Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1429316 > unrolled thread

[PATCH 4.4 00/75] 4.4.14-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2016-06-23 01:30 +0200
Last post2016-06-23 07:00 +0200
Articles 14 — 1 participant

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 00/75] 4.4.14-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 08/75] bpf: Use mount_nodev not mount_ns to mount the bpf filesystem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 10/75] uapi glibc compat: fix compilation when !__USE_MISC in glibc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 14/75] vxlan: Accept user specified MTU value when create new vxlan link Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 18/75] ipv6: Skip XFRM lookup if dst_entry in socket cache is valid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 13/75] team: dont call netdev_change_features under team->lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 03/75] tipc: check nl sock before parsing nested attributes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 11/75] bpf, inode: disallow userns mounts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 01/75] scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 12/75] sfc: on MC reset, clear PIO buffer linkage in TXQs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 04/75] netlink: Fix dump skb leak/double free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 06/75] switchdev: pass pointer to fib_info instead of copy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    [PATCH 4.4 07/75] tuntap: correctly wake up process during uninit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:30 +0200
    Re: [PATCH 4.4 00/75] 4.4.14-stable review -rc2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 07:00 +0200

#1429316 — [PATCH 4.4 00/75] 4.4.14-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 00/75] 4.4.14-stable review
Message-ID<rMZ85-15H-3@gated-at.bofh.it>
This is the start of the stable review cycle for the 4.4.14 release.
There are 75 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri Jun 24 22:34:00 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.14-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.14-rc1

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: don't reject valid target size on some architectures

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: validate all offsets and sizes in a rule

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: check for bogus target offset

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: check standard target size too

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: add compat version of xt_check_entry_offsets

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: assert minimum target size

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: kill check_entry helper

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: add and use xt_check_entry_offsets

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: validate targets of jumps

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: don't move to non-existent next rule

Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    drm/core: Do not preserve framebuffer on rmfb, v4.

Tadeusz Struk <tadeusz.struk@intel.com>
    crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: fix unconditional helper

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: make sure e->next_offset covers remaining blob size

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: validate e->target_offset early

Ralf Baechle <ralf@linux-mips.org>
    MIPS: Fix 64k page support for 32 bit kernels.

David S. Miller <davem@davemloft.net>
    sparc64: Fix return from trap window fill crashes.

David S. Miller <davem@davemloft.net>
    sparc: Harden signal return frame checks.

David S. Miller <davem@davemloft.net>
    sparc64: Take ctx_alloc_lock properly in hugetlb_setup().

Nitin Gupta <nitin.m.gupta@oracle.com>
    sparc64: Reduce TLB flushes during hugepte changes

Babu Moger <babu.moger@oracle.com>
    sparc/PCI: Fix for panic while enabling SR-IOV

David S. Miller <davem@davemloft.net>
    sparc64: Fix sparc64_set_context stack handling.

Nitin Gupta <nitin.m.gupta@oracle.com>
    sparc64: Fix numa node distance initialization

David S. Miller <davem@davemloft.net>
    sparc64: Fix bootup regressions on some Kconfig combinations.

Mike Frysinger <vapier@gentoo.org>
    sparc: Fix system call tracing register handling.

Al Viro <viro@zeniv.linux.org.uk>
    fix d_walk()/non-delayed __d_free() race

Jann Horn <jannh@google.com>
    sched: panic on corrupted stack end

Jann Horn <jannh@google.com>
    proc: prevent stacking filesystems on top

Andy Lutomirski <luto@kernel.org>
    x86/entry/traps: Don't force in_interrupt() to return true in IST handlers

Prasun Maiti <prasunmaiti87@gmail.com>
    wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel

Jann Horn <jannh@google.com>
    ecryptfs: forbid opening files without mmap handler

Tejun Heo <tj@kernel.org>
    memcg: add RCU locking around css_for_each_descendant_pre() in memcg_offline_kmem()

Helge Deller <deller@gmx.de>
    parisc: Fix pagefault crash in unaligned __get_user() call

hongkun.cao <hongkun.cao@mediatek.com>
    pinctrl: mediatek: fix dual-edge code defect

Thomas Huth <thuth@redhat.com>
    powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call

Thomas Huth <thuth@redhat.com>
    powerpc: Use privileged SPR number for MMCR2

Thomas Huth <thuth@redhat.com>
    powerpc: Fix definition of SIAR and SDAR registers

Russell Currey <ruscur@russell.cc>
    powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge

Will Deacon <will.deacon@arm.com>
    arm64: mm: always take dirty state from new pte in ptep_set_access_flags

Catalin Marinas <catalin.marinas@arm.com>
    arm64: Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks

Tom Lendacky <thomas.lendacky@amd.com>
    crypto: ccp - Fix AES XTS error for request sizes above 4096

Arnd Bergmann <arnd@arndb.de>
    crypto: public_key: select CRYPTO_AKCIPHER

Marc Zyngier <marc.zyngier@arm.com>
    irqchip/gic-v3: Fix ICC_SGI1R_EL1.INTID decoding mask

Michael Holzheu <holzheu@linux.vnet.ibm.com>
    s390/bpf: reduce maximum program size to 64 KB

Michael Holzheu <holzheu@linux.vnet.ibm.com>
    s390/bpf: fix recache skb->data/hlen for skb_vlan_push/pop

Ben Dooks <ben.dooks@codethink.co.uk>
    gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings

Russell King <rmk+kernel@armlinux.org.uk>
    ARM: fix PTRACE_SETVFPREGS on SMP systems

Torsten Hilbrich <torsten.hilbrich@secunet.com>
    ALSA: hda/realtek: Add T560 docking unit fixup

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - ALC256 speaker noise issue

AceLan Kao <acelan.kao@canonical.com>
    ALSA: hda - Fix headset mic detection problem for Dell machine

Vinod Koul <vinod.koul@intel.com>
    ALSA: hda - Add PCI ID for Kabylake

Paolo Bonzini <pbonzini@redhat.com>
    KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS

David Wragg <david@weave.works>
    vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices

David Wragg <david@weave.works>
    geneve: Relax MTU constraints

David Wragg <david@weave.works>
    vxlan: Relax MTU constraints

Jakub Sitnicki <jkbs@redhat.com>
    ipv6: Skip XFRM lookup if dst_entry in socket cache is valid

Guillaume Nault <g.nault@alphalink.fr>
    l2tp: fix configuration passed to setup_udp_tunnel_sock()

Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    bridge: Don't insert unnecessary local fdb entry on changing mac address

Yuchung Cheng <ycheng@google.com>
    tcp: record TLP and ER timer stats in v6 stats

