Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1354574 > unrolled thread

[3.13.y-ckt stable] Linux 3.13.11-ckt36 stable review

Back to article view | Back to linux.kernel

Contents

  [3.13.y-ckt stable] Linux 3.13.11-ckt36 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
    [PATCH 3.13.y-ckt 059/138] mm: replace vma_lock_anon_vma with anon_vma_lock_read/write Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
    [PATCH 3.13.y-ckt 009/138] iio: dac: mcp4725: set iio name property in sysfs Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
    [PATCH 3.13.y-ckt 017/138] drm/i915/dp: fall back to 18 bpp when sink capability is unknown Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
    [PATCH 3.13.y-ckt 070/138] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:20 +0100
    [PATCH 3.13.y-ckt 109/138] KVM: async_pf: do not warn on page allocation failures Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 126/138] sctp: translate network order to host order when users get a hmacid Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 113/138] hpfs: don't truncate the file when delete fails Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 119/138] pptp: fix illegal memory access caused by multiple bind()s Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 117/138] tcp: fix NULL deref in tcp_v4_send_ack() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 090/138] ALSA: seq: Drop superfluous error/debug messages after malloc failures Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 131/138] rtnl: RTM_GETNETCONF: fix wrong return value Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 123/138] ipv6: fix a lockdep splat Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 137/138] af_unix: Don't set err in unix_stream_read_generic unless there was an error Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 134/138] bonding: Fix ARP monitor validation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 130/138] pppoe: fix reference counting in PPPoE proxy Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 138/138] pipe: limit the per-user amount of pages allocated in pipes Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 110/138] tracing: Fix showing function event in available_events Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 114/138] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 125/138] net:Add sysctl_max_skb_frags Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 111/138] libceph: don't bail early from try_read() when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 120/138] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 101/138] USB: option: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 115/138] af_iucv: Validate socket address length in iucv_sock_bind() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 122/138] net/ipv6: add sysctl option accept_ra_min_hop_limit Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 132/138] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 127/138] af_unix: Guard against other == sk in unix_dgram_sendmsg Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 129/138] net/mlx4_en: Count HW buffer overrun only once Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 112/138] KVM: x86: MMU: fix ubsan index-out-of-range warning Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 097/138] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 077/138] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 116/138] net: dp83640: Fix tx timestamp overflow handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 128/138] qmi_wwan: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 136/138] net/mlx4_en: Choose time-stamping shift value according to HW frequency Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 118/138] af_unix: fix struct pid memory leak Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 135/138] ipv4: fix memory leaks in ip_cmsg_send() callers Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 133/138] sctp: Fix port hash table size computation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 124/138] unix: correctly track in-flight fds in sending process user_struct Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 121/138] ipv6/udp: use sticky pktinfo egress ifindex on connect() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:30 +0100
    [PATCH 3.13.y-ckt 103/138] ext4: fix bh->b_state corruption Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 082/138] ARM: 8519/1: ICST: try other dividends than 1 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 074/138] phy: twl4030-usb: Relase usb phy on unload Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 099/138] USB: option: add support for SIM7100E Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 063/138] pty: fix possible use after free of tty->driver_data Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 094/138] tracing: Fix freak link error caused by branch tracer Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 108/138] sunrpc/cache: fix off-by-one in qword_get() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 089/138] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 085/138] ext4: don't read blocks from disk after extents being swapped Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 067/138] ALSA: dummy: Implement timer backend switching more safely Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 100/138] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 081/138] s390/dasd: fix refcount for PAV reassignment Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 064/138] pty: make sure super_block is still valid in final /dev/tty close Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 106/138] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 096/138] drm/radeon: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 086/138] bio: return EINTR if copying to user space got interrupted Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 093/138] tracepoints: Do not trace when cpu is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 072/138] ALSA: timer: Fix race between stop and interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 088/138] xen/pciback: Save the number of MSI-X entries to be copied later. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 065/138] ALSA: hda - Fix speaker output from VAIO AiO machines Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 091/138] ALSA: seq: Fix leak of pool buffer at concurrent writes Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 084/138] ext4: fix potential integer overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 092/138] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 095/138] ALSA: seq: Fix double port list deletion Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 104/138] ext4: fix crashes in dioread_nolock mode Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 058/138] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 107/138] can: ems_usb: Fix possible tx overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 083/138] btrfs: properly set the termination value of ctx->pos in readdir Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 105/138] kernel/resource.c: fix muxed resource handling in __request_region() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 079/138] cifs: fix erroneous return value Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 087/138] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 066/138] klist: fix starting point removed bug in klist iterators Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 102/138] hwmon: (ads1015) Handle negative conversion values correctly Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 098/138] NFSv4: Fix a dentry leak on alias use Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:40 +0100
    [PATCH 3.13.y-ckt 053/138] SCSI: Add Marvell Console to VPD blacklist Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 021/138] intel_scu_ipcutil: underflow in scu_reg_access() Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 041/138] target: Fix Task Aborted Status (TAS) handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 020/138] iio: inkern: fix a NULL dereference on error Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 056/138] dump_stack: avoid potential deadlocks Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 027/138] libata: fix sff host state machine locking while polling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 060/138] radix-tree: fix oops after radix_tree_iter_retry Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 049/138] ALSA: timer: Fix leftover link at closing Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 057/138] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 046/138] target: Fix remote-port TMR ABORT + se_cmd fabric stop Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 048/138] [media] tda1004x: only update the frontend properties if locked Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 051/138] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 023/138] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 037/138] radix-tree: fix race in gang lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 035/138] ALSA: seq: Fix lockdep warnings due to double mutex locks Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 036/138] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 030/138] module: wrapper for symbol name. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 042/138] target: Add TFO->abort_task for aborted task resources release Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 040/138] xhci: Fix list corruption in urb dequeue at host removal Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 047/138] target: Fix race with SCF_SEND_DELAYED_TAS handling Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 045/138] target: Fix TAS handling for multi-session se_node_acls Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 038/138] Revert "xhci: don't finish a TD if we get a short-transfer event mid TD" Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 008/138] x86/entry/compat: Add missing CLAC to entry_INT80_32 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 024/138] ALSA: pcm: Fix potential deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 054/138] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 022/138] ALSA: seq: Fix race at closing in virmidi driver Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 052/138] scsi_dh_rdac: always retry MODE SELECT on command lock violation Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 031/138] ALSA: hda - Add fixup for Mac Mini 7,1 model Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 050/138] [media] saa7134-alsa: Only frees registered sound cards Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 061/138] crypto: user - lock crypto_alg_list on alg dump Kamal Mostafa <kamal@canonical.com> - 2016-03-10 00:50 +0100
    [PATCH 3.13.y-ckt 012/138] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 019/138] crypto: algif_hash - wait for crypto_ahash_init() to complete Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 004/138] EVM: Use crypto_memneq() for digest comparisons Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 003/138] iw_cxgb3: Fix incorrectly returning error on success Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 005/138] ALSA: usb-audio: avoid freeing umidi object twice Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 014/138] mac80211: Requeue work after scan complete for all VIF types. Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 013/138] mac80211: start_next_roc only if scan was actually running Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 007/138] bcache: Fix a lockdep splat in an error path Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 018/138] target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100
    [PATCH 3.13.y-ckt 010/138] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Kamal Mostafa <kamal@canonical.com> - 2016-03-10 01:00 +0100

Page 2 of 6 — ← Prev page 1 [2] 3 4 5 6  Next page →

#1354596 — [PATCH 3.13.y-ckt 111/138] libceph: don't bail early from try_read() when skipping a message

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit e7a88e82fe380459b864e05b372638aeacb0f52d upstream.

