Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1352081 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2016-03-08 00:00 +0100 |
| Last post | 2016-03-08 02:00 +0100 |
| Articles | 20 on this page of 231 — 1 participant |
Back to article view | Back to linux.kernel
[4.2.y-ckt stable] Linux 4.2.8-ckt5 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:00 +0100
[PATCH 4.2.y-ckt 034/273] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:00 +0100
[PATCH 4.2.y-ckt 264/273] net: phy: bcm7xxx: Fix shadow mode 2 disabling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 259/273] ARM: dts: kirkwood: use unique machine name for ds112 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 256/273] af_unix: Don't set err in unix_stream_read_generic unless there was an error Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 247/273] l2tp: Fix error creating L2TP tunnels Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 253/273] net/mlx4_core: Do not BUG_ON during reset when PCI is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 262/273] [media] exynos4-is: fix a format string bug Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 249/273] route: check and remove route cache when we get route Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 269/273] net: phy: Fix phy_mac_interrupt() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 270/273] net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 268/273] s390/oprofile: fix address range for asynchronous stack Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 271/273] net: phy: bcm7xxx: Fix 40nm EPHY features Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 255/273] batman-adv: Avoid endless loop in bat-on-bat netdevice check Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 267/273] net: phy: bcm7xxx: Fix bcm7xxx_config_init() check Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 238/273] net: Copy inner L3 and L4 headers as unaligned on GRE TEB Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 243/273] qmi_wwan: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 273/273] IB/IPoIB: Do not set skb truesize since using one linearskb Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 246/273] net/mlx4_en: Avoid changing dev->features directly in run-time Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 251/273] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 250/273] rtnl: RTM_GETNETCONF: fix wrong return value Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 254/273] s390/perf_event: fix address range for asynchronous stack Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 266/273] bonding: don't use stale speed and duplex information Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 245/273] net/mlx4_en: Choose time-stamping shift value according to HW frequency Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 242/273] af_unix: Guard against other == sk in unix_dgram_sendmsg Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 239/273] bpf: fix branch offset adjustment on backjumps after patching ctx expansion Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 261/273] MAINTAINERS: Remove stale entry for BCM33xx chips Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 265/273] writeback: initialize inode members that track writeback history Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 257/273] netlink: not trim skb for mmaped socket when dump Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 248/273] pppoe: fix reference counting in PPPoE proxy Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 263/273] net/mlx4_core: Fix potential corruption in counters database Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 252/273] sctp: Fix port hash table size computation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 260/273] s390/stacktrace: fix address ranges for asynchronous and panic stack Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 258/273] Input: xpad - remove unused function Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 272/273] netfilter: nfnetlink: correctly validate length of batch messages Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 244/273] net/mlx4_en: Count HW buffer overrun only once Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:10 +0100
[PATCH 4.2.y-ckt 225/273] tipc: fix connection abort during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
Re: [PATCH 4.2.y-ckt 225/273] tipc: fix connection abort during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-10 19:00 +0100
[PATCH 4.2.y-ckt 131/273] ALSA: timer: Fix race between stop and interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 222/273] af_unix: fix struct pid memory leak Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 240/273] bonding: Fix ARP monitor validation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 223/273] pptp: fix illegal memory access caused by multiple bind()s Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 241/273] ipv4: fix memory leaks in ip_cmsg_send() callers Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 224/273] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 221/273] tcp: fix NULL deref in tcp_v4_send_ack() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 176/273] x86/mm: Fix vmalloc_fault() to handle large pages properly Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 172/273] x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 232/273] ipv6: fix a lockdep splat Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 231/273] ipv6: addrconf: Fix recursive spin lock call Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 228/273] ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 227/273] tcp: beware of alignments in tcp_get_info() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 229/273] ipv6/udp: use sticky pktinfo egress ifindex on connect() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 219/273] af_iucv: Validate socket address length in iucv_sock_bind() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 226/273] switchdev: Require RTNL mutex to be held when sending FDB notifications Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 237/273] flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 171/273] x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 233/273] unix: correctly track in-flight fds in sending process user_struct Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 230/273] net/ipv6: add sysctl option accept_ra_min_hop_limit Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:20 +0100
[PATCH 4.2.y-ckt 190/273] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 215/273] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 193/273] s390/compat: correct restore of high gprs on signal return Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 199/273] ARCv2: SMP: Emulate IPI to self using software triggered interrupt Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 197/273] sunrpc/cache: fix off-by-one in qword_get() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 191/273] can: ems_usb: Fix possible tx overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 205/273] ALSA: hda - Fixing background noise on Dell Inspiron 3162 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 201/273] KVM: async_pf: do not warn on page allocation failures Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 203/273] libceph: don't bail early from try_read() when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 220/273] net: dp83640: Fix tx timestamp overflow handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 210/273] ALSA: hda - Loop interrupt handling until really cleared Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 213/273] ocfs2: unlock inode if deleting inode from orphan fails Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 207/273] ALSA: hda/realtek - Support Dell headset mode for ALC225 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 218/273] do_last(): ELOOP failure exit should be done after leaving RCU mode Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 202/273] tracing: Fix showing function event in available_events Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 211/273] x86/mpx: Fix off-by-one comparison with nr_registers Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 208/273] ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 204/273] libceph: use the right footer size when skipping a message Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 209/273] ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 192/273] dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 217/273] should_follow_link(): validate ->d_seq after having decided to follow Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 212/273] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 206/273] KVM: x86: MMU: fix ubsan index-out-of-range warning Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 216/273] namei: ->d_inode of a pinned dentry is stable only for positives Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 214/273] hpfs: don't truncate the file when delete fails Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 200/273] KVM: x86: fix missed hardware breakpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 198/273] KVM: arm/arm64: vgic: Ensure bitmaps are long enough Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:30 +0100