Chen Haiquan <oc@yunify.com>
    vxlan: Accept user specified MTU value when create new vxlan link

Ivan Vecera <ivecera@redhat.com>
    team: don't call netdev_change_features under team->lock

Edward Cree <ecree@solarflare.com>
    sfc: on MC reset, clear PIO buffer linkage in TXQs

Daniel Borkmann <daniel@iogearbox.net>
    bpf, inode: disallow userns mounts

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    uapi glibc compat: fix compilation when !__USE_MISC in glibc

Hannes Frederic Sowa <hannes@stressinduktion.org>
    udp: prevent skbs lingering in tunnel socket queues

Eric W. Biederman <ebiederm@xmission.com>
    bpf: Use mount_nodev not mount_ns to mount the bpf filesystem

Jason Wang <jasowang@redhat.com>
    tuntap: correctly wake up process during uninit

Jiri Pirko <jiri@mellanox.com>
    switchdev: pass pointer to fib_info instead of copy

Richard Alpe <richard.alpe@ericsson.com>
    tipc: fix nametable publication field in nl compat

Herbert Xu <herbert@gondor.apana.org.au>
    netlink: Fix dump skb leak/double free

Richard Alpe <richard.alpe@ericsson.com>
    tipc: check nl sock before parsing nested attributes

Ewan D. Milne <emilne@redhat.com>
    scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist

James Bottomley <James.Bottomley@HansenPartnership.com>
    scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands


-------------

Diffstat:

 Makefile                                       |   4 +-
 arch/arm/kernel/ptrace.c                       |   2 +-
 arch/arm64/include/asm/elf.h                   |   4 +-
 arch/arm64/kernel/cpuinfo.c                    |   8 +-
 arch/arm64/mm/fault.c                          |   2 +-
 arch/mips/include/asm/processor.h              |   2 +-
 arch/parisc/kernel/unaligned.c                 |  10 +-
 arch/powerpc/include/asm/reg.h                 |   6 +-
 arch/powerpc/kernel/prom_init.c                |   1 +
 arch/powerpc/platforms/pseries/eeh_pseries.c   |  51 +++++---
 arch/s390/net/bpf_jit.h                        |   4 +-
 arch/s390/net/bpf_jit_comp.c                   |   4 +-
 arch/sparc/include/asm/head_64.h               |   4 +
 arch/sparc/include/asm/pgtable_64.h            |  43 +++++--
 arch/sparc/include/asm/tlbflush_64.h           |   3 +-
 arch/sparc/include/asm/ttable.h                |   8 +-
 arch/sparc/kernel/Makefile                     |   1 +
 arch/sparc/kernel/cherrs.S                     |  14 +--
 arch/sparc/kernel/entry.S                      |  17 +++
 arch/sparc/kernel/fpu_traps.S                  |  11 +-
 arch/sparc/kernel/head_64.S                    |  24 ++--
 arch/sparc/kernel/misctrap.S                   |  12 +-
 arch/sparc/kernel/pci.c                        |  17 +++
 arch/sparc/kernel/rtrap_64.S                   |  57 ++-------
 arch/sparc/kernel/signal32.c                   |  46 ++++---
 arch/sparc/kernel/signal_32.c                  |  41 ++++---
 arch/sparc/kernel/signal_64.c                  |  33 ++++--
 arch/sparc/kernel/sigutil_32.c                 |   9 +-
 arch/sparc/kernel/sigutil_64.c                 |  10 +-
 arch/sparc/kernel/spiterrs.S                   |  18 +--
 arch/sparc/kernel/syscalls.S                   |  36 ++++++
 arch/sparc/kernel/urtt_fill.S                  |  98 +++++++++++++++
 arch/sparc/kernel/utrap.S                      |   3 +-
 arch/sparc/kernel/vmlinux.lds.S                |   4 +
 arch/sparc/kernel/winfixup.S                   |   3 +-
 arch/sparc/mm/hugetlbpage.c                    |  33 +++++-
 arch/sparc/mm/init_64.c                        |  37 +++---
 arch/sparc/mm/tlb.c                            |  25 ++--
 arch/sparc/mm/tsb.c                            |  32 ++---
 arch/x86/kernel/traps.c                        |  20 ++--
 arch/x86/kvm/x86.c                             |   5 +
 crypto/asymmetric_keys/Kconfig                 |   1 +
 drivers/crypto/ccp/ccp-crypto-aes-xts.c        |  17 ++-
 drivers/crypto/qat/qat_common/adf_common_drv.h |  13 +-
 drivers/gpio/gpio-bcm-kona.c                   |   4 +-
 drivers/gpu/drm/drm_crtc.c                     |  60 +++++++++-
 drivers/net/ethernet/rocker/rocker.c           |   4 +-
 drivers/net/ethernet/sfc/ef10.c                |  16 +++
 drivers/net/geneve.c                           |  41 +++++--
 drivers/net/team/team.c                        |   9 +-
 drivers/net/tun.c                              |   6 +-
 drivers/net/vxlan.c                            |  60 ++++++----
 drivers/pinctrl/mediatek/pinctrl-mtk-common.c  |   5 +-
 drivers/scsi/scsi_devinfo.c                    |   1 +
 drivers/scsi/scsi_lib.c                        |   7 +-
 fs/dcache.c                                    |   4 +-
 fs/ecryptfs/kthread.c                          |  13 +-
 fs/proc/root.c                                 |   7 ++
 include/linux/irqchip/arm-gic-v3.h             |   2 +-
 include/linux/netfilter/x_tables.h             |   7 ++
 include/net/ip_tunnels.h                       |   1 +
 include/net/switchdev.h                        |   2 +-
 include/uapi/linux/libc-compat.h               |   2 +-
 kernel/bpf/inode.c                             |   3 +-
 kernel/sched/core.c                            |   3 +-
 mm/memcontrol.c                                |   3 +
 net/bridge/br_fdb.c                            |   2 +
 net/ipv4/ip_gre.c                              |   8 ++
 net/ipv4/ip_tunnel.c                           |  20 +++-
 net/ipv4/netfilter/arp_tables.c                |  87 ++++++++------
 net/ipv4/netfilter/ip_tables.c                 |  90 +++++++-------
 net/ipv4/udp.c                                 |   2 +-
 net/ipv6/ip6_output.c                          |  11 +-
 net/ipv6/netfilter/ip6_tables.c                |  90 +++++++-------
 net/ipv6/tcp_ipv6.c                            |   4 +-
 net/ipv6/udp.c                                 |   2 +-
 net/l2tp/l2tp_core.c                           |   2 +-
 net/netfilter/x_tables.c                       | 158 +++++++++++++++++++++++++
 net/netlink/af_netlink.c                       |   7 +-
 net/openvswitch/vport-vxlan.c                  |   2 +
 net/switchdev/switchdev.c                      |   6 +-
 net/tipc/netlink_compat.c                      |   2 +-
 net/tipc/socket.c                              |   3 +
 net/wireless/wext-core.c                       |  25 +++-
 sound/pci/hda/hda_intel.c                      |  11 +-
 sound/pci/hda/patch_realtek.c                  |  73 +++++++++++-
 virt/kvm/irqchip.c                             |   2 +-
 87 files changed, 1184 insertions(+), 476 deletions(-)