The contract between try_read() and try_write() is that when called
each processes as much data as possible.  When instructed by osd_client
to skip a message, try_read() is violating this contract by returning
after receiving and discarding a single message instead of checking for
more.  try_write() then gets a chance to write out more requests,
generating more replies/skips for try_read() to handle, forcing the
messenger into a starvation loop.

Reported-by: Varada Kari <Varada.Kari@sandisk.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Tested-by: Varada Kari <Varada.Kari@sandisk.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/ceph/messenger.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 057017b..469f313 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2280,7 +2280,7 @@ static int read_partial_message(struct ceph_connection *con)
 		con->in_base_pos = -front_len - middle_len - data_len -
 			sizeof(m->footer);
 		con->in_tag = CEPH_MSGR_TAG_READY;
-		return 0;
+		return 1;
 	} else if ((s64)seq - (s64)con->in_seq > 1) {
 		pr_err("read_partial_message bad seq %lld expected %lld\n",
 		       seq, con->in_seq + 1);
@@ -2313,7 +2313,7 @@ static int read_partial_message(struct ceph_connection *con)
 				sizeof(m->footer);
 			con->in_tag = CEPH_MSGR_TAG_READY;
 			con->in_seq++;
-			return 0;
+			return 1;
 		}
 
 		BUG_ON(!con->in_msg);
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354598 — [PATCH 3.13.y-ckt 120/138] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>

commit 27f7ed2b11d42ab6d796e96533c2076ec220affc upstream.

This patch extends commit b93d6471748d ("sctp: implement the sender side
for SACK-IMMEDIATELY extension") as it didn't white list
SCTP_SACK_IMMEDIATELY on sctp_msghdr_parse(), causing it to be
understood as an invalid flag and returning -EINVAL to the application.

Note that the actual handling of the flag is already there in
sctp_datamsg_from_user().

https://tools.ietf.org/html/rfc7053#section-7

Fixes: b93d6471748d ("sctp: implement the sender side for SACK-IMMEDIATELY extension")
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16:
  - dropped changes to SCTP_SNDINFO case ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/sctp/socket.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d486356..fdd6a8305 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6436,6 +6436,7 @@ static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
 			/* Minimally, validate the sinfo_flags. */
 			if (cmsgs->info->sinfo_flags &
 			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
+			      SCTP_SACK_IMMEDIATELY |
 			      SCTP_ABORT | SCTP_EOF))
 				return -EINVAL;
 			break;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354599 — [PATCH 3.13.y-ckt 101/138] USB: option: add "4G LTE usb-modem U901"

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>

commit d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 upstream.

Thomas reports:

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=6001 Rev=00.00
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 21bf218..ed8a4c0 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1142,6 +1142,8 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */
+	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354600 — [PATCH 3.13.y-ckt 115/138] af_iucv: Validate socket address length in iucv_sock_bind()

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ursula Braun <ursula.braun@de.ibm.com>

commit 52a82e23b9f2a9e1d429c5207f8575784290d008 upstream.

Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Evgeny Cherkashin <Eugene.Crosser@ru.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/iucv/af_iucv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 1465363..bb3969a 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -697,6 +697,9 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
 	if (!addr || addr->sa_family != AF_IUCV)
 		return -EINVAL;
 
+	if (addr_len < sizeof(struct sockaddr_iucv))
+		return -EINVAL;
+
 	lock_sock(sk);
 	if (sk->sk_state != IUCV_OPEN) {
 		err = -EBADFD;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354601 — [PATCH 3.13.y-ckt 122/138] net/ipv6: add sysctl option accept_ra_min_hop_limit

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Hangbin Liu <liuhangbin@gmail.com>

commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 upstream.

Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface")
disabled accept hop limit from RA if it is smaller than the current hop
limit for security stuff. But this behavior kind of break the RFC definition.

RFC 4861, 6.3.4.  Processing Received Router Advertisements
   A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time,
   and Retrans Timer) may contain a value denoting that it is
   unspecified.  In such cases, the parameter should be ignored and the
   host should continue using whatever value it is already using.

   If the received Cur Hop Limit value is non-zero, the host SHOULD set
   its CurHopLimit variable to the received value.

So add sysctl option accept_ra_min_hop_limit to let user choose the minimum
hop limit value they can accept from RA. And set default to 1 to meet RFC
standards.

Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: YOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 Documentation/networking/ip-sysctl.txt |  8 ++++++++
 include/linux/ipv6.h                   |  1 +
 include/uapi/linux/ipv6.h              |  1 +
 net/ipv6/addrconf.c                    | 10 ++++++++++
 net/ipv6/ndisc.c                       | 16 +++++++---------
 5 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index b4be7fd..9a11e8d 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1143,6 +1143,14 @@ accept_ra_defrtr - BOOLEAN
 	Functional default: enabled if accept_ra is enabled.
 			    disabled if accept_ra is disabled.
 