[PATCH 4.2.y-ckt 155/273] iwlwifi: mvm: don't allow sched scans without matches to be started Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 174/273] powerpc/ioda: Set "read" permission when "write" is set Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 149/273] btrfs: properly set the termination value of ctx->pos in readdir Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 185/273] ext4: fix bh->b_state corruption Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 178/273] USB: option: add support for SIM7100E Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 153/273] ext4: don't read blocks from disk after extents being swapped Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 163/273] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 164/273] tracepoints: Do not trace when cpu is offline Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 173/273] usb: dwc3: Fix assignment of EP transfer resources Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 182/273] ipc: convert invalid scenarios to use WARN_ON Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 165/273] tracing: Fix freak link error caused by branch tracer Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 160/273] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 179/273] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 162/273] ALSA: hda - Cancel probe work instead of flush at remove Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 184/273] hwmon: (ads1015) Handle negative conversion values correctly Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 183/273] ipc/shm: handle removed segments gracefully in shm_mmap() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 151/273] scsi: fix soft lockup in scsi_remove_target() on module removal Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 152/273] ext4: fix potential integer overflow Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 154/273] bio: return EINTR if copying to user space got interrupted Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 180/273] USB: option: add "4G LTE usb-modem U901" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 150/273] irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 181/273] mm: fix regression in remap_file_pages() emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 169/273] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 168/273] drm/radeon: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 177/273] ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 161/273] ALSA: seq: Fix leak of pool buffer at concurrent writes Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 157/273] powerpc/powernv: Fix stale PE primary bus Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 175/273] NFSv4: Fix a dentry leak on alias use Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 166/273] ALSA: seq: Fix double port list deletion Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 167/273] drm/amdgpu: use post-decrement in error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:40 +0100
[PATCH 4.2.y-ckt 126/273] powerpc: Fix dedotify for binutils >= 2.26 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 148/273] ARM: 8519/1: ICST: try other dividends than 1 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 122/273] klist: fix starting point removed bug in klist iterators Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 138/273] drm/i915: fix error path in intel_setup_gmbus() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 130/273] nfs: fix nfs_size_to_loff_t Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 147/273] s390/dasd: fix refcount for PAV reassignment Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 124/273] drm/i915/dsi: defend gpio table against out of bounds access Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 015/273] x86/entry/compat: Add missing CLAC to entry_INT80_32 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 123/273] ALSA: dummy: Implement timer backend switching more safely Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 132/273] ALSA: hda - Fix bad dereference of jack object Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 144/273] drm/amdgpu: fix issue with overlapping userptrs Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 128/273] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 125/273] drm/i915/dsi: don't pass arbitrary data to sideband Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 143/273] drm/radeon: hold reference to fences in radeon_sa_bo_new Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 136/273] phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 115/273] target: Fix race with SCF_SEND_DELAYED_TAS handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 140/273] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 137/273] drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 127/273] ALSA: timer: Fix wrong instance passed to slave callbacks Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 134/273] phy: core: fix wrong err handle for phy_power_on Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 135/273] phy: twl4030-usb: Relase usb phy on unload Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 145/273] cifs: fix erroneous return value Kamal Mostafa <kamal@canonical.com> - 2016-03-08 00:50 +0100
[PATCH 4.2.y-ckt 039/273] ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
[PATCH 4.2.y-ckt 108/273] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
[PATCH 4.2.y-ckt 113/273] crypto: atmel-sha - fix atmel_sha_remove() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
[PATCH 4.2.y-ckt 121/273] ALSA: hda - Fix speaker output from VAIO AiO machines Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
[PATCH 4.2.y-ckt 117/273] serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485) Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
[PATCH 4.2.y-ckt 120/273] pty: make sure super_block is still valid in final /dev/tty close Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:10 +0100
[PATCH 4.2.y-ckt 112/273] crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 104/273] Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 110/273] radix-tree: fix oops after radix_tree_iter_retry Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 111/273] crypto: user - lock crypto_alg_list on alg dump Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 109/273] mm: replace vma_lock_anon_vma with anon_vma_lock_read/write Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 114/273] crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 107/273] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:30 +0100