[toc] | [next] | [standalone]

#1429320 — [PATCH 4.4 08/75] bpf: Use mount_nodev not mount_ns to mount the bpf filesystem

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 08/75] bpf: Use mount_nodev not mount_ns to mount the bpf filesystem
Message-ID<rMZKO-1BV-29@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Eric W. Biederman" <ebiederm@xmission.com>

[ Upstream commit e27f4a942a0ee4b84567a3c6cfa84f273e55cbb7 ]

While reviewing the filesystems that set FS_USERNS_MOUNT I spotted the
bpf filesystem.  Looking at the code I saw a broken usage of mount_ns
with current->nsproxy->mnt_ns. As the code does not acquire a
reference to the mount namespace it can not possibly be correct to
store the mount namespace on the superblock as it does.

Replace mount_ns with mount_nodev so that each mount of the bpf
filesystem returns a distinct instance, and the code is not buggy.

In discussion with Hannes Frederic Sowa it was reported that the use
of mount_ns was an attempt to have one bpf instance per mount
namespace, in an attempt to keep resources that pin resources from
hiding.  That intent simply does not work, the vfs is not built to
allow that kind of behavior.  Which means that the bpf filesystem
really is buggy both semantically and in it's implemenation as it does
not nor can it implement the original intent.

This change is userspace visible, but my experience with similar
filesystems leads me to believe nothing will break with a model of each
mount of the bpf filesystem is distinct from all others.

Fixes: b2197755b263 ("bpf: add support for persistent maps/progs")
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/inode.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -358,7 +358,7 @@ static int bpf_fill_super(struct super_b
 static struct dentry *bpf_mount(struct file_system_type *type, int flags,
 				const char *dev_name, void *data)
 {
-	return mount_ns(type, flags, current->nsproxy->mnt_ns, bpf_fill_super);
+	return mount_nodev(type, flags, data, bpf_fill_super);
 }
 
 static struct file_system_type bpf_fs_type = {

[toc] | [prev] | [next] | [standalone]

#1429321 — [PATCH 4.4 10/75] uapi glibc compat: fix compilation when !__USE_MISC in glibc

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 10/75] uapi glibc compat: fix compilation when !__USE_MISC in glibc
Message-ID<rMZKO-1BV-31@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

[ Upstream commit f0a3fdca794d1e68ae284ef4caefe681f7c18e89 ]

These structures are defined only if __USE_MISC is set in glibc net/if.h
headers, ie when _BSD_SOURCE or _SVID_SOURCE are defined.

CC: Jan Engelhardt <jengelh@inai.de>
CC: Josh Boyer <jwboyer@fedoraproject.org>
CC: Stephen Hemminger <shemming@brocade.com>
CC: Waldemar Brodkorb <mail@waldemar-brodkorb.de>
CC: Gabriel Laskar <gabriel@lse.epita.fr>
CC: Mikko Rapeli <mikko.rapeli@iki.fi>
Fixes: 4a91cb61bb99 ("uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/uapi/linux/libc-compat.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -52,7 +52,7 @@
 #if defined(__GLIBC__)
 
 /* Coordinate with glibc net/if.h header. */
-#if defined(_NET_IF_H)
+#if defined(_NET_IF_H) && defined(__USE_MISC)
 
 /* GLIBC headers included first so don't define anything
  * that would already be defined. */

[toc] | [prev] | [next] | [standalone]

#1429322 — [PATCH 4.4 14/75] vxlan: Accept user specified MTU value when create new vxlan link

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 14/75] vxlan: Accept user specified MTU value when create new vxlan link
Message-ID<rMZKO-1BV-33@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen Haiquan <oc@yunify.com>

[ Upstream commit ce577668a426c6a9e2470a09dcd07fbd6e45272a ]

When create a new vxlan link, example:
  ip link add vtap mtu 1440 type vxlan vni 1 dev eth0

The argument "mtu" has no effect, because it is not set to conf->mtu. The
default value is used in vxlan_dev_configure function.

This problem was introduced by commit 0dfbdf4102b9 (vxlan: Factor out device
configuration).

Fixes: 0dfbdf4102b9 (vxlan: Factor out device configuration)
Signed-off-by:  Chen Haiquan <oc@yunify.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vxlan.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2985,6 +2985,9 @@ static int vxlan_newlink(struct net *src
 	if (data[IFLA_VXLAN_REMCSUM_NOPARTIAL])
 		conf.flags |= VXLAN_F_REMCSUM_NOPARTIAL;
 
+	if (tb[IFLA_MTU])
+		conf.mtu = nla_get_u32(tb[IFLA_MTU]);
+
 	err = vxlan_dev_configure(src_net, dev, &conf);
 	switch (err) {
 	case -ENODEV:

[toc] | [prev] | [next] | [standalone]

#1429324 — [PATCH 4.4 18/75] ipv6: Skip XFRM lookup if dst_entry in socket cache is valid

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 18/75] ipv6: Skip XFRM lookup if dst_entry in socket cache is valid
Message-ID<rMZKO-1BV-39@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jakub Sitnicki <jkbs@redhat.com>

[ Upstream commit 00bc0ef5880dc7b82f9c320dead4afaad48e47be ]

At present we perform an xfrm_lookup() for each UDPv6 message we
send. The lookup involves querying the flow cache (flow_cache_lookup)
and, in case of a cache miss, creating an XFRM bundle.

If we miss the flow cache, we can end up creating a new bundle and
deriving the path MTU (xfrm_init_pmtu) from on an already transformed
dst_entry, which we pass from the socket cache (sk->sk_dst_cache) down
to xfrm_lookup(). This can happen only if we're caching the dst_entry
in the socket, that is when we're using a connected UDP socket.