+accept_ra_min_hop_limit - INTEGER
+	Minimum hop limit Information in Router Advertisement.
+
+	Hop limit Information in Router Advertisement less than this
+	variable shall be ignored.
+
+	Default: 1
+
 accept_ra_pinfo - BOOLEAN
 	Learn Prefix Information in Router Advertisement.
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index c56c350..dc80edd 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -29,6 +29,7 @@ struct ipv6_devconf {
 	__s32		max_desync_factor;
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
+	__s32		accept_ra_min_hop_limit;
 	__s32		accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	__s32		accept_ra_rtr_pref;
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 593b0e3..f1d3214 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -163,6 +163,7 @@ enum {
 	DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL,
 	DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
 	DEVCONF_SUPPRESS_FRAG_NDISC,
+	DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2be400d..dd8b55b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -184,6 +184,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.max_desync_factor	= MAX_DESYNC_FACTOR,
 	.max_addresses		= IPV6_MAX_ADDRESSES,
 	.accept_ra_defrtr	= 1,
+	.accept_ra_min_hop_limit= 1,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -220,6 +221,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.max_desync_factor	= MAX_DESYNC_FACTOR,
 	.max_addresses		= IPV6_MAX_ADDRESSES,
 	.accept_ra_defrtr	= 1,
+	.accept_ra_min_hop_limit= 1,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -4125,6 +4127,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
 	array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
 	array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
+	array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
 	array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
@@ -4864,6 +4867,13 @@ static struct addrconf_sysctl_table
 			.proc_handler	= proc_dointvec,
 		},
 		{
+			.procname	= "accept_ra_min_hop_limit",
+			.data		= &ipv6_devconf.accept_ra_min_hop_limit,
+			.maxlen		= sizeof(int),
+			.mode		= 0644,
+			.proc_handler	= proc_dointvec,
+		},
+		{
 			.procname	= "accept_ra_pinfo",
 			.data		= &ipv6_devconf.accept_ra_pinfo,
 			.maxlen		= sizeof(int),
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index ac0bbe8..4e62e51 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1190,18 +1190,16 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
 	if (rt)
 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
-	if (ra_msg->icmph.icmp6_hop_limit) {
-		/* Only set hop_limit on the interface if it is higher than
-		 * the current hop_limit.
-		 */
-		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
+	    ra_msg->icmph.icmp6_hop_limit) {
+		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
 			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+			if (rt)
+				dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+					       ra_msg->icmph.icmp6_hop_limit);
 		} else {
-			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
 		}
-		if (rt)
-			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
-				       ra_msg->icmph.icmp6_hop_limit);
 	}
 
 skip_defrtr:
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354602 — [PATCH 3.13.y-ckt 132/138] unix_diag: fix incorrect sign extension in unix_lookup_by_ino

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Dmitry V. Levin" <ldv@altlinux.org>

commit b5f0549231ffb025337be5a625b0ff9f52b016f0 upstream.

The value passed by unix_diag_get_exact to unix_lookup_by_ino has type
__u32, but unix_lookup_by_ino's argument ino has type int, which is not
a problem yet.
However, when ino is compared with sock_i_ino return value of type
unsigned long, ino is sign extended to signed long, and this results
to incorrect comparison on 64-bit architectures for inode numbers
greater than INT_MAX.

This bug was found by strace test suite.

Fixes: 5d3cae8bc39d ("unix_diag: Dumping exact socket core")
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/unix/diag.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/unix/diag.c b/net/unix/diag.c
index 86fa0f3..27dd3dc 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -219,7 +219,7 @@ done:
 	return skb->len;
 }
 
-static struct sock *unix_lookup_by_ino(int ino)
+static struct sock *unix_lookup_by_ino(unsigned int ino)
 {
 	int i;
 	struct sock *sk;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354603 — [PATCH 3.13.y-ckt 127/138] af_unix: Guard against other == sk in unix_dgram_sendmsg

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Rainer Weikusat <rweikusat@mobileactivedefense.com>

commit a5527dda344fff0514b7989ef7a755729769daa1 upstream.

The unix_dgram_sendmsg routine use the following test

if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {

to determine if sk and other are in an n:1 association (either
established via connect or by using sendto to send messages to an
unrelated socket identified by address). This isn't correct as the
specified address could have been bound to the sending socket itself or
because this socket could have been connected to itself by the time of
the unix_peer_get but disconnected before the unix_state_lock(other). In
both cases, the if-block would be entered despite other == sk which
might either block the sender unintentionally or lead to trying to unlock
the same spin lock twice for a non-blocking send. Add a other != sk
check to guard against this.

Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue")
Reported-By: Philipp Hahn <pmhahn@pmhahn.de>
Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Tested-by: Philipp Hahn <pmhahn@pmhahn.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/unix/af_unix.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e00b572..3974413 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1716,7 +1716,12 @@ restart_locked:
 			goto out_unlock;
 	}
 
-	if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
+	/* other == sk && unix_peer(other) != sk if
+	 * - unix_peer(sk) == NULL, destination address bound to sk
+	 * - unix_peer(sk) == sk by time of get but disconnected before lock
+	 */
+	if (other != sk &&
+	    unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
 		if (timeo) {
 			timeo = unix_wait_for_peer(other, timeo);
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354604 — [PATCH 3.13.y-ckt 129/138] net/mlx4_en: Count HW buffer overrun only once

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Amir Vadai <amir@vadai.me>

commit 281e8b2fdf8e4ef366b899453cae50e09b577ada upstream.

RdropOvflw counts overrun of HW buffer, therefore should
be used for rx_fifo_errors only.

Currently RdropOvflw counter is mistakenly also set into
rx_missed_errors and rx_over_errors too, which makes the
device total dropped packets accounting to show wrong results.

Fix that. Use it for rx_fifo_errors only.

Fixes: c27a02cd94d6 ('mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC')
Signed-off-by: Amir Vadai <amir@vadai.me>
Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/ethernet/mellanox/mlx4/en_port.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index dae1a1f..136eb5b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -171,11 +171,11 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 			   be64_to_cpu(mlx4_en_stats->MCAST_novlan);
 	stats->collisions = 0;
 	stats->rx_length_errors = be32_to_cpu(mlx4_en_stats->RdropLength);
-	stats->rx_over_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
+	stats->rx_over_errors = 0;
 	stats->rx_crc_errors = be32_to_cpu(mlx4_en_stats->RCRC);
 	stats->rx_frame_errors = 0;
 	stats->rx_fifo_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
-	stats->rx_missed_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
+	stats->rx_missed_errors = 0;
 	stats->tx_aborted_errors = 0;
 	stats->tx_carrier_errors = 0;
 	stats->tx_fifo_errors = 0;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354605 — [PATCH 3.13.y-ckt 112/138] KVM: x86: MMU: fix ubsan index-out-of-range warning

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mike Krinkin <krinkin.m.u@gmail.com>

commit 17e4bce0ae63c7e03f3c7fa8d80890e7af3d4971 upstream.

Ubsan reports the following warning due to a typo in
update_accessed_dirty_bits template, the patch fixes
the typo:

[  168.791851] ================================================================================
[  168.791862] UBSAN: Undefined behaviour in arch/x86/kvm/paging_tmpl.h:252:15
[  168.791866] index 4 is out of range for type 'u64 [4]'
[  168.791871] CPU: 0 PID: 2950 Comm: qemu-system-x86 Tainted: G           O L  4.5.0-rc5-next-20160222 #7
[  168.791873] Hardware name: LENOVO 23205NG/23205NG, BIOS G2ET95WW (2.55 ) 07/09/2013
[  168.791876]  0000000000000000 ffff8801cfcaf208 ffffffff81c9f780 0000000041b58ab3
[  168.791882]  ffffffff82eb2cc1 ffffffff81c9f6b4 ffff8801cfcaf230 ffff8801cfcaf1e0
[  168.791886]  0000000000000004 0000000000000001 0000000000000000 ffffffffa1981600
[  168.791891] Call Trace:
[  168.791899]  [<ffffffff81c9f780>] dump_stack+0xcc/0x12c
[  168.791904]  [<ffffffff81c9f6b4>] ? _atomic_dec_and_lock+0xc4/0xc4
[  168.791910]  [<ffffffff81da9e81>] ubsan_epilogue+0xd/0x8a
[  168.791914]  [<ffffffff81daafa2>] __ubsan_handle_out_of_bounds+0x15c/0x1a3
[  168.791918]  [<ffffffff81daae46>] ? __ubsan_handle_shift_out_of_bounds+0x2bd/0x2bd
[  168.791922]  [<ffffffff811287ef>] ? get_user_pages_fast+0x2bf/0x360
[  168.791954]  [<ffffffffa1794050>] ? kvm_largepages_enabled+0x30/0x30 [kvm]
[  168.791958]  [<ffffffff81128530>] ? __get_user_pages_fast+0x360/0x360
[  168.791987]  [<ffffffffa181b818>] paging64_walk_addr_generic+0x1b28/0x2600 [kvm]
[  168.792014]  [<ffffffffa1819cf0>] ? init_kvm_mmu+0x1100/0x1100 [kvm]
[  168.792019]  [<ffffffff8129e350>] ? debug_check_no_locks_freed+0x350/0x350
[  168.792044]  [<ffffffffa1819cf0>] ? init_kvm_mmu+0x1100/0x1100 [kvm]
[  168.792076]  [<ffffffffa181c36d>] paging64_gva_to_gpa+0x7d/0x110 [kvm]
[  168.792121]  [<ffffffffa181c2f0>] ? paging64_walk_addr_generic+0x2600/0x2600 [kvm]
[  168.792130]  [<ffffffff812e848b>] ? debug_lockdep_rcu_enabled+0x7b/0x90
[  168.792178]  [<ffffffffa17d9a4a>] emulator_read_write_onepage+0x27a/0x1150 [kvm]
[  168.792208]  [<ffffffffa1794d44>] ? __kvm_read_guest_page+0x54/0x70 [kvm]
[  168.792234]  [<ffffffffa17d97d0>] ? kvm_task_switch+0x160/0x160 [kvm]
[  168.792238]  [<ffffffff812e848b>] ? debug_lockdep_rcu_enabled+0x7b/0x90
[  168.792263]  [<ffffffffa17daa07>] emulator_read_write+0xe7/0x6d0 [kvm]
[  168.792290]  [<ffffffffa183b620>] ? em_cr_write+0x230/0x230 [kvm]
[  168.792314]  [<ffffffffa17db005>] emulator_write_emulated+0x15/0x20 [kvm]
[  168.792340]  [<ffffffffa18465f8>] segmented_write+0xf8/0x130 [kvm]
[  168.792367]  [<ffffffffa1846500>] ? em_lgdt+0x20/0x20 [kvm]
[  168.792374]  [<ffffffffa14db512>] ? vmx_read_guest_seg_ar+0x42/0x1e0 [kvm_intel]
[  168.792400]  [<ffffffffa1846d82>] writeback+0x3f2/0x700 [kvm]
[  168.792424]  [<ffffffffa1846990>] ? em_sidt+0xa0/0xa0 [kvm]
[  168.792449]  [<ffffffffa185554d>] ? x86_decode_insn+0x1b3d/0x4f70 [kvm]
[  168.792474]  [<ffffffffa1859032>] x86_emulate_insn+0x572/0x3010 [kvm]
[  168.792499]  [<ffffffffa17e71dd>] x86_emulate_instruction+0x3bd/0x2110 [kvm]
[  168.792524]  [<ffffffffa17e6e20>] ? reexecute_instruction.part.110+0x2e0/0x2e0 [kvm]
[  168.792532]  [<ffffffffa14e9a81>] handle_ept_misconfig+0x61/0x460 [kvm_intel]
[  168.792539]  [<ffffffffa14e9a20>] ? handle_pause+0x450/0x450 [kvm_intel]
[  168.792546]  [<ffffffffa15130ea>] vmx_handle_exit+0xd6a/0x1ad0 [kvm_intel]
[  168.792572]  [<ffffffffa17f6a6c>] ? kvm_arch_vcpu_ioctl_run+0xbdc/0x6090 [kvm]
[  168.792597]  [<ffffffffa17f6bcd>] kvm_arch_vcpu_ioctl_run+0xd3d/0x6090 [kvm]
[  168.792621]  [<ffffffffa17f6a6c>] ? kvm_arch_vcpu_ioctl_run+0xbdc/0x6090 [kvm]
[  168.792627]  [<ffffffff8293b530>] ? __ww_mutex_lock_interruptible+0x1630/0x1630
[  168.792651]  [<ffffffffa17f5e90>] ? kvm_arch_vcpu_runnable+0x4f0/0x4f0 [kvm]
[  168.792656]  [<ffffffff811eeb30>] ? preempt_notifier_unregister+0x190/0x190
[  168.792681]  [<ffffffffa17e0447>] ? kvm_arch_vcpu_load+0x127/0x650 [kvm]
[  168.792704]  [<ffffffffa178e9a3>] kvm_vcpu_ioctl+0x553/0xda0 [kvm]
[  168.792727]  [<ffffffffa178e450>] ? vcpu_put+0x40/0x40 [kvm]
[  168.792732]  [<ffffffff8129e350>] ? debug_check_no_locks_freed+0x350/0x350
[  168.792735]  [<ffffffff82946087>] ? _raw_spin_unlock+0x27/0x40
[  168.792740]  [<ffffffff8163a943>] ? handle_mm_fault+0x1673/0x2e40
[  168.792744]  [<ffffffff8129daa8>] ? trace_hardirqs_on_caller+0x478/0x6c0
[  168.792747]  [<ffffffff8129dcfd>] ? trace_hardirqs_on+0xd/0x10
[  168.792751]  [<ffffffff812e848b>] ? debug_lockdep_rcu_enabled+0x7b/0x90
[  168.792756]  [<ffffffff81725a80>] do_vfs_ioctl+0x1b0/0x12b0
[  168.792759]  [<ffffffff817258d0>] ? ioctl_preallocate+0x210/0x210
[  168.792763]  [<ffffffff8174aef3>] ? __fget+0x273/0x4a0
[  168.792766]  [<ffffffff8174acd0>] ? __fget+0x50/0x4a0
[  168.792770]  [<ffffffff8174b1f6>] ? __fget_light+0x96/0x2b0
[  168.792773]  [<ffffffff81726bf9>] SyS_ioctl+0x79/0x90
[  168.792777]  [<ffffffff82946880>] entry_SYSCALL_64_fastpath+0x23/0xc1
[  168.792780] ================================================================================

Signed-off-by: Mike Krinkin <krinkin.m.u@gmail.com>
Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/kvm/paging_tmpl.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 90c4570..3d7d3fb 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -257,7 +257,7 @@ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
 			return ret;
 
 		mark_page_dirty(vcpu->kvm, table_gfn);
-		walker->ptes[level] = pte;
+		walker->ptes[level - 1] = pte;
 	}
 	return 0;
 }
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354606 — [PATCH 3.13.y-ckt 097/138] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Gerd Hoffmann <kraxel@redhat.com>

commit 34855706c30d52b0a744da44348b5d1cc39fbe51 upstream.