[PATCH 4.2.y-ckt 090/273] target: Fix TAS handling for multi-session se_node_acls Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 103/273] ALSA: hda - Fix static checker warning in patch_hdmi.c Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 068/273] drm/amdgpu: pull topaz gmc bits into gmc_v7 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 085/273] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 070/273] modules: fix modparam async_probe request Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 102/273] drm/dp/mst: deallocate payload on port destruction Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 073/273] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 087/273] target: Invoke release_cmd() callback without holding a spinlock Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 074/273] ALSA: rawmidi: Fix race at copying & updating the position Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 080/273] Btrfs: fix invalid page accesses in extent_same (dedup) ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 071/273] module: wrapper for symbol name. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 065/273] drm/amdgpu: move gmc7 support out of CIK dependency Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 098/273] drm: fix missing reference counting decrease Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 069/273] drm/amdgpu: drop topaz support from gmc8 module Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 064/273] ASoC: dpcm: fix the BE state on hw_free Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 066/273] drm/amdgpu: iceland use CI based MC IP Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 076/273] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 096/273] scsi_dh_rdac: always retry MODE SELECT on command lock violation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 061/273] drm: add helper to check for wc memory support Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 095/273] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 083/273] usb: xhci: add a quirk bit for ssic port unused Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 072/273] ALSA: hda - Add fixup for Mac Mini 7,1 model Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 084/273] usb: xhci: set SSIC port unused only if xhci_suspend succeeds Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 089/273] target: Fix LUN_RESET active TMR descriptor handling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 101/273] drm/dp/mst: Reverse order of MST enable and clearing VC payload table. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 075/273] ALSA: seq: Fix lockdep warnings due to double mutex locks Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 093/273] [media] saa7134-alsa: Only frees registered sound cards Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 088/273] target: Fix LUN_RESET active I/O handling for ACK_KREF Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 106/273] dump_stack: avoid potential deadlocks Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 100/273] drm/dp/mst: Calculate MST PBN with 31.32 fixed point Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 105/273] target: Fix remote-port TMR ABORT + se_cmd fabric stop Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 092/273] ALSA: timer: Fix leftover link at closing Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 097/273] SCSI: Add Marvell Console to VPD blacklist Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 094/273] ARM: nomadik: fix up SD/MMC DT settings Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 099/273] drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 067/273] drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:40 +0100
[PATCH 4.2.y-ckt 026/273] ARM: OMAP2+: Fix wait_dll_lock_timed for rodata Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 032/273] PCI/AER: Flush workqueue on device remove to avoid use-after-free Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 046/273] ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 058/273] libata: fix sff host state machine locking while polling Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 033/273] ARM: dts: Fix wl12xx missing clocks that cause hangs Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 037/273] ARM: dts: at91: sama5d4: fix instance id of DBGU Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 036/273] rfkill: fix rfkill_fop_read wait_event usage Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 049/273] iio: inkern: fix a NULL dereference on error Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 042/273] spi: atmel: fix gpio chip-select in case of non-DT platform Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 043/273] drm/i915/dp: fall back to 18 bpp when sink capability is unknown Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 044/273] ALSA: usb-audio: Fix OPPO HA-1 vendor ID Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 012/273] Revert "workqueue: make sure delayed work run in local cpu" Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 041/273] Input: vmmouse - fix absolute device registration Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 028/273] ARM: OMAP2+: Fix save_secure_ram_context for rodata Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 056/273] ALSA: timer: Code cleanup Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 055/273] ALSA: seq: Fix yet another races among ALSA timer accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 062/273] drm/radeon: mask out WC from BO on unsupported arches Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 045/273] ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 060/273] cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 053/273] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 027/273] ARM: OMAP2+: Fix l2dis_3630 for rodata Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 047/273] target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 048/273] crypto: algif_hash - wait for crypto_ahash_init() to complete Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 051/273] intel_scu_ipcutil: underflow in scu_reg_access() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 035/273] mac80211: Requeue work after scan complete for all VIF types. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 063/273] drm/amdgpu: mask out WC from BO on unsupported arches Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 025/273] cgroup: make sure a parent css isn't offlined before its children Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 023/273] ASoC: rt5645: fix the shift bit of IN1 boost Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 054/273] ALSA: pcm: Fix potential deadlock in OSS emulation Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 052/273] ALSA: seq: Fix race at closing in virmidi driver Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 057/273] ALSA: timer: Fix link corruption due to double start or stop Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 050/273] iio: pressure: mpl115: fix temperature offset sign Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 040/273] crypto: shash - Fix has_key setting Kamal Mostafa <kamal@canonical.com> - 2016-03-08 01:50 +0100
[PATCH 4.2.y-ckt 009/273] EVM: Use crypto_memneq() for digest comparisons Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 010/273] ALSA: usb-audio: avoid freeing umidi object twice Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 022/273] iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer. Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 017/273] iio: add IIO_TRIGGER dependency to STK8BA50 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 013/273] drm/vmwgfx: Fix an fb unlocking bug Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 016/273] iio-light: Use a signed return type for ltr501_match_samp_freq() Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 024/273] ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2 Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 020/273] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 018/273] iio: add HAS_IOMEM dependency to VF610_ADC Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 019/273] iio: dac: mcp4725: set iio name property in sysfs Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 021/273] iio: light: acpi-als: Report data as processed Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
[PATCH 4.2.y-ckt 011/273] vmstat: explicitly schedule per-cpu work on the CPU we need it to run on Kamal Mostafa <kamal@canonical.com> - 2016-03-08 02:00 +0100
Page 3 of 12 — ← Prev page 1 2 [3] 4 5 … 12 Next page →
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 240/273] bonding: Fix ARP monitor validation |
| Message-ID | <racBs-YH-19@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jay Vosburgh <jay.vosburgh@canonical.com>
[ Upstream commit 21a75f0915dde8674708b39abfcda113911c49b1 ]
The current logic in bond_arp_rcv will accept an incoming ARP for
validation if (a) the receiving slave is either "active" (which includes
the currently active slave, or the current ARP slave) or, (b) there is a
currently active slave, and it has received an ARP since it became active.