To put it another way, the path MTU shrinks each time we miss the flow
cache, which later on leads to incorrectly fragmented payload. It can
be observed with ESPv6 in transport mode:

  1) Set up a transformation and lower the MTU to trigger fragmentation
    # ip xfrm policy add dir out src ::1 dst ::1 \
      tmpl src ::1 dst ::1 proto esp spi 1
    # ip xfrm state add src ::1 dst ::1 \
      proto esp spi 1 enc 'aes' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
    # ip link set dev lo mtu 1500

  2) Monitor the packet flow and set up an UDP sink
    # tcpdump -ni lo -ttt &
    # socat udp6-listen:12345,fork /dev/null &

  3) Send a datagram that needs fragmentation with a connected socket
    # perl -e 'print "@" x 1470 | socat - udp6:[::1]:12345
    2016/06/07 18:52:52 socat[724] E read(3, 0x555bb3d5ba00, 8192): Protocol error
    00:00:00.000000 IP6 ::1 > ::1: frag (0|1448) ESP(spi=0x00000001,seq=0x2), length 1448
    00:00:00.000014 IP6 ::1 > ::1: frag (1448|32)
    00:00:00.000050 IP6 ::1 > ::1: ESP(spi=0x00000001,seq=0x3), length 1272
    (^ ICMPv6 Parameter Problem)
    00:00:00.000022 IP6 ::1 > ::1: ESP(spi=0x00000001,seq=0x5), length 136

  4) Compare it to a non-connected socket
    # perl -e 'print "@" x 1500' | socat - udp6-sendto:[::1]:12345
    00:00:40.535488 IP6 ::1 > ::1: frag (0|1448) ESP(spi=0x00000001,seq=0x6), length 1448
    00:00:00.000010 IP6 ::1 > ::1: frag (1448|64)

What happens in step (3) is:

  1) when connecting the socket in __ip6_datagram_connect(), we
     perform an XFRM lookup, miss the flow cache, create an XFRM
     bundle, and cache the destination,

  2) afterwards, when sending the datagram, we perform an XFRM lookup,
     again, miss the flow cache (due to mismatch of flowi6_iif and
     flowi6_oif, which is an issue of its own), and recreate an XFRM
     bundle based on the cached (and already transformed) destination.

To prevent the recreation of an XFRM bundle, avoid an XFRM lookup
altogether whenever we already have a destination entry cached in the
socket. This prevents the path MTU shrinkage and brings us on par with
UDPv4.

The fix also benefits connected PINGv6 sockets, another user of
ip6_sk_dst_lookup_flow(), who also suffer messages being transformed
twice.

Joint work with Hannes Frederic Sowa.

Reported-by: Jan Tluka <jtluka@redhat.com>
Signed-off-by: Jakub Sitnicki <jkbs@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_output.c |   11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1072,17 +1072,12 @@ struct dst_entry *ip6_sk_dst_lookup_flow
 					 const struct in6_addr *final_dst)
 {
 	struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
-	int err;
 
 	dst = ip6_sk_dst_check(sk, dst, fl6);
+	if (!dst)
+		dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
 
-	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
-	if (err)
-		return ERR_PTR(err);
-	if (final_dst)
-		fl6->daddr = *final_dst;
-
-	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
+	return dst;
 }
 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);

[toc] | [prev] | [next] | [standalone]

#1429329 — [PATCH 4.4 13/75] team: dont call netdev_change_features under team->lock

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 13/75] team: dont call netdev_change_features under team->lock
Message-ID<rMZKP-1BV-53@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ivan Vecera <ivecera@redhat.com>

[ Upstream commit f6988cb63a4e698d8a62a1d085d263d1fcc351ea ]

The team_device_event() notifier calls team_compute_features() to fix
vlan_features under team->lock to protect team->port_list. The problem is
that subsequent __team_compute_features() calls netdev_change_features()
to propagate vlan_features to upper vlan devices while team->lock is still
taken. This can lead to deadlock when NETIF_F_LRO is modified on lower
devices or team device itself.

Example:
The team0 as active backup with eth0 and eth1 NICs. Both eth0 & eth1 are
LRO capable and LRO is enabled. Thus LRO is also enabled on team0.

The command 'ethtool -K team0 lro off' now hangs due to this deadlock:

dev_ethtool()
-> ethtool_set_features()
 -> __netdev_update_features(team)
  -> netdev_sync_lower_features()
   -> netdev_update_features(lower_1)
    -> __netdev_update_features(lower_1)
    -> netdev_features_change(lower_1)
     -> call_netdevice_notifiers(...)
      -> team_device_event(lower_1)
       -> team_compute_features(team) [TAKES team->lock]
        -> netdev_change_features(team)
         -> __netdev_update_features(team)
          -> netdev_sync_lower_features()
           -> netdev_update_features(lower_2)
            -> __netdev_update_features(lower_2)
            -> netdev_features_change(lower_2)
             -> call_netdevice_notifiers(...)
              -> team_device_event(lower_2)
               -> team_compute_features(team) [DEADLOCK]

The bug is present in team from the beginning but it appeared after the commit
fd867d5 (net/core: generic support for disabling netdev features down stack)
that adds synchronization of features with lower devices.

Fixes: fd867d5 (net/core: generic support for disabling netdev features down stack)
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/team/team.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -969,7 +969,7 @@ static void team_port_disable(struct tea
 			    NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
 			    NETIF_F_HIGHDMA | NETIF_F_LRO)
 
-static void __team_compute_features(struct team *team)
+static void ___team_compute_features(struct team *team)
 {
 	struct team_port *port;
 	u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
@@ -993,15 +993,20 @@ static void __team_compute_features(stru
 	team->dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 	if (dst_release_flag == (IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM))
 		team->dev->priv_flags |= IFF_XMIT_DST_RELEASE;
+}
 
+static void __team_compute_features(struct team *team)
+{
+	___team_compute_features(team);
 	netdev_change_features(team->dev);
 }
 
 static void team_compute_features(struct team *team)
 {
 	mutex_lock(&team->lock);
-	__team_compute_features(team);
+	___team_compute_features(team);
 	mutex_unlock(&team->lock);
+	netdev_change_features(team->dev);
 }
 
 static int team_port_enter(struct team *team, struct team_port *port)

[toc] | [prev] | [next] | [standalone]

#1429331 — [PATCH 4.4 03/75] tipc: check nl sock before parsing nested attributes

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 03/75] tipc: check nl sock before parsing nested attributes
Message-ID<rMZKP-1BV-61@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Alpe <richard.alpe@ericsson.com>

[ Upstream commit 45e093ae2830cd1264677d47ff9a95a71f5d9f9c ]

Make sure the socket for which the user is listing publication exists
before parsing the socket netlink attributes.

Prior to this patch a call without any socket caused a NULL pointer
dereference in tipc_nl_publ_dump().