This avoids integer overflows on 32bit machines when calculating
reloc_info size, as reported by Alan Cox.

Cc: gnomes@lxorguk.ukuu.org.uk
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/qxl/qxl_ioctl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 729debf..9400858 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -168,7 +168,8 @@ static int qxl_process_single_command(struct qxl_device *qdev,
 		       cmd->command_size))
 		return -EFAULT;
 
-	reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL);
+	reloc_info = kmalloc_array(cmd->relocs_num,
+				   sizeof(struct qxl_reloc_info), GFP_KERNEL);
 	if (!reloc_info)
 		return -ENOMEM;
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354607 — [PATCH 3.13.y-ckt 077/138] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Tejun Heo <tj@kernel.org>

commit d6e022f1d207a161cd88e08ef0371554680ffc46 upstream.

When looking up the pool_workqueue to use for an unbound workqueue,
workqueue assumes that the target CPU is always bound to a valid NUMA
node.  However, currently, when a CPU goes offline, the mapping is
destroyed and cpu_to_node() returns NUMA_NO_NODE.

This has always been broken but hasn't triggered often enough before
874bbfe600a6 ("workqueue: make sure delayed work run in local cpu").
After the commit, workqueue forcifully assigns the local CPU for
delayed work items without explicit target CPU to fix a different
issue.  This widens the window where CPU can go offline while a
delayed work item is pending causing delayed work items dispatched
with target CPU set to an already offlined CPU.  The resulting
NUMA_NO_NODE mapping makes workqueue try to queue the work item on a
NULL pool_workqueue and thus crash.

While 874bbfe600a6 has been reverted for a different reason making the
bug less visible again, it can still happen.  Fix it by mapping
NUMA_NO_NODE to the default pool_workqueue from unbound_pwq_by_node().
This is a temporary workaround.  The long term solution is keeping CPU
-> NODE mapping stable across CPU off/online cycles which is being
worked on.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mike Galbraith <umgwanakikbuti@gmail.com>
Cc: Tang Chen <tangchen@cn.fujitsu.com>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Len Brown <len.brown@intel.com>
Link: http://lkml.kernel.org/g/1454424264.11183.46.camel@gmail.com
Link: http://lkml.kernel.org/g/1453702100-2597-1-git-send-email-tangchen@cn.fujitsu.com
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 kernel/workqueue.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index eb1cc22..de5ad5c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -558,6 +558,16 @@ static struct pool_workqueue *unbound_pwq_by_node(struct workqueue_struct *wq,
 						  int node)
 {
 	assert_rcu_or_wq_mutex(wq);
+
+	/*
+	 * XXX: @node can be NUMA_NO_NODE if CPU goes offline while a
+	 * delayed item is pending.  The plan is to keep CPU -> NODE
+	 * mapping valid and stable across CPU on/offlines.  Once that
+	 * happens, this workaround can be removed.
+	 */
+	if (unlikely(node == NUMA_NO_NODE))
+		return wq->dfl_pwq;
+
 	return rcu_dereference_raw(wq->numa_pwq_tbl[node]);
 }
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354608 — [PATCH 3.13.y-ckt 116/138] net: dp83640: Fix tx timestamp overflow handling.

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Manfred Rudigier <Manfred.Rudigier@omicron.at>

commit 81e8f2e930fe76b9814c71b9d87c30760b5eb705 upstream.

PHY status frames are not reliable, the PHY may not be able to send them
during heavy receive traffic. This overflow condition is signaled by the
PHY in the next status frame, but the driver did not make use of it.
Instead it always reported wrong tx timestamps to user space after an
overflow happened because it assigned newly received tx timestamps to old
packets in the queue.

This commit fixes this issue by clearing the tx timestamp queue every time
an overflow happens, so that no timestamps are delivered for overflow
packets. This way time stamping will continue correctly after an overflow.

Signed-off-by: Manfred Rudigier <manfred.rudigier@omicron.at>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/phy/dp83640.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index d2907a6..be37c04 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -698,6 +698,11 @@ static void decode_rxts(struct dp83640_private *dp83640,
 {
 	struct rxts *rxts;
 	unsigned long flags;
+	u8 overflow;
+
+	overflow = (phy_rxts->ns_hi >> 14) & 0x3;
+	if (overflow)
+		pr_debug("rx timestamp queue overflow, count %d\n", overflow);
 
 	spin_lock_irqsave(&dp83640->rx_lock, flags);
 
@@ -721,6 +726,7 @@ static void decode_txts(struct dp83640_private *dp83640,
 	struct skb_shared_hwtstamps shhwtstamps;
 	struct sk_buff *skb;
 	u64 ns;
+	u8 overflow;
 
 	/* We must already have the skb that triggered this. */
 
@@ -730,6 +736,17 @@ static void decode_txts(struct dp83640_private *dp83640,
 		pr_debug("have timestamp but tx_queue empty\n");
 		return;
 	}
+
+	overflow = (phy_txts->ns_hi >> 14) & 0x3;
+	if (overflow) {
+		pr_debug("tx timestamp queue overflow, count %d\n", overflow);
+		while (skb) {
+			skb_complete_tx_timestamp(skb, NULL);
+			skb = skb_dequeue(&dp83640->tx_queue);
+		}
+		return;
+	}
+
 	ns = phy2txts(phy_txts);
 	memset(&shhwtstamps, 0, sizeof(shhwtstamps));
 	shhwtstamps.hwtstamp = ns_to_ktime(ns);
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354609 — [PATCH 3.13.y-ckt 128/138] qmi_wwan: add "4G LTE usb-modem U901"

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>

commit aac8d3c282e024c344c5b86dc1eab7af88bb9716 upstream.

Thomas reports:

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=6001 Rev=00.00
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 7bd1716..67073e9 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -535,6 +535,7 @@ static const struct usb_device_id products[] = {
 
 	/* 3. Combined interface devices matching on interface number */
 	{QMI_FIXED_INTF(0x0408, 0xea42, 4)},	/* Yota / Megafon M100-1 */
+	{QMI_FIXED_INTF(0x05c6, 0x6001, 3)},	/* 4G LTE usb-modem U901 */
 	{QMI_FIXED_INTF(0x05c6, 0x7000, 0)},
 	{QMI_FIXED_INTF(0x05c6, 0x7001, 1)},
 	{QMI_FIXED_INTF(0x05c6, 0x7002, 1)},
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354610 — [PATCH 3.13.y-ckt 136/138] net/mlx4_en: Choose time-stamping shift value according to HW frequency

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Eugenia Emantayev <eugenia@mellanox.com>

commit 31c128b66e5b28f468076e4f3ca3025c35342041 upstream.