For case (b), the receiving slave isn't the currently active slave, and is
receiving the original broadcast ARP request, not an ARP reply from the
target.
This logic can fail if there is no currently active slave. In
this situation, the ARP probe logic cycles through all slaves, assigning
each in turn as the "current_arp_slave" for one arp_interval, then setting
that one as "active," and sending an ARP probe from that slave. The
current logic expects the ARP reply to arrive on the sending
current_arp_slave, however, due to switch FDB updating delays, the reply
may be directed to another slave.
This can arise if the bonding slaves and switch are working, but
the ARP target is not responding. When the ARP target recovers, a
condition may result wherein the ARP target host replies faster than the
switch can update its forwarding table, causing each ARP reply to be sent
to the previous current_arp_slave. This will never pass the logic in
bond_arp_rcv, as neither of the above conditions (a) or (b) are met.
Some experimentation on a LAN shows ARP reply round trips in the
200 usec range, but my available switches never update their FDB in less
than 4000 usec.
This patch changes the logic in bond_arp_rcv to additionally
accept an ARP reply for validation on any slave if there is a current ARP
slave and it sent an ARP probe during the previous arp_interval.
Fixes: aeea64ac717a ("bonding: don't trust arp requests unless active slave really works")
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/bonding/bond_main.c | 39 ++++++++++++++++++++++++++++-----------
1 file changed, 28 insertions(+), 11 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 593dc28..ba0e359 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -214,6 +214,8 @@ static void bond_uninit(struct net_device *bond_dev);
static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
struct rtnl_link_stats64 *stats);
static void bond_slave_arr_handler(struct work_struct *work);
+static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act,
+ int mod);
/*---------------------------- General routines -----------------------------*/
@@ -2420,7 +2422,7 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
struct slave *slave)
{
struct arphdr *arp = (struct arphdr *)skb->data;
- struct slave *curr_active_slave;
+ struct slave *curr_active_slave, *curr_arp_slave;
unsigned char *arp_ptr;
__be32 sip, tip;
int alen, is_arp = skb->protocol == __cpu_to_be16(ETH_P_ARP);
@@ -2467,26 +2469,41 @@ int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
&sip, &tip);
curr_active_slave = rcu_dereference(bond->curr_active_slave);
+ curr_arp_slave = rcu_dereference(bond->current_arp_slave);
- /* Backup slaves won't see the ARP reply, but do come through
- * here for each ARP probe (so we swap the sip/tip to validate
- * the probe). In a "redundant switch, common router" type of
- * configuration, the ARP probe will (hopefully) travel from
- * the active, through one switch, the router, then the other
- * switch before reaching the backup.
+ /* We 'trust' the received ARP enough to validate it if:
+ *
+ * (a) the slave receiving the ARP is active (which includes the
+ * current ARP slave, if any), or
+ *
+ * (b) the receiving slave isn't active, but there is a currently
+ * active slave and it received valid arp reply(s) after it became
+ * the currently active slave, or
+ *
+ * (c) there is an ARP slave that sent an ARP during the prior ARP
+ * interval, and we receive an ARP reply on any slave. We accept
+ * these because switch FDB update delays may deliver the ARP
+ * reply to a slave other than the sender of the ARP request.
*
- * We 'trust' the arp requests if there is an active slave and
- * it received valid arp reply(s) after it became active. This
- * is done to avoid endless looping when we can't reach the
+ * Note: for (b), backup slaves are receiving the broadcast ARP
+ * request, not a reply. This request passes from the sending
+ * slave through the L2 switch(es) to the receiving slave. Since
+ * this is checking the request, sip/tip are swapped for
+ * validation.
+ *
+ * This is done to avoid endless looping when we can't reach the
* arp_ip_target and fool ourselves with our own arp requests.
*/
-
if (bond_is_active_slave(slave))
bond_validate_arp(bond, slave, sip, tip);
else if (curr_active_slave &&
time_after(slave_last_rx(bond, curr_active_slave),
curr_active_slave->last_link_up))
bond_validate_arp(bond, slave, tip, sip);
+ else if (curr_arp_slave && (arp->ar_op == htons(ARPOP_REPLY)) &&
+ bond_time_in_interval(bond,
+ dev_trans_start(curr_arp_slave->dev), 1))
+ bond_validate_arp(bond, slave, sip, tip);
out_unlock:
if (arp != (struct arphdr *)skb->data)
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 223/273] pptp: fix illegal memory access caused by multiple bind()s |
| Message-ID | <racBt-YH-27@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
[ Upstream commit 9a368aff9cb370298fa02feeffa861f2db497c18 ]
Several times already this has been reported as kasan reports caused by
syzkaller and trinity and people always looked at RCU races, but it is
much more simple. :)
In case we bind a pptp socket multiple times, we simply add it to
the callid_sock list but don't remove the old binding. Thus the old
socket stays in the bucket with unused call_id indexes and doesn't get
cleaned up. This causes various forms of kasan reports which were hard
to pinpoint.