Tested-and-reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.cm>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/socket.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2814,6 +2814,9 @@ int tipc_nl_publ_dump(struct sk_buff *sk
 		if (err)
 			return err;
 
+		if (!attrs[TIPC_NLA_SOCK])
+			return -EINVAL;
+
 		err = nla_parse_nested(sock, TIPC_NLA_SOCK_MAX,
 				       attrs[TIPC_NLA_SOCK],
 				       tipc_nl_sock_policy);

[toc] | [prev] | [next] | [standalone]

#1429332 — [PATCH 4.4 11/75] bpf, inode: disallow userns mounts

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 11/75] bpf, inode: disallow userns mounts
Message-ID<rMZKP-1BV-67@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

[ Upstream commit 612bacad78ba6d0a91166fc4487af114bac172a8 ]

Follow-up to commit e27f4a942a0e ("bpf: Use mount_nodev not mount_ns
to mount the bpf filesystem"), which removes the FS_USERNS_MOUNT flag.

The original idea was to have a per mountns instance instead of a
single global fs instance, but that didn't work out and we had to
switch to mount_nodev() model. The intent of that middle ground was
that we avoid users who don't play nice to create endless instances
of bpf fs which are difficult to control and discover from an admin
point of view, but at the same time it would have allowed us to be
more flexible with regard to namespaces.

Therefore, since we now did the switch to mount_nodev() as a fix
where individual instances are created, we also need to remove userns
mount flag along with it to avoid running into mentioned situation.
I don't expect any breakage at this early point in time with removing
the flag and we can revisit this later should the requirement for
this come up with future users. This and commit e27f4a942a0e have
been split to facilitate tracking should any of them run into the
unlikely case of causing a regression.

Fixes: b2197755b263 ("bpf: add support for persistent maps/progs")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/inode.c |    1 -
 1 file changed, 1 deletion(-)

--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -366,7 +366,6 @@ static struct file_system_type bpf_fs_ty
 	.name		= "bpf",
 	.mount		= bpf_mount,
 	.kill_sb	= kill_litter_super,
-	.fs_flags	= FS_USERNS_MOUNT,
 };
 
 MODULE_ALIAS_FS("bpf");

[toc] | [prev] | [next] | [standalone]

#1429333 — [PATCH 4.4 01/75] scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 01/75] scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands
Message-ID<rMZKP-1BV-55@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Bottomley <James.Bottomley@HansenPartnership.com>

commit a621bac3044ed6f7ec5fa0326491b2d4838bfa93 upstream.

When SCSI was written, all commands coming from the filesystem
(REQ_TYPE_FS commands) had data.  This meant that our signal for needing
to complete the command was the number of bytes completed being equal to
the number of bytes in the request.  Unfortunately, with the advent of
flush barriers, we can now get zero length REQ_TYPE_FS commands, which
confuse this logic because they satisfy the condition every time.  This
means they never get retried even for retryable conditions, like UNIT
ATTENTION because we complete them early assuming they're done.  Fix
this by special casing the early completion condition to recognise zero
length commands with errors and let them drop through to the retry code.

Reported-by: Sebastian Parschauer <s.parschauer@gmx.de>
Signed-off-by: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
Tested-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/scsi_lib.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -910,9 +910,12 @@ void scsi_io_completion(struct scsi_cmnd
 	}
 
 	/*
-	 * If we finished all bytes in the request we are done now.
+	 * special case: failed zero length commands always need to
+	 * drop down into the retry code. Otherwise, if we finished
+	 * all bytes in the request we are done now.
 	 */
-	if (!scsi_end_request(req, error, good_bytes, 0))
+	if (!(blk_rq_bytes(req) == 0 && error) &&
+	    !scsi_end_request(req, error, good_bytes, 0))
 		return;
 
 	/*

[toc] | [prev] | [next] | [standalone]

#1429334 — [PATCH 4.4 12/75] sfc: on MC reset, clear PIO buffer linkage in TXQs

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 12/75] sfc: on MC reset, clear PIO buffer linkage in TXQs
Message-ID<rMZKP-1BV-49@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Edward Cree <ecree@solarflare.com>

[ Upstream commit c0795bf64cba4d1b796fdc5b74b33772841ed1bb ]

Otherwise, if we fail to allocate new PIO buffers, our TXQs will try to
use the old ones, which aren't there any more.

Fixes: 183233bec810 "sfc: Allocate and link PIO buffers; map them with write-combining"
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sfc/ef10.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -619,6 +619,17 @@ fail:
 	return rc;
 }
 
+static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
+{
+	struct efx_channel *channel;
+	struct efx_tx_queue *tx_queue;
+
+	/* All our existing PIO buffers went away */
+	efx_for_each_channel(channel, efx)
+		efx_for_each_channel_tx_queue(tx_queue, channel)
+			tx_queue->piobuf = NULL;
+}
+
 #else /* !EFX_USE_PIO */
 
 static int efx_ef10_alloc_piobufs(struct efx_nic *efx, unsigned int n)
@@ -635,6 +646,10 @@ static void efx_ef10_free_piobufs(struct
 {
 }
 
+static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
+{
+}
+
 #endif /* EFX_USE_PIO */
 
 static void efx_ef10_remove(struct efx_nic *efx)
@@ -1018,6 +1033,7 @@ static void efx_ef10_reset_mc_allocation
 	nic_data->must_realloc_vis = true;
 	nic_data->must_restore_filters = true;
 	nic_data->must_restore_piobufs = true;
+	efx_ef10_forget_old_piobufs(efx);
 	nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
 
 	/* Driver-created vswitches and vports must be re-created */

[toc] | [prev] | [next] | [standalone]

#1429337 — [PATCH 4.4 04/75] netlink: Fix dump skb leak/double free

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 04/75] netlink: Fix dump skb leak/double free
Message-ID<rMZKP-1BV-65@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

[ Upstream commit 92964c79b357efd980812c4de5c1fd2ec8bb5520 ]

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlink/af_netlink.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2784,6 +2784,7 @@ static int netlink_dump(struct sock *sk)
 	struct netlink_callback *cb;
 	struct sk_buff *skb = NULL;
 	struct nlmsghdr *nlh;
+	struct module *module;
 	int len, err = -ENOBUFS;
 	int alloc_min_size;
 	int alloc_size;
@@ -2863,9 +2864,11 @@ static int netlink_dump(struct sock *sk)
 		cb->done(cb);
 
 	nlk->cb_running = false;
+	module = cb->module;
+	skb = cb->skb;
 	mutex_unlock(nlk->cb_mutex);
-	module_put(cb->module);
-	consume_skb(cb->skb);
+	module_put(module);
+	consume_skb(skb);
 	return 0;
 
 errout_skb:

[toc] | [prev] | [next] | [standalone]

#1429339 — [PATCH 4.4 06/75] switchdev: pass pointer to fib_info instead of copy

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 06/75] switchdev: pass pointer to fib_info instead of copy
Message-ID<rMZKP-1BV-63@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiri Pirko <jiri@mellanox.com>

[ Upstream commit da4ed55165d41b1073f9a476f1c18493e9bf8c8e ]

The problem is that fib_info->nh is [0] so the struct fib_info
allocation size depends on number of nexthops. If we just copy fib_info,
we do not copy the nexthops info and driver accesses memory which is not
ours.