Previously, the shift value used for time-stamping was constant and didn't
depend on the HW chip frequency. Change that to take the frequency into account
and calculate the maximal value in cycles per wraparound of ten seconds. This
time slot was chosen since it gives a good accuracy in time synchronization.

Algorithm for shift value calculation:
 * Round up the maximal value in cycles to nearest power of two

 * Calculate maximal multiplier by division of all 64 bits set
   to above result

 * Then, invert the function clocksource_khz2mult() to get the shift from
   maximal mult value

Fixes: ec693d47010e ('net/mlx4_en: Add HW timestamping (TS) support')
Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Reviewed-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/ethernet/mellanox/mlx4/en_clock.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index fd64410..9180c7e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -111,6 +111,24 @@ void mlx4_en_fill_hwtstamps(struct mlx4_en_dev *mdev,
 	hwts->hwtstamp = ns_to_ktime(nsec);
 }
 
+#define MLX4_EN_WRAP_AROUND_SEC	10ULL
+
+/* This function calculates the max shift that enables the user range
+ * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register.
+ */
+static u32 freq_to_shift(u16 freq)
+{
+	u32 freq_khz = freq * 1000;
+	u64 max_val_cycles = freq_khz * 1000 * MLX4_EN_WRAP_AROUND_SEC;
+	u64 max_val_cycles_rounded = is_power_of_2(max_val_cycles + 1) ?
+		max_val_cycles : roundup_pow_of_two(max_val_cycles) - 1;
+	/* calculate max possible multiplier in order to fit in 64bit */
+	u64 max_mul = div_u64(0xffffffffffffffffULL, max_val_cycles_rounded);
+
+	/* This comes from the reverse of clocksource_khz2mult */
+	return ilog2(div_u64(max_mul * freq_khz, 1000000));
+}
+
 void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 {
 	struct mlx4_dev *dev = mdev->dev;
@@ -119,12 +137,7 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
 	memset(&mdev->cycles, 0, sizeof(mdev->cycles));
 	mdev->cycles.read = mlx4_en_read_clock;
 	mdev->cycles.mask = CLOCKSOURCE_MASK(48);
-	/* Using shift to make calculation more accurate. Since current HW
-	 * clock frequency is 427 MHz, and cycles are given using a 48 bits
-	 * register, the biggest shift when calculating using u64, is 14
-	 * (max_cycles * multiplier < 2^64)
-	 */
-	mdev->cycles.shift = 14;
+	mdev->cycles.shift = freq_to_shift(dev->caps.hca_core_clock);
 	mdev->cycles.mult =
 		clocksource_khz2mult(1000 * dev->caps.hca_core_clock, mdev->cycles.shift);
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354611 — [PATCH 3.13.y-ckt 118/138] af_unix: fix struct pid memory leak

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Eric Dumazet <edumazet@google.com>

commit fa0dc04df259ba2df3ce1920e9690c7842f8fa4b upstream.

Dmitry reported a struct pid leak detected by a syzkaller program.

Bug happens in unix_stream_recvmsg() when we break the loop when a
signal is pending, without properly releasing scm.

Fixes: b3ca9b02b007 ("net: fix multithreaded signal handling in unix recv routines")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16:
  - use siocb->scm instead of &scm ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/unix/af_unix.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e6b0213..496ce9c 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2147,6 +2147,7 @@ again:
 
 			if (signal_pending(current)) {
 				err = sock_intr_errno(timeo);
+				scm_destroy(siocb->scm);
 				goto out;
 			}
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354612 — [PATCH 3.13.y-ckt 135/138] ipv4: fix memory leaks in ip_cmsg_send() callers

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Eric Dumazet <edumazet@google.com>

commit 919483096bfe75dda338e98d56da91a263746a0a upstream.

Dmitry reported memory leaks of IP options allocated in
ip_cmsg_send() when/if this function returns an error.

Callers are responsible for the freeing.

Many thanks to Dmitry for the report and diagnostic.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/ipv4/ip_sockglue.c | 2 ++
 net/ipv4/ping.c        | 4 +++-
 net/ipv4/raw.c         | 4 +++-
 net/ipv4/udp.c         | 4 +++-
 4 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 304cd16..73e8497 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -200,6 +200,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
 		switch (cmsg->cmsg_type) {
 		case IP_RETOPTS:
 			err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));
+
+			/* Our caller is responsible for freeing ipc->opt */
 			err = ip_options_get(net, &ipc->opt, CMSG_DATA(cmsg),
 					     err < 40 ? err : 40);
 			if (err)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 64735ad..fc15435 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -743,8 +743,10 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
 	if (msg->msg_controllen) {
 		err = ip_cmsg_send(sock_net(sk), msg, &ipc);
-		if (err)
+		if (unlikely(err)) {
+			kfree(ipc.opt);
 			return err;
+		}
 		if (ipc.opt)
 			free = 1;
 	}
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 3022aed..4bd8d30 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -525,8 +525,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
 	if (msg->msg_controllen) {
 		err = ip_cmsg_send(sock_net(sk), msg, &ipc);
-		if (err)
+		if (unlikely(err)) {
+			kfree(ipc.opt);
 			goto out;
+		}
 		if (ipc.opt)
 			free = 1;
 	}
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ccb5fbf..3dc61c4 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -933,8 +933,10 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
 	if (msg->msg_controllen) {
 		err = ip_cmsg_send(sock_net(sk), msg, &ipc);
-		if (err)
+		if (unlikely(err)) {
+			kfree(ipc.opt);
 			return err;
+		}
 		if (ipc.opt)
 			free = 1;
 		connected = 0;
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354613 — [PATCH 3.13.y-ckt 133/138] sctp: Fix port hash table size computation

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Neil Horman <nhorman@tuxdriver.com>

commit d9749fb5942f51555dc9ce1ac0dbb1806960a975 upstream.

Dmitry Vyukov noted recently that the sctp_port_hashtable had an error in
its size computation, observing that the current method never guaranteed
that the hashsize (measured in number of entries) would be a power of two,
which the input hash function for that table requires.  The root cause of
the problem is that two values need to be computed (one, the allocation
order of the storage requries, as passed to __get_free_pages, and two the
number of entries for the hash table).  Both need to be ^2, but for
different reasons, and the existing code is simply computing one order
value, and using it as the basis for both, which is wrong (i.e. it assumes
that ((1<<order)*PAGE_SIZE)/sizeof(bucket) is still ^2 when its not).