Simply don't allow multiple binds and correct error handling in
pptp_bind. Also keep sk_state bits in place in pptp_connect.
Fixes: 00959ade36acad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Cc: Dmitry Kozlov <xeb@mail.ru>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dave Jones <davej@codemonkey.org.uk>
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ppp/pptp.c | 34 ++++++++++++++++++++++++----------
1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index b910cae..f55670b 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -129,24 +129,27 @@ static int lookup_chan_dst(u16 call_id, __be32 d_addr)
return i < MAX_CALLID;
}
-static int add_chan(struct pppox_sock *sock)
+static int add_chan(struct pppox_sock *sock,
+ struct pptp_addr *sa)
{
static int call_id;
spin_lock(&chan_lock);
- if (!sock->proto.pptp.src_addr.call_id) {
+ if (!sa->call_id) {
call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, call_id + 1);
if (call_id == MAX_CALLID) {
call_id = find_next_zero_bit(callid_bitmap, MAX_CALLID, 1);
if (call_id == MAX_CALLID)
goto out_err;
}
- sock->proto.pptp.src_addr.call_id = call_id;
- } else if (test_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap))
+ sa->call_id = call_id;
+ } else if (test_bit(sa->call_id, callid_bitmap)) {
goto out_err;
+ }
- set_bit(sock->proto.pptp.src_addr.call_id, callid_bitmap);
- rcu_assign_pointer(callid_sock[sock->proto.pptp.src_addr.call_id], sock);
+ sock->proto.pptp.src_addr = *sa;
+ set_bit(sa->call_id, callid_bitmap);
+ rcu_assign_pointer(callid_sock[sa->call_id], sock);
spin_unlock(&chan_lock);
return 0;
@@ -415,7 +418,6 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
struct sock *sk = sock->sk;
struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
struct pppox_sock *po = pppox_sk(sk);
- struct pptp_opt *opt = &po->proto.pptp;
int error = 0;
if (sockaddr_len < sizeof(struct sockaddr_pppox))
@@ -423,10 +425,22 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
lock_sock(sk);
- opt->src_addr = sp->sa_addr.pptp;
- if (add_chan(po))
+ if (sk->sk_state & PPPOX_DEAD) {
+ error = -EALREADY;
+ goto out;
+ }
+
+ if (sk->sk_state & PPPOX_BOUND) {
error = -EBUSY;
+ goto out;
+ }
+
+ if (add_chan(po, &sp->sa_addr.pptp))
+ error = -EBUSY;
+ else
+ sk->sk_state |= PPPOX_BOUND;
+out:
release_sock(sk);
return error;
}
@@ -497,7 +511,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
}
opt->dst_addr = sp->sa_addr.pptp;
- sk->sk_state = PPPOX_CONNECTED;
+ sk->sk_state |= PPPOX_CONNECTED;
end:
release_sock(sk);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 241/273] ipv4: fix memory leaks in ip_cmsg_send() callers |
| Message-ID | <racBt-YH-29@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 919483096bfe75dda338e98d56da91a263746a0a ]
Dmitry reported memory leaks of IP options allocated in
ip_cmsg_send() when/if this function returns an error.
Callers are responsible for the freeing.
Many thanks to Dmitry for the report and diagnostic.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv4/ip_sockglue.c | 2 ++
net/ipv4/ping.c | 4 +++-
net/ipv4/raw.c | 4 +++-
net/ipv4/udp.c | 4 +++-
4 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 5f73a7c..a501242 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -249,6 +249,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc,
switch (cmsg->cmsg_type) {
case IP_RETOPTS:
err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));
+
+ /* Our caller is responsible for freeing ipc->opt */
err = ip_options_get(net, &ipc->opt, CMSG_DATA(cmsg),
err < 40 ? err : 40);
if (err)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 05ff44b..f6ee0d5 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -745,8 +745,10 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
if (msg->msg_controllen) {
err = ip_cmsg_send(sock_net(sk), msg, &ipc, false);
- if (err)
+ if (unlikely(err)) {
+ kfree(ipc.opt);
return err;
+ }
if (ipc.opt)
free = 1;
}
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 561cd4b..c77aac7 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -543,8 +543,10 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
if (msg->msg_controllen) {
err = ip_cmsg_send(sock_net(sk), msg, &ipc, false);
- if (err)
+ if (unlikely(err)) {
+ kfree(ipc.opt);
goto out;
+ }
if (ipc.opt)
free = 1;
}
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1b8c5ba..a390174 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -963,8 +963,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
if (msg->msg_controllen) {
err = ip_cmsg_send(sock_net(sk), msg, &ipc,
sk->sk_family == AF_INET6);
- if (err)
+ if (unlikely(err)) {
+ kfree(ipc.opt);
return err;
+ }
if (ipc.opt)
free = 1;
connected = 0;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 224/273] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application |
| Message-ID | <racBt-YH-37@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
[ Upstream commit 27f7ed2b11d42ab6d796e96533c2076ec220affc ]
This patch extends commit b93d6471748d ("sctp: implement the sender side
for SACK-IMMEDIATELY extension") as it didn't white list
SCTP_SACK_IMMEDIATELY on sctp_msghdr_parse(), causing it to be
understood as an invalid flag and returning -EINVAL to the application.
