLET <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/arc/emac_rockchip.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit a069215cf5985f3aa1bba550264907d6bd05c5f7 ]
When unbinding/removing the driver, we will run into the following warnings:
[ 259.655198] fec 400d1000.ethernet: 400d1000.ethernet supply phy not found, using dummy regulator
[ 259.665065] fec 400d1000.ethernet: Unbalanced pm_runtime_enable!
[ 259.672770] fec 400d1000.ethernet (unnamed net_device) (uninitialized): Invalid MAC address: 00:00:00:00:00:00
[ 259.683062] fec 400d1000.ethernet (unnamed net_device) (uninitialized): Using random MAC address: f2:3e:93:b7:29:c1
[ 259.696239] libphy: fec_enet_mii_bus: probed
Avoid these warnings by balancing the runtime PM calls during fec_drv_remove().
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/fec_main.c | 2 ++
1 file changed, 2 insertions(+)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <redacted>
[ Upstream commit 02a2385f37a7c6594c9d89b64c4a1451276f08eb ]
nlmsg_multicast() consumes always the skb, thus the original skb must be
freed only when this function is called with a clone.
Fixes: cb9f7a9a5c96 ("netlink: ensure to loop over all netns in genlmsg_multicast_allns()")
Reported-by: Ben Hutchings <redacted>
Signed-off-by: Nicolas Dichtel <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlink/genetlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
[ Upstream commit 6e5d58fdc9bedd0255a8781b258f10bbdc63e975 ]
When errors are enqueued to the error queue via sock_queue_err_skb()
function, it is possible that the waiting application is not notified.
Calling 'sk->sk_data_ready()' would not notify applications that
selected only POLLERR events in poll() (for example).
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Randy E. Witt <redacted>
Reviewed-by: Eric Dumazet <redacted>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/skbuff.c+++ b/net/core/skbuff.c
@@ -3717,7 +3717,7 @@ int sock_queue_err_skb(struct sock *sk,skb_queue_tail(&sk->sk_error_queue,skb);if(!sock_flag(sk,SOCK_DEAD))-sk->sk_data_ready(sk);+sk->sk_error_report(sk);return0;}EXPORT_SYMBOL(sock_queue_err_skb);
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadi Sharshevsky <redacted>
[ Upstream commit cbcc607e18422555db569b593608aec26111cb0b ]
The __send_and_alloc_skb() receives a skb ptr as a parameter but in
case it fails the skb is not valid:
- Send failed and released the skb internally.
- Allocation failed.
The current code tries to release the skb in case of failure which
causes redundant freeing.
Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
Signed-off-by: Arkadi Sharshevsky <redacted>
Acked-by: Jiri Pirko <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/team/team.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madalin Bucur <madalin.bucur@nxp.com>
[ Upstream commit 96f413f47677366e0ae03797409bfcc4151dbf9e ]
The wait_for_completion() call in qman_delete_cgr_safe()
was triggering a scheduling while atomic bug, replacing the
kthread with a smp_call_function_single() call to fix it.
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: Roy Pledge <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/fsl/qbman/qman.c | 28 +++++-----------------------
1 file changed, 5 insertions(+), 23 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <redacted>
[ Upstream commit 6be687395b3124f002a653c1a50b3260222b3cd7 ]
On removal, a qeth card's netdevice is currently not properly freed
because the call chain looks as follows:
qeth_core_remove_device(card)
lx_remove_device(card)
unregister_netdev(card->dev)
card->dev = NULL !!!
qeth_core_free_card(card)
if (card->dev) !!!
free_netdev(card->dev)
Fix it by free'ing the netdev straight after unregistering. This also
fixes the sysfs-driven layer switch case (qeth_dev_layer2_store()),
where the need to free the current netdevice was not considered at all.
Note that free_netdev() takes care of the netif_napi_del() for us too.
Fixes: 4a71df50047f ("qeth: new qeth device driver")
Signed-off-by: Julian Wiedmann <redacted>
Reviewed-by: Ursula Braun <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_core_main.c | 2 --
drivers/s390/net/qeth_l2_main.c | 2 +-
drivers/s390/net/qeth_l3_main.c | 2 +-
3 files changed, 2 insertions(+), 4 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <redacted>
[ Upstream commit 1063e432bb45be209427ed3f1ca3908e4aa3c7d7 ]
qeth_wait_for_threads() is potentially called by multiple users, make
sure to notify all of them after qeth_clear_thread_running_bit()
adjusted the thread_running_mask. With no timeout, callers would
otherwise stall.
Signed-off-by: Julian Wiedmann <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_core_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <redacted>
[ Upstream commit 17bf8c9b3d499d5168537c98b61eb7a1fcbca6c2 ]
For calling ccw_device_start(), issue_next_read() needs to hold the
device's ccwlock.
This is satisfied for the IRQ handler path (where qeth_irq() gets called
under the ccwlock), but we need explicit locking for the initial call by
the MPC initialization.