To fix this, we change the logic slightly.  We start by computing a goal
allocation order (which is limited by the maximum size hash table we want
to support.  Then we attempt to allocate that size table, decreasing the
order until a successful allocation is made.  Then, with the resultant
successful order we compute the number of buckets that hash table supports,
which we then round down to the nearest power of two, giving us the number
of entries the table actually supports.

I've tested this locally here, using non-debug and spinlock-debug kernels,
and the number of entries in the hashtable consistently work out to be
powers of two in all cases.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
CC: Dmitry Vyukov <dvyukov@google.com>
CC: Vladislav Yasevich <vyasevich@gmail.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/sctp/protocol.c | 47 ++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 38 insertions(+), 9 deletions(-)

diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 599757e..d8689fc 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -61,6 +61,8 @@
 #include <net/inet_common.h>
 #include <net/inet_ecn.h>
 
+#define MAX_SCTP_PORT_HASH_ENTRIES (64 * 1024)
+
 /* Global data structures. */
 struct sctp_globals sctp_globals __read_mostly;
 
@@ -1333,6 +1335,8 @@ static __init int sctp_init(void)
 	unsigned long limit;
 	int max_share;
 	int order;
+	int num_entries;
+	int max_entry_order;
 
 	BUILD_BUG_ON(sizeof(struct sctp_ulpevent) >
 		     sizeof(((struct sk_buff *) 0)->cb));
@@ -1386,14 +1390,24 @@ static __init int sctp_init(void)
 
 	/* Size and allocate the association hash table.
 	 * The methodology is similar to that of the tcp hash tables.
+	 * Though not identical.  Start by getting a goal size
 	 */
 	if (totalram_pages >= (128 * 1024))
 		goal = totalram_pages >> (22 - PAGE_SHIFT);
 	else
 		goal = totalram_pages >> (24 - PAGE_SHIFT);
 
-	for (order = 0; (1UL << order) < goal; order++)
-		;
+	/* Then compute the page order for said goal */
+	order = get_order(goal);
+
+	/* Now compute the required page order for the maximum sized table we
+	 * want to create
+	 */
+	max_entry_order = get_order(MAX_SCTP_PORT_HASH_ENTRIES *
+				    sizeof(struct sctp_bind_hashbucket));
+
+	/* Limit the page order by that maximum hash table size */
+	order = min(order, max_entry_order);
 
 	do {
 		sctp_assoc_hashsize = (1UL << order) * PAGE_SIZE /
@@ -1427,27 +1441,42 @@ static __init int sctp_init(void)
 		INIT_HLIST_HEAD(&sctp_ep_hashtable[i].chain);
 	}
 
-	/* Allocate and initialize the SCTP port hash table.  */
+	/* Allocate and initialize the SCTP port hash table.
+	 * Note that order is initalized to start at the max sized
+	 * table we want to support.  If we can't get that many pages
+	 * reduce the order and try again
+	 */
 	do {
-		sctp_port_hashsize = (1UL << order) * PAGE_SIZE /
-					sizeof(struct sctp_bind_hashbucket);
-		if ((sctp_port_hashsize > (64 * 1024)) && order > 0)
-			continue;
 		sctp_port_hashtable = (struct sctp_bind_hashbucket *)
 			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, order);
 	} while (!sctp_port_hashtable && --order > 0);
+
 	if (!sctp_port_hashtable) {
 		pr_err("Failed bind hash alloc\n");
 		status = -ENOMEM;
 		goto err_bhash_alloc;
 	}
+
+	/* Now compute the number of entries that will fit in the
+	 * port hash space we allocated
+	 */
+	num_entries = (1UL << order) * PAGE_SIZE /
+		      sizeof(struct sctp_bind_hashbucket);
+
+	/* And finish by rounding it down to the nearest power of two
+	 * this wastes some memory of course, but its needed because
+	 * the hash function operates based on the assumption that
+	 * that the number of entries is a power of two
+	 */
+	sctp_port_hashsize = rounddown_pow_of_two(num_entries);
+
 	for (i = 0; i < sctp_port_hashsize; i++) {
 		spin_lock_init(&sctp_port_hashtable[i].lock);
 		INIT_HLIST_HEAD(&sctp_port_hashtable[i].chain);
 	}
 
-	pr_info("Hash tables configured (established %d bind %d)\n",
-		sctp_assoc_hashsize, sctp_port_hashsize);
+	pr_info("Hash tables configured (established %d bind %d/%d)\n",
+		sctp_assoc_hashsize, sctp_port_hashsize, num_entries);
 
 	sctp_sysctl_register();
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354614 — [PATCH 3.13.y-ckt 124/138] unix: correctly track in-flight fds in sending process user_struct

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 upstream.

The commit referenced in the Fixes tag incorrectly accounted the number
of in-flight fds over a unix domain socket to the original opener
of the file-descriptor. This allows another process to arbitrary
deplete the original file-openers resource limit for the maximum of
open files. Instead the sending processes and its struct cred should
be credited.

To do so, we add a reference counted struct user_struct pointer to the
scm_fp_list and use it to account for the number of inflight unix fds.

Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets")
Reported-by: David Herrmann <dh.herrmann@gmail.com>
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 include/net/af_unix.h | 4 ++--
 include/net/scm.h     | 1 +
 net/core/scm.c        | 7 +++++++
 net/unix/af_unix.c    | 4 ++--
 net/unix/garbage.c    | 8 ++++----
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index e830c3d..7bb69c9 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -6,8 +6,8 @@
 #include <linux/mutex.h>
 #include <net/sock.h>
 
-void unix_inflight(struct file *fp);
-void unix_notinflight(struct file *fp);
+void unix_inflight(struct user_struct *user, struct file *fp);
+void unix_notinflight(struct user_struct *user, struct file *fp);
 void unix_gc(void);
 void wait_for_unix_gc(void);
 struct sock *unix_get_socket(struct file *filp);
diff --git a/include/net/scm.h b/include/net/scm.h
index 262532d..59fa93c 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -21,6 +21,7 @@ struct scm_creds {
 struct scm_fp_list {
 	short			count;
 	short			max;
+	struct user_struct	*user;
 	struct file		*fp[SCM_MAX_FD];
 };
 
diff --git a/net/core/scm.c b/net/core/scm.c
index b442e7e..47a5515 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
 		*fplp = fpl;
 		fpl->count = 0;
 		fpl->max = SCM_MAX_FD;
+		fpl->user = NULL;
 	}
 	fpp = &fpl->fp[fpl->count];
 
@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
 		*fpp++ = file;
 		fpl->count++;
 	}
+
+	if (!fpl->user)
+		fpl->user = get_uid(current_user());
+
 	return num;
 }
 