Note that the actual handling of the flag is already there in
sctp_datamsg_from_user().
https://tools.ietf.org/html/rfc7053#section-7
Fixes: b93d6471748d ("sctp: implement the sender side for SACK-IMMEDIATELY extension")
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/sctp/socket.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9dee804..fb5c86b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6641,6 +6641,7 @@ static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
if (cmsgs->srinfo->sinfo_flags &
~(SCTP_UNORDERED | SCTP_ADDR_OVER |
+ SCTP_SACK_IMMEDIATELY |
SCTP_ABORT | SCTP_EOF))
return -EINVAL;
break;
@@ -6664,6 +6665,7 @@ static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
if (cmsgs->sinfo->snd_flags &
~(SCTP_UNORDERED | SCTP_ADDR_OVER |
+ SCTP_SACK_IMMEDIATELY |
SCTP_ABORT | SCTP_EOF))
return -EINVAL;
break;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 221/273] tcp: fix NULL deref in tcp_v4_send_ack() |
| Message-ID | <racBs-YH-21@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e62a123b8ef7c5dc4db2c16383d506860ad21b47 ]
Neal reported crashes with this stack trace :
RIP: 0010:[<ffffffff8c57231b>] tcp_v4_send_ack+0x41/0x20f
...
CR2: 0000000000000018 CR3: 000000044005c000 CR4: 00000000001427e0
...
[<ffffffff8c57258e>] tcp_v4_reqsk_send_ack+0xa5/0xb4
[<ffffffff8c1a7caa>] tcp_check_req+0x2ea/0x3e0
[<ffffffff8c19e420>] tcp_rcv_state_process+0x850/0x2500
[<ffffffff8c1a6d21>] tcp_v4_do_rcv+0x141/0x330
[<ffffffff8c56cdb2>] sk_backlog_rcv+0x21/0x30
[<ffffffff8c098bbd>] tcp_recvmsg+0x75d/0xf90
[<ffffffff8c0a8700>] inet_recvmsg+0x80/0xa0
[<ffffffff8c17623e>] sock_aio_read+0xee/0x110
[<ffffffff8c066fcf>] do_sync_read+0x6f/0xa0
[<ffffffff8c0673a1>] SyS_read+0x1e1/0x290
[<ffffffff8c5ca262>] system_call_fastpath+0x16/0x1b
The problem here is the skb we provide to tcp_v4_send_ack() had to
be parked in the backlog of a new TCP fastopen child because this child
was owned by the user at the time an out of window packet arrived.
Before queuing a packet, TCP has to set skb->dev to NULL as the device
could disappear before packet is removed from the queue.
Fix this issue by using the net pointer provided by the socket (being a
timewait or a request socket).
IPv6 is immune to the bug : tcp_v6_send_response() already gets the net
pointer from the socket if provided.
Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
Reported-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jerry Chu <hkchu@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv4/tcp_ipv4.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b78df51..236b76f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -705,7 +705,8 @@ release_sk1:
outside socket context is ugly, certainly. What can I do?
*/
-static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+static void tcp_v4_send_ack(struct net *net,
+ struct sk_buff *skb, u32 seq, u32 ack,
u32 win, u32 tsval, u32 tsecr, int oif,
struct tcp_md5sig_key *key,
int reply_flags, u8 tos)
@@ -720,7 +721,6 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
];
} rep;
struct ip_reply_arg arg;
- struct net *net = dev_net(skb_dst(skb)->dev);
memset(&rep.th, 0, sizeof(struct tcphdr));
memset(&arg, 0, sizeof(arg));
@@ -782,7 +782,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
struct inet_timewait_sock *tw = inet_twsk(sk);
struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
- tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+ tcp_v4_send_ack(sock_net(sk), skb,
+ tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
tcp_time_stamp + tcptw->tw_ts_offset,
tcptw->tw_ts_recent,
@@ -801,8 +802,10 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
* sk->sk_state == TCP_SYN_RECV -> for Fast Open.
*/
- tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
- tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+ u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
+ tcp_sk(sk)->snd_nxt;
+
+ tcp_v4_send_ack(sock_net(sk), skb, seq,
tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
tcp_time_stamp,
req->ts_recent,
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 176/273] x86/mm: Fix vmalloc_fault() to handle large pages properly |
| Message-ID | <racBt-YH-41@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Toshi Kani <toshi.kani@hpe.com>
commit f4eafd8bcd5229e998aa252627703b8462c3b90f upstream.