Given the fact that fib4 does not defer operations and therefore it does
not need copy, just pass the pointer down to drivers as it was done
before.

Fixes: 850d0cbc91 ("switchdev: remove pointers from switchdev objects")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/rocker/rocker.c |    4 ++--
 include/net/switchdev.h              |    2 +-
 net/switchdev/switchdev.c            |    6 ++----
 3 files changed, 5 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -4475,7 +4475,7 @@ static int rocker_port_obj_add(struct ne
 		fib4 = SWITCHDEV_OBJ_IPV4_FIB(obj);
 		err = rocker_port_fib_ipv4(rocker_port, trans,
 					   htonl(fib4->dst), fib4->dst_len,
-					   &fib4->fi, fib4->tb_id, 0);
+					   fib4->fi, fib4->tb_id, 0);
 		break;
 	case SWITCHDEV_OBJ_ID_PORT_FDB:
 		err = rocker_port_fdb_add(rocker_port, trans,
@@ -4547,7 +4547,7 @@ static int rocker_port_obj_del(struct ne
 		fib4 = SWITCHDEV_OBJ_IPV4_FIB(obj);
 		err = rocker_port_fib_ipv4(rocker_port, NULL,
 					   htonl(fib4->dst), fib4->dst_len,
-					   &fib4->fi, fib4->tb_id,
+					   fib4->fi, fib4->tb_id,
 					   ROCKER_OP_FLAG_REMOVE);
 		break;
 	case SWITCHDEV_OBJ_ID_PORT_FDB:
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -88,7 +88,7 @@ struct switchdev_obj_ipv4_fib {
 	struct switchdev_obj obj;
 	u32 dst;
 	int dst_len;
-	struct fib_info fi;
+	struct fib_info *fi;
 	u8 tos;
 	u8 type;
 	u32 nlflags;
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -1169,6 +1169,7 @@ int switchdev_fib_ipv4_add(u32 dst, int
 		.obj.id = SWITCHDEV_OBJ_ID_IPV4_FIB,
 		.dst = dst,
 		.dst_len = dst_len,
+		.fi = fi,
 		.tos = tos,
 		.type = type,
 		.nlflags = nlflags,
@@ -1177,8 +1178,6 @@ int switchdev_fib_ipv4_add(u32 dst, int
 	struct net_device *dev;
 	int err = 0;
 
-	memcpy(&ipv4_fib.fi, fi, sizeof(ipv4_fib.fi));
-
 	/* Don't offload route if using custom ip rules or if
 	 * IPv4 FIB offloading has been disabled completely.
 	 */
@@ -1222,6 +1221,7 @@ int switchdev_fib_ipv4_del(u32 dst, int
 		.obj.id = SWITCHDEV_OBJ_ID_IPV4_FIB,
 		.dst = dst,
 		.dst_len = dst_len,
+		.fi = fi,
 		.tos = tos,
 		.type = type,
 		.nlflags = 0,
@@ -1230,8 +1230,6 @@ int switchdev_fib_ipv4_del(u32 dst, int
 	struct net_device *dev;
 	int err = 0;
 
-	memcpy(&ipv4_fib.fi, fi, sizeof(ipv4_fib.fi));
-
 	if (!(fi->fib_flags & RTNH_F_OFFLOAD))
 		return 0;

[toc] | [prev] | [next] | [standalone]

#1429340 — [PATCH 4.4 07/75] tuntap: correctly wake up process during uninit

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 01:30 +0200
Subject[PATCH 4.4 07/75] tuntap: correctly wake up process during uninit
Message-ID<rMZKP-1BV-69@gated-at.bofh.it>
In reply to#1429316
4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jason Wang <jasowang@redhat.com>

[ Upstream commit addf8fc4acb1cf79492ac64966f07178793cb3d7 ]

We used to check dev->reg_state against NETREG_REGISTERED after each
time we are woke up. But after commit 9e641bdcfa4e ("net-tun:
restructure tun_do_read for better sleep/wakeup efficiency"), it uses
skb_recv_datagram() which does not check dev->reg_state. This will
result if we delete a tun/tap device after a process is blocked in the
reading. The device will wait for the reference count which was held
by that process for ever.

Fixes this by using RCV_SHUTDOWN which will be checked during
sk_recv_datagram() before trying to wake up the process during uninit.

Fixes: 9e641bdcfa4e ("net-tun: restructure tun_do_read for better
sleep/wakeup efficiency")
Cc: Eric Dumazet <edumazet@google.com>
Cc: Xi Wang <xii@google.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/tun.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -567,11 +567,13 @@ static void tun_detach_all(struct net_de
 	for (i = 0; i < n; i++) {
 		tfile = rtnl_dereference(tun->tfiles[i]);
 		BUG_ON(!tfile);
+		tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
 		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
 		RCU_INIT_POINTER(tfile->tun, NULL);
 		--tun->numqueues;
 	}
 	list_for_each_entry(tfile, &tun->disabled, next) {
+		tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
 		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
 		RCU_INIT_POINTER(tfile->tun, NULL);
 	}
@@ -627,6 +629,7 @@ static int tun_attach(struct tun_struct
 			goto out;
 	}
 	tfile->queue_index = tun->numqueues;
+	tfile->socket.sk->sk_shutdown &= ~RCV_SHUTDOWN;
 	rcu_assign_pointer(tfile->tun, tun);
 	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
 	tun->numqueues++;
@@ -1408,9 +1411,6 @@ static ssize_t tun_do_read(struct tun_st
 	if (!iov_iter_count(to))
 		return 0;
 
-	if (tun->dev->reg_state != NETREG_REGISTERED)
-		return -EIO;
-
 	/* Read frames from queue */
 	skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0,
 				  &peeked, &off, &err);

[toc] | [prev] | [next] | [standalone]

#1429437 — Re: [PATCH 4.4 00/75] 4.4.14-stable review -rc2

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2016-06-23 07:00 +0200
SubjectRe: [PATCH 4.4 00/75] 4.4.14-stable review -rc2
Message-ID<rN4U9-50i-1@gated-at.bofh.it>
In reply to#1429316
-rc2!