Signed-off-by: Julian Wiedmann <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_core_main.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <redacted>
[ Upstream commit a6c3d93963e4b333c764fde69802c3ea9eaa9d5c ]
When the IRQ handler determines that one of the cmd IO channels has
failed and schedules recovery, block any further cmd requests from
being submitted. The request would inevitably stall, and prevent the
recovery from making progress until the request times out.
This sort of error was observed after Live Guest Relocation, where
the pending IO on the READ channel intentionally gets terminated to
kick-start recovery. Simultaneously the guest executed SIOCETHTOOL,
triggering qeth to issue a QUERY CARD INFO command. The command
then stalled in the inoperabel WRITE channel.
Signed-off-by: Julian Wiedmann <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_core_main.c | 1 +
1 file changed, 1 insertion(+)
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 484d802d0f2f29c335563fcac2a8facf174a1bbc ]
There is no need for complex checking between the last consumed index
and current consumed index, a simple subtraction will do.
This also eliminates the possibility of a permanent transmit queue stall
under the following conditions:
- one CPU bursts ring->size worth of traffic (up to 256 buffers), to the
point where we run out of free descriptors, so we stop the transmit
queue at the end of bcm_sysport_xmit()
- because of our locking, we have the transmit process disable
interrupts which means we can be blocking the TX reclamation process
- when TX reclamation finally runs, we will be computing the difference
between ring->c_index (last consumed index by SW) and what the HW
reports through its register
- this register is masked with (ring->size - 1) = 0xff, which will lead
to stripping the upper bits of the index (register is 16-bits wide)
- we will be computing last_tx_cn as 0, which means there is no work to
be done, and we never wake-up the transmit queue, leaving it
permanently disabled
A practical example is e.g: ring->c_index aka last_c_index = 12, we
pushed 256 entries, HW consumer index = 268, we mask it with 0xff = 12,
so last_tx_cn == 0, nothing happens.
Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bcmsysport.c | 33 +++++++++++++----------------
drivers/net/ethernet/broadcom/bcmsysport.h | 2 -
2 files changed, 16 insertions(+), 19 deletions(-)
@@ -707,37 +707,33 @@ static unsigned int __bcm_sysport_tx_recstructbcm_sysport_tx_ring*ring){structnet_device*ndev=priv->netdev;-unsignedintc_index,last_c_index,last_tx_cn,num_tx_cbs;unsignedintpkts_compl=0,bytes_compl=0;+unsignedinttxbds_processed=0;structbcm_sysport_cb*cb;+unsignedinttxbds_ready;+unsignedintc_index;u32hw_ind;/* Compute how many descriptors have been processed since last call */hw_ind=tdma_readl(priv,TDMA_DESC_RING_PROD_CONS_INDEX(ring->index));c_index=(hw_ind>>RING_CONS_INDEX_SHIFT)&RING_CONS_INDEX_MASK;-ring->p_index=(hw_ind&RING_PROD_INDEX_MASK);--last_c_index=ring->c_index;-num_tx_cbs=ring->size;--c_index&=(num_tx_cbs-1);--if(c_index>=last_c_index)-last_tx_cn=c_index-last_c_index;-else-last_tx_cn=num_tx_cbs-last_c_index+c_index;+txbds_ready=(c_index-ring->c_index)&RING_CONS_INDEX_MASK;netif_dbg(priv,tx_done,ndev,-"ring=%d c_index=%d last_tx_cn=%d last_c_index=%d\n",-ring->index,c_index,last_tx_cn,last_c_index);+"ring=%d old_c_index=%u c_index=%u txbds_ready=%u\n",+ring->index,ring->c_index,c_index,txbds_ready);-while(last_tx_cn-->0){-cb=ring->cbs+last_c_index;+while(txbds_processed<txbds_ready){+cb=&ring->cbs[ring->clean_index];bcm_sysport_tx_reclaim_one(priv,cb,&bytes_compl,&pkts_compl);ring->desc_count++;-last_c_index++;-last_c_index&=(num_tx_cbs-1);+txbds_processed++;++if(likely(ring->clean_index<ring->size-1))+ring->clean_index++;+else+ring->clean_index=0;}ring->c_index=c_index;
@@ -1207,6 +1203,7 @@ static int bcm_sysport_init_tx_ring(strunetif_tx_napi_add(priv->netdev,&ring->napi,bcm_sysport_tx_poll,64);ring->index=index;ring->size=size;+ring->clean_index=0;ring->alloc_size=ring->size;ring->desc_cpu=p;ring->desc_count=ring->size;---a/drivers/net/ethernet/broadcom/bcmsysport.h+++b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -638,7 +638,7 @@ struct bcm_sysport_tx_ring {unsignedintdesc_count;/* Number of descriptors */unsignedintcurr_desc;/* Current descriptor */unsignedintc_index;/* Last consumer index */-unsignedintp_index;/* Current producer index */+unsignedintclean_index;/* Current clean index */structbcm_sysport_cb*cbs;/* Transmit control blocks */structdma_desc*desc_cpu;/* CPU view of the descriptor */structbcm_sysport_priv*priv;/* private context backpointer */
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Herbert <redacted>
[ Upstream commit 2cc683e88c0c993ac3721d9b702cb0630abe2879 ]
Need to lock lower socket in order to provide mutual exclusion
with kcm_unattach.