A kernel page fault oops with the callstack below was observed
when a read syscall was made to a pmem device after a huge amount
(>512GB) of vmalloc ranges was allocated by ioremap() on a x86_64
system:
BUG: unable to handle kernel paging request at ffff880840000ff8
IP: vmalloc_fault+0x1be/0x300
PGD c7f03a067 PUD 0
Oops: 0000 [#1] SM
Call Trace:
__do_page_fault+0x285/0x3e0
do_page_fault+0x2f/0x80
? put_prev_entity+0x35/0x7a0
page_fault+0x28/0x30
? memcpy_erms+0x6/0x10
? schedule+0x35/0x80
? pmem_rw_bytes+0x6a/0x190 [nd_pmem]
? schedule_timeout+0x183/0x240
btt_log_read+0x63/0x140 [nd_btt]
:
? __symbol_put+0x60/0x60
? kernel_read+0x50/0x80
SyS_finit_module+0xb9/0xf0
entry_SYSCALL_64_fastpath+0x1a/0xa4
Since v4.1, ioremap() supports large page (pud/pmd) mappings in
x86_64 and PAE. vmalloc_fault() however assumes that the vmalloc
range is limited to pte mappings.
vmalloc faults do not normally happen in ioremap'd ranges since
ioremap() sets up the kernel page tables, which are shared by
user processes. pgd_ctor() sets the kernel's PGD entries to
user's during fork(). When allocation of the vmalloc ranges
crosses a 512GB boundary, ioremap() allocates a new pud table
and updates the kernel PGD entry to point it. If user process's
PGD entry does not have this update yet, a read/write syscall
to the range will cause a vmalloc fault, which hits the Oops
above as it does not handle a large page properly.
Following changes are made to vmalloc_fault().
64-bit:
- No change for the PGD sync operation as it handles large
pages already.
- Add pud_huge() and pmd_huge() to the validation code to
handle large pages.
- Change pud_page_vaddr() to pud_pfn() since an ioremap range
is not directly mapped (while the if-statement still works
with a bogus addr).
- Change pmd_page() to pmd_pfn() since an ioremap range is not
backed by struct page (while the if-statement still works
with a bogus addr).
32-bit:
- No change for the sync operation since the index3 PGD entry
covers the entire vmalloc range, which is always valid.
(A separate change to sync PGD entry is necessary if this
memory layout is changed regardless of the page size.)
- Add pmd_huge() to the validation code to handle large pages.
This is for completeness since vmalloc_fault() won't happen
in ioremap'd ranges as its PGD entry is always valid.
Reported-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: linux-mm@kvack.org
Cc: linux-nvdimm@lists.01.org
Link: http://lkml.kernel.org/r/1455758214-24623-1-git-send-email-toshi.kani@hpe.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/mm/fault.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9dc9098..1d3beaf 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -286,6 +286,9 @@ static noinline int vmalloc_fault(unsigned long address)
if (!pmd_k)
return -1;
+ if (pmd_huge(*pmd_k))
+ return 0;
+
pte_k = pte_offset_kernel(pmd_k, address);
if (!pte_present(*pte_k))
return -1;
@@ -357,8 +360,6 @@ void vmalloc_sync_all(void)
* 64-bit:
*
* Handle a fault on the vmalloc area
- *
- * This assumes no large pages in there.
*/
static noinline int vmalloc_fault(unsigned long address)
{
@@ -400,17 +401,23 @@ static noinline int vmalloc_fault(unsigned long address)
if (pud_none(*pud_ref))
return -1;
- if (pud_none(*pud) || pud_page_vaddr(*pud) != pud_page_vaddr(*pud_ref))
+ if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref))
BUG();
+ if (pud_huge(*pud))
+ return 0;
+
pmd = pmd_offset(pud, address);
pmd_ref = pmd_offset(pud_ref, address);
if (pmd_none(*pmd_ref))
return -1;
- if (pmd_none(*pmd) || pmd_page(*pmd) != pmd_page(*pmd_ref))
+ if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref))
BUG();
+ if (pmd_huge(*pmd))
+ return 0;
+
pte_ref = pte_offset_kernel(pmd_ref, address);
if (!pte_present(*pte_ref))
return -1;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 172/273] x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() |
| Message-ID | <racBt-YH-49@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Toshi Kani <toshi.kani@hpe.com> commit a82eee7424525e34e98d821dd059ce14560a1e35 upstream. Data corruption issues were observed in tests which initiated a system crash/reset while accessing BTT devices. This problem is reproducible. The BTT driver calls pmem_rw_bytes() to update data in pmem devices. This interface calls __copy_user_nocache(), which uses non-temporal stores so that the stores to pmem are persistent. __copy_user_nocache() uses non-temporal stores when a request size is 8 bytes or larger (and is aligned by 8 bytes). The BTT driver updates the BTT map table, which entry size is 4 bytes. Therefore, updates to the map table entries remain cached, and are not written to pmem after a crash. Change __copy_user_nocache() to use non-temporal store when a request size is 4 bytes. The change extends the current byte-copy path for a less-than-8-bytes request, and does not add any overhead to the regular path. Reported-and-tested-by: Micah Parrish <micah.parrish@hpe.com> Reported-and-tested-by: Brian Boylston <brian.boylston@hpe.com> Signed-off-by: Toshi Kani <toshi.kani@hpe.