@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm)
 		scm->fp = NULL;
 		for (i=fpl->count-1; i>=0; i--)
 			fput(fpl->fp[i]);
+		free_uid(fpl->user);
 		kfree(fpl);
 	}
 }
@@ -335,6 +341,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
 		for (i = 0; i < fpl->count; i++)
 			get_file(fpl->fp[i]);
 		new_fpl->max = new_fpl->count;
+		new_fpl->user = get_uid(fpl->user);
 	}
 	return new_fpl;
 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 496ce9c..e00b572 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1467,7 +1467,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 	UNIXCB(skb).fp = NULL;
 
 	for (i = scm->fp->count-1; i >= 0; i--)
-		unix_notinflight(scm->fp->fp[i]);
+		unix_notinflight(scm->fp->user, scm->fp->fp[i]);
 }
 
 static void unix_destruct_scm(struct sk_buff *skb)
@@ -1532,7 +1532,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 		return -ENOMEM;
 
 	for (i = scm->fp->count - 1; i >= 0; i--)
-		unix_inflight(scm->fp->fp[i]);
+		unix_inflight(scm->fp->user, scm->fp->fp[i]);
 	return max_level;
 }
 
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 06730fe..a72182d 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file *filp)
  *	descriptor if it is for an AF_UNIX socket.
  */
 
-void unix_inflight(struct file *fp)
+void unix_inflight(struct user_struct *user, struct file *fp)
 {
 	struct sock *s = unix_get_socket(fp);
 
@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp)
 		}
 		unix_tot_inflight++;
 	}
-	fp->f_cred->user->unix_inflight++;
+	user->unix_inflight++;
 	spin_unlock(&unix_gc_lock);
 }
 
-void unix_notinflight(struct file *fp)
+void unix_notinflight(struct user_struct *user, struct file *fp)
 {
 	struct sock *s = unix_get_socket(fp);
 
@@ -157,7 +157,7 @@ void unix_notinflight(struct file *fp)
 			list_del_init(&u->link);
 		unix_tot_inflight--;
 	}
-	fp->f_cred->user->unix_inflight--;
+	user->unix_inflight--;
 	spin_unlock(&unix_gc_lock);
 }
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354615 — [PATCH 3.13.y-ckt 121/138] ipv6/udp: use sticky pktinfo egress ifindex on connect()

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Paolo Abeni <pabeni@redhat.com>

commit 1cdda91871470f15e79375991bd2eddc6e86ddb1 upstream.

Currently, the egress interface index specified via IPV6_PKTINFO
is ignored by __ip6_datagram_connect(), so that RFC 3542 section 6.7
can be subverted when the user space application calls connect()
before sendmsg().
Fix it by initializing properly flowi6_oif in connect() before
performing the route lookup.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/ipv6/datagram.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 6e85cb9..28be769 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -162,6 +162,9 @@ ipv4_connected:
 	fl6.fl6_dport = inet->inet_dport;
 	fl6.fl6_sport = inet->inet_sport;
 
+	if (!fl6.flowi6_oif)
+		fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
+
 	if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST))
 		fl6.flowi6_oif = np->mcast_oif;
 
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1354616 — [PATCH 3.13.y-ckt 103/138] ext4: fix bh->b_state corruption

3.13.11-ckt36 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jan Kara <jack@suse.com>

commit ed8ad83808f009ade97ebbf6519bc3a97fefbc0c upstream.

ext4 can update bh->b_state non-atomically in _ext4_get_block() and
ext4_da_get_block_prep(). Usually this is fine since bh is just a
temporary storage for mapping information on stack but in some cases it
can be fully living bh attached to a page. In such case non-atomic
update of bh->b_state can race with an atomic update which then gets
lost. Usually when we are mapping bh and thus updating bh->b_state
non-atomically, nobody else touches the bh and so things work out fine
but there is one case to especially worry about: ext4_finish_bio() uses
BH_Uptodate_Lock on the first bh in the page to synchronize handling of
PageWriteback state. So when blocksize < pagesize, we can be atomically
modifying bh->b_state of a buffer that actually isn't under IO and thus
can race e.g. with delalloc trying to map that buffer. The result is
that we can mistakenly set / clear BH_Uptodate_Lock bit resulting in the
corruption of PageWriteback state or missed unlock of BH_Uptodate_Lock.

Fix the problem by always updating bh->b_state bits atomically.

Reported-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[ luis: backported to 3.16:
  - replaced READ_ONCE() by ACCESS_ONCE() ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/ext4/inode.c | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 776de0e..5fc5e63 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -704,6 +704,34 @@ has_zeroout:
 	return retval;
 }
 
+/*
+ * Update EXT4_MAP_FLAGS in bh->b_state. For buffer heads attached to pages
+ * we have to be careful as someone else may be manipulating b_state as well.
+ */
+static void ext4_update_bh_state(struct buffer_head *bh, unsigned long flags)
+{
+	unsigned long old_state;
+	unsigned long new_state;
+
+	flags &= EXT4_MAP_FLAGS;
+
+	/* Dummy buffer_head? Set non-atomically. */
+	if (!bh->b_page) {
+		bh->b_state = (bh->b_state & ~EXT4_MAP_FLAGS) | flags;
+		return;
+	}
+	/*
+	 * Someone else may be modifying b_state. Be careful! This is ugly but
+	 * once we get rid of using bh as a container for mapping information
+	 * to pass to / from get_block functions, this can go away.
+	 */
+	do {
+		old_state = ACCESS_ONCE(bh->b_state);
+		new_state = (old_state & ~EXT4_MAP_FLAGS) | flags;
+	} while (unlikely(
+		 cmpxchg(&bh->b_state, old_state, new_state) != old_state));
+}
+
 /* Maximum number of blocks we map for direct IO at once. */
 #define DIO_MAX_BLOCKS 4096
 
@@ -740,7 +768,7 @@ static int _ext4_get_block(struct inode *inode, sector_t iblock,
 		ext4_io_end_t *io_end = ext4_inode_aio(inode);
 
 		map_bh(bh, inode->i_sb, map.m_pblk);
-		bh->b_state = (bh->b_state & ~EXT4_MAP_FLAGS) | map.m_flags;
+		ext4_update_bh_state(bh, map.m_flags);
 		if (io_end && io_end->flag & EXT4_IO_END_UNWRITTEN)
 			set_buffer_defer_completion(bh);
 		bh->b_size = inode->i_sb->s_blocksize * map.m_len;
@@ -1703,7 +1731,7 @@ int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
 		return ret;
 
 	map_bh(bh, inode->i_sb, map.m_pblk);
-	bh->b_state = (bh->b_state & ~EXT4_MAP_FLAGS) | map.m_flags;
+	ext4_update_bh_state(bh, map.m_flags);
 
 	if (buffer_unwritten(bh)) {
 		/* A delayed write to unwritten bh should be marked
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

Page 2 of 6 — ← Prev page 1 [2] 3 4 5 6  Next page →

Back to top | Article view | linux.kernel

csiph-web