This is the start of the stable review cycle for the 4.4.14 release.
There are 81 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Jun 25 04:51:37 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.14-rc2.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.14-rc2

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: introduce and use xt_copy_counters_from_user

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: do compat validation via translate_table

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: xt_compat_match_from_user doesn't need a retval

Florian Westphal <fw@strlen.de>
    netfilter: ip6_tables: simplify translate_compat_table args

Florian Westphal <fw@strlen.de>
    netfilter: ip_tables: simplify translate_compat_table args

Florian Westphal <fw@strlen.de>
    netfilter: arp_tables: simplify translate_compat_table args

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: don't reject valid target size on some architectures

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: validate all offsets and sizes in a rule

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: check for bogus target offset

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: check standard target size too

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: add compat version of xt_check_entry_offsets

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: assert minimum target size

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: kill check_entry helper

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: add and use xt_check_entry_offsets

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: validate targets of jumps

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: don't move to non-existent next rule

Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    drm/core: Do not preserve framebuffer on rmfb, v4.

Tadeusz Struk <tadeusz.struk@intel.com>
    crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: fix unconditional helper

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: make sure e->next_offset covers remaining blob size

Florian Westphal <fw@strlen.de>
    netfilter: x_tables: validate e->target_offset early

Ralf Baechle <ralf@linux-mips.org>
    MIPS: Fix 64k page support for 32 bit kernels.

David S. Miller <davem@davemloft.net>
    sparc64: Fix return from trap window fill crashes.

David S. Miller <davem@davemloft.net>
    sparc: Harden signal return frame checks.

David S. Miller <davem@davemloft.net>
    sparc64: Take ctx_alloc_lock properly in hugetlb_setup().

Nitin Gupta <nitin.m.gupta@oracle.com>
    sparc64: Reduce TLB flushes during hugepte changes

Babu Moger <babu.moger@oracle.com>
    sparc/PCI: Fix for panic while enabling SR-IOV

David S. Miller <davem@davemloft.net>
    sparc64: Fix sparc64_set_context stack handling.

Nitin Gupta <nitin.m.gupta@oracle.com>
    sparc64: Fix numa node distance initialization

David S. Miller <davem@davemloft.net>
    sparc64: Fix bootup regressions on some Kconfig combinations.

Mike Frysinger <vapier@gentoo.org>
    sparc: Fix system call tracing register handling.

Al Viro <viro@zeniv.linux.org.uk>
    fix d_walk()/non-delayed __d_free() race

Jann Horn <jannh@google.com>
    sched: panic on corrupted stack end

Jann Horn <jannh@google.com>
    proc: prevent stacking filesystems on top

Andy Lutomirski <luto@kernel.org>
    x86/entry/traps: Don't force in_interrupt() to return true in IST handlers

Prasun Maiti <prasunmaiti87@gmail.com>
    wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel

Jann Horn <jannh@google.com>
    ecryptfs: forbid opening files without mmap handler

Tejun Heo <tj@kernel.org>
    memcg: add RCU locking around css_for_each_descendant_pre() in memcg_offline_kmem()

Helge Deller <deller@gmx.de>
    parisc: Fix pagefault crash in unaligned __get_user() call

hongkun.cao <hongkun.cao@mediatek.com>
    pinctrl: mediatek: fix dual-edge code defect

Thomas Huth <thuth@redhat.com>
    powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call

Thomas Huth <thuth@redhat.com>
    powerpc: Use privileged SPR number for MMCR2

Thomas Huth <thuth@redhat.com>
    powerpc: Fix definition of SIAR and SDAR registers

Russell Currey <ruscur@russell.cc>
    powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge

Will Deacon <will.deacon@arm.com>
    arm64: mm: always take dirty state from new pte in ptep_set_access_flags

Catalin Marinas <catalin.marinas@arm.com>
    arm64: Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks

Tom Lendacky <thomas.lendacky@amd.com>
    crypto: ccp - Fix AES XTS error for request sizes above 4096

Arnd Bergmann <arnd@arndb.de>
    crypto: public_key: select CRYPTO_AKCIPHER

Marc Zyngier <marc.zyngier@arm.com>
    irqchip/gic-v3: Fix ICC_SGI1R_EL1.INTID decoding mask

Michael Holzheu <holzheu@linux.vnet.ibm.com>
    s390/bpf: reduce maximum program size to 64 KB

Michael Holzheu <holzheu@linux.vnet.ibm.com>
    s390/bpf: fix recache skb->data/hlen for skb_vlan_push/pop

Ben Dooks <ben.dooks@codethink.co.uk>
    gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings

Russell King <rmk+kernel@armlinux.org.uk>
    ARM: fix PTRACE_SETVFPREGS on SMP systems

Torsten Hilbrich <torsten.hilbrich@secunet.com>
    ALSA: hda/realtek: Add T560 docking unit fixup

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - ALC256 speaker noise issue

AceLan Kao <acelan.kao@canonical.com>
    ALSA: hda - Fix headset mic detection problem for Dell machine

Vinod Koul <vinod.koul@intel.com>
    ALSA: hda - Add PCI ID for Kabylake

Paolo Bonzini <pbonzini@redhat.com>
    KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS

David Wragg <david@weave.works>
    vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices

David Wragg <david@weave.works>
    geneve: Relax MTU constraints

David Wragg <david@weave.works>
    vxlan: Relax MTU constraints

Jakub Sitnicki <jkbs@redhat.com>
    ipv6: Skip XFRM lookup if dst_entry in socket cache is valid

Guillaume Nault <g.nault@alphalink.fr>
    l2tp: fix configuration passed to setup_udp_tunnel_sock()

Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    bridge: Don't insert unnecessary local fdb entry on changing mac address

Yuchung Cheng <ycheng@google.com>
    tcp: record TLP and ER timer stats in v6 stats

Chen Haiquan <oc@yunify.com>
    vxlan: Accept user specified MTU value when create new vxlan link

Ivan Vecera <ivecera@redhat.com>
    team: don't call netdev_change_features under team->lock

Edward Cree <ecree@solarflare.com>
    sfc: on MC reset, clear PIO buffer linkage in TXQs

Daniel Borkmann <daniel@iogearbox.net>
    bpf, inode: disallow userns mounts

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    uapi glibc compat: fix compilation when !__USE_MISC in glibc

Hannes Frederic Sowa <hannes@stressinduktion.org>
    udp: prevent skbs lingering in tunnel socket queues