v2: Add Reported-by for syzbot
Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
Signed-off-by: Tom Herbert <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/kcm/kcmsock.c | 33 +++++++++++++++++++++++----------
1 file changed, 23 insertions(+), 10 deletions(-)
--- a/net/kcm/kcmsock.c+++ b/net/kcm/kcmsock.c
@@ -1375,24 +1375,32 @@ static int kcm_attach(struct socket *socstructlist_head*head;intindex=0;structstrp_callbackscb;-interr;+interr=0;csk=csock->sk;if(!csk)return-EINVAL;+lock_sock(csk);+/* Only allow TCP sockets to be attached for now */if((csk->sk_family!=AF_INET&&csk->sk_family!=AF_INET6)||-csk->sk_protocol!=IPPROTO_TCP)-return-EOPNOTSUPP;+csk->sk_protocol!=IPPROTO_TCP){+err=-EOPNOTSUPP;+gotoout;+}/* Don't allow listeners or closed sockets */-if(csk->sk_state==TCP_LISTEN||csk->sk_state==TCP_CLOSE)-return-EOPNOTSUPP;+if(csk->sk_state==TCP_LISTEN||csk->sk_state==TCP_CLOSE){+err=-EOPNOTSUPP;+gotoout;+}psock=kmem_cache_zalloc(kcm_psockp,GFP_KERNEL);-if(!psock)-return-ENOMEM;+if(!psock){+err=-ENOMEM;+gotoout;+}psock->mux=mux;psock->sk=csk;
@@ -1406,7 +1414,7 @@ static int kcm_attach(struct socket *socerr=strp_init(&psock->strp,csk,&cb);if(err){kmem_cache_free(kcm_psockp,psock);-returnerr;+gotoout;}write_lock_bh(&csk->sk_callback_lock);
@@ -1418,7 +1426,8 @@ static int kcm_attach(struct socket *socwrite_unlock_bh(&csk->sk_callback_lock);strp_done(&psock->strp);kmem_cache_free(kcm_psockp,psock);-return-EALREADY;+err=-EALREADY;+gotoout;}psock->save_data_ready=csk->sk_data_ready;
@@ -1454,7 +1463,10 @@ static int kcm_attach(struct socket *soc/* Schedule RX work in case there are already bytes queued */strp_check_rcv(&psock->strp);-return0;+out:+release_sock(csk);++returnerr;}staticintkcm_attach_ioctl(structsocket*sock,structkcm_attach*info)
@@ -360,6 +360,10 @@ int hns_nic_net_xmit_hw(struct net_devicdev_queue=netdev_get_tx_queue(ndev,skb->queue_mapping);netdev_tx_sent_queue(dev_queue,skb->len);+netif_trans_update(ndev);+ndev->stats.tx_bytes+=skb->len;+ndev->stats.tx_packets++;+wmb();/* commit all data before submit */assert(skb->queue_mapping<priv->ae_handle->q_num);hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping],buf_num);
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <redacted>
[ Upstream commit 2cbb4ea7de167b02ffa63e9cdfdb07a7e7094615 ]
Only allow ifindex from IP_PKTINFO to override SO_BINDTODEVICE settings
if the index is actually set in the message.
Signed-off-by: David Ahern <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_sockglue.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
On 29 March 2018 at 23:30, Greg Kroah-Hartman
[off-list ref] wrote:
This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
On Thu, Mar 29, 2018 at 08:00:19PM +0200, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
On Fri, Mar 30, 2018 at 11:51:26AM +0530, Naresh Kamboju wrote:
On 29 March 2018 at 23:30, Greg Kroah-Hartman
[off-list ref] wrote:
quoted
This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
-rc2 is out which hopefully should be just as good :)
On 30 March 2018 at 14:38, Greg Kroah-Hartman
[off-list ref] wrote:
On Fri, Mar 30, 2018 at 11:51:26AM +0530, Naresh Kamboju wrote:
quoted
On 29 March 2018 at 23:30, Greg Kroah-Hartman
[off-list ref] wrote:
quoted
This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.92-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
-rc2 is out which hopefully should be just as good :)
This is the start of the stable review cycle for the 4.9.92 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Mar 31 17:57:18 UTC 2018.
Anything received after that time might be too late.
For v4.9.91-29-gbc89e90:
Build results:
total: 145 pass: 145 fail: 0
Qemu test results:
total: 137 pass: 137 fail: 0
Guenter