Eric W. Biederman <ebiederm@xmission.com>
    bpf: Use mount_nodev not mount_ns to mount the bpf filesystem

Jason Wang <jasowang@redhat.com>
    tuntap: correctly wake up process during uninit

Jiri Pirko <jiri@mellanox.com>
    switchdev: pass pointer to fib_info instead of copy

Richard Alpe <richard.alpe@ericsson.com>
    tipc: fix nametable publication field in nl compat

Herbert Xu <herbert@gondor.apana.org.au>
    netlink: Fix dump skb leak/double free

Richard Alpe <richard.alpe@ericsson.com>
    tipc: check nl sock before parsing nested attributes

Ewan D. Milne <emilne@redhat.com>
    scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist

James Bottomley <James.Bottomley@HansenPartnership.com>
    scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands


-------------

Diffstat:

 Makefile                                       |   4 +-
 arch/arm/kernel/ptrace.c                       |   2 +-
 arch/arm64/include/asm/elf.h                   |   4 +-
 arch/arm64/kernel/cpuinfo.c                    |   8 +-
 arch/arm64/mm/fault.c                          |   2 +-
 arch/mips/include/asm/processor.h              |   2 +-
 arch/parisc/kernel/unaligned.c                 |  10 +-
 arch/powerpc/include/asm/reg.h                 |   6 +-
 arch/powerpc/kernel/prom_init.c                |   1 +
 arch/powerpc/platforms/pseries/eeh_pseries.c   |  51 ++--
 arch/s390/net/bpf_jit.h                        |   4 +-
 arch/s390/net/bpf_jit_comp.c                   |   4 +-
 arch/sparc/include/asm/head_64.h               |   4 +
 arch/sparc/include/asm/pgtable_64.h            |  43 ++-
 arch/sparc/include/asm/tlbflush_64.h           |   3 +-
 arch/sparc/include/asm/ttable.h                |   8 +-
 arch/sparc/kernel/Makefile                     |   1 +
 arch/sparc/kernel/cherrs.S                     |  14 +-
 arch/sparc/kernel/entry.S                      |  17 ++
 arch/sparc/kernel/fpu_traps.S                  |  11 +-
 arch/sparc/kernel/head_64.S                    |  24 +-
 arch/sparc/kernel/misctrap.S                   |  12 +-
 arch/sparc/kernel/pci.c                        |  17 ++
 arch/sparc/kernel/rtrap_64.S                   |  57 +---
 arch/sparc/kernel/signal32.c                   |  46 ++--
 arch/sparc/kernel/signal_32.c                  |  41 +--
 arch/sparc/kernel/signal_64.c                  |  33 ++-
 arch/sparc/kernel/sigutil_32.c                 |   9 +-
 arch/sparc/kernel/sigutil_64.c                 |  10 +-
 arch/sparc/kernel/spiterrs.S                   |  18 +-
 arch/sparc/kernel/syscalls.S                   |  36 +++
 arch/sparc/kernel/urtt_fill.S                  |  98 +++++++
 arch/sparc/kernel/utrap.S                      |   3 +-
 arch/sparc/kernel/vmlinux.lds.S                |   4 +
 arch/sparc/kernel/winfixup.S                   |   3 +-
 arch/sparc/mm/hugetlbpage.c                    |  33 ++-
 arch/sparc/mm/init_64.c                        |  37 ++-
 arch/sparc/mm/tlb.c                            |  25 +-
 arch/sparc/mm/tsb.c                            |  32 +--
 arch/x86/kernel/traps.c                        |  20 +-
 arch/x86/kvm/x86.c                             |   5 +
 crypto/asymmetric_keys/Kconfig                 |   1 +
 drivers/crypto/ccp/ccp-crypto-aes-xts.c        |  17 +-
 drivers/crypto/qat/qat_common/adf_common_drv.h |  13 +-
 drivers/gpio/gpio-bcm-kona.c                   |   4 +-
 drivers/gpu/drm/drm_crtc.c                     |  60 ++++-
 drivers/net/ethernet/rocker/rocker.c           |   4 +-
 drivers/net/ethernet/sfc/ef10.c                |  16 ++
 drivers/net/geneve.c                           |  41 ++-
 drivers/net/team/team.c                        |   9 +-
 drivers/net/tun.c                              |   6 +-
 drivers/net/vxlan.c                            |  60 +++--
 drivers/pinctrl/mediatek/pinctrl-mtk-common.c  |   5 +-
 drivers/scsi/scsi_devinfo.c                    |   1 +
 drivers/scsi/scsi_lib.c                        |   7 +-
 fs/dcache.c                                    |   4 +-
 fs/ecryptfs/kthread.c                          |  13 +-
 fs/proc/root.c                                 |   7 +
 include/linux/irqchip/arm-gic-v3.h             |   2 +-
 include/linux/netfilter/x_tables.h             |  12 +-
 include/net/ip_tunnels.h                       |   1 +
 include/net/switchdev.h                        |   2 +-
 include/uapi/linux/libc-compat.h               |   2 +-
 kernel/bpf/inode.c                             |   3 +-
 kernel/sched/core.c                            |   3 +-
 mm/memcontrol.c                                |   3 +
 net/bridge/br_fdb.c                            |   2 +
 net/ipv4/ip_gre.c                              |   8 +
 net/ipv4/ip_tunnel.c                           |  20 +-
 net/ipv4/netfilter/arp_tables.c                | 326 ++++++++--------------
 net/ipv4/netfilter/ip_tables.c                 | 356 ++++++++-----------------
 net/ipv4/udp.c                                 |   2 +-
 net/ipv6/ip6_output.c                          |  11 +-
 net/ipv6/netfilter/ip6_tables.c                | 349 +++++++-----------------
 net/ipv6/tcp_ipv6.c                            |   4 +-
 net/ipv6/udp.c                                 |   2 +-
 net/l2tp/l2tp_core.c                           |   2 +-
 net/netfilter/x_tables.c                       | 245 ++++++++++++++++-
 net/netlink/af_netlink.c                       |   7 +-
 net/openvswitch/vport-vxlan.c                  |   2 +
 net/switchdev/switchdev.c                      |   6 +-
 net/tipc/netlink_compat.c                      |   2 +-
 net/tipc/socket.c                              |   3 +
 net/wireless/wext-core.c                       |  25 +-
 sound/pci/hda/hda_intel.c                      |  11 +-
 sound/pci/hda/patch_realtek.c                  |  73 ++++-
 virt/kvm/irqchip.c                             |   2 +-
 87 files changed, 1435 insertions(+), 1081 deletions(-)

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web