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Borislav Petkov <bp@alien8.de> Cc: Borislav Petkov <bp@suse.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Dan Williams <dan.j.williams@intel.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Luis R. Rodriguez <mcgrof@suse.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ross Zwisler <ross.zwisler@linux.intel.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Toshi Kani <toshi.kani@hp.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: linux-nvdimm@lists.01.org Link: http://lkml.kernel.org/r/1455225857-12039-3-git-send-email-toshi.kani@hpe.com [ Small readability edits. ] Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/x86/lib/copy_user_64.S | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S index a644aad..27f89c7 100644 --- a/arch/x86/lib/copy_user_64.S +++ b/arch/x86/lib/copy_user_64.S @@ -237,13 +237,14 @@ ENDPROC(copy_user_enhanced_fast_string) * Note: Cached memory copy is used when destination or size is not * naturally aligned. That is: * - Require 8-byte alignment when size is 8 bytes or larger. + * - Require 4-byte alignment when size is 4 bytes. */ ENTRY(__copy_user_nocache) ASM_STAC - /* If size is less than 8 bytes, go to byte copy */ + /* If size is less than 8 bytes, go to 4-byte copy */ cmpl $8,%edx - jb .L_1b_cache_copy_entry + jb .L_4b_nocache_copy_entry /* If destination is not 8-byte aligned, "cache" copy to align it */ ALIGN_DESTINATION @@ -282,7 +283,7 @@ ENTRY(__copy_user_nocache) movl %edx,%ecx andl $7,%edx shrl $3,%ecx - jz .L_1b_cache_copy_entry /* jump if count is 0 */ + jz .L_4b_nocache_copy_entry /* jump if count is 0 */ /* Perform 8-byte nocache loop-copy */ .L_8b_nocache_copy_loop: @@ -294,11 +295,33 @@ ENTRY(__copy_user_nocache) jnz .L_8b_nocache_copy_loop /* If no byte left, we're done */ -.L_1b_cache_copy_entry: +.L_4b_nocache_copy_entry: + andl %edx,%edx + jz .L_finish_copy + + /* If destination is not 4-byte aligned, go to byte copy: */ + movl %edi,%ecx + andl $3,%ecx + jnz .L_1b_cache_copy_entry + + /* Set 4-byte copy count (1 or 0) and remainder */ + movl %edx,%ecx + andl $3,%edx + shrl $2,%ecx + jz .L_1b_cache_copy_entry /* jump if count is 0 */ + + /* Perform 4-byte nocache copy: */ +30: movl (%rsi),%r8d +31: movnti %r8d,(%rdi) + leaq 4(%rsi),%rsi + leaq 4(%rdi),%rdi + + /* If no bytes left, we're done: */ andl %edx,%edx jz .L_finish_copy /* Perform byte "cache" loop-copy for the remainder */ +.L_1b_cache_copy_entry: movl %edx,%ecx .L_1b_cache_copy_loop: 40: movb (%rsi),%al @@ -323,6 +346,9 @@ ENTRY(__copy_user_nocache) .L_fixup_8b_copy: lea (%rdx,%rcx,8),%rdx jmp .L_fixup_handle_tail +.L_fixup_4b_copy: + lea (%rdx,%rcx,4),%rdx + jmp .L_fixup_handle_tail .L_fixup_1b_copy: movl %ecx,%edx .L_fixup_handle_tail: @@ -348,6 +374,8 @@ ENTRY(__copy_user_nocache) _ASM_EXTABLE(16b,.L_fixup_4x8b_copy) _ASM_EXTABLE(20b,.L_fixup_8b_copy) _ASM_EXTABLE(21b,.L_fixup_8b_copy) + _ASM_EXTABLE(30b,.L_fixup_4b_copy) + _ASM_EXTABLE(31b,.L_fixup_4b_copy) _ASM_EXTABLE(40b,.L_fixup_1b_copy) _ASM_EXTABLE(41b,.L_fixup_1b_copy) ENDPROC(__copy_user_nocache) -- 2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 232/273] ipv6: fix a lockdep splat |
| Message-ID | <racBu-YH-55@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 44c3d0c1c0a880354e9de5d94175742e2c7c9683 ]
Silence lockdep false positive about rcu_dereference() being
used in the wrong context.
First one should use rcu_dereference_protected() as we own the spinlock.
Second one should be a normal assignation, as no barrier is needed.
Fixes: 18367681a10bd ("ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.")
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv6/ip6_flowlabel.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1f9ebe3..dc2db4f 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -540,12 +540,13 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
}
spin_lock_bh(&ip6_sk_fl_lock);
for (sflp = &np->ipv6_fl_list;
- (sfl = rcu_dereference(*sflp)) != NULL;
+ (sfl = rcu_dereference_protected(*sflp,
+ lockdep_is_held(&ip6_sk_fl_lock))) != NULL;
sflp = &sfl->next) {
if (sfl->fl->label == freq.flr_label) {
if (freq.flr_label == (np->flow_label&IPV6_FLOWLABEL_MASK))
np->flow_label &= ~IPV6_FLOWLABEL_MASK;
- *sflp = rcu_dereference(sfl->next);
+ *sflp = sfl->next;
spin_unlock_bh(&ip6_sk_fl_lock);
fl_release(sfl->fl);
kfree_rcu(sfl, rcu);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 231/273] ipv6: addrconf: Fix recursive spin lock call |
| Message-ID | <racBu-YH-57@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "subashab@codeaurora.org" <subashab@codeaurora.org>
[ Upstream commit 16186a82de1fdd868255448274e64ae2616e2640 ]
A rcu stall with the following backtrace was seen on a system with
forwarding, optimistic_dad and use_optimistic set. To reproduce,
set these flags and allow ipv6 autoconf.
This occurs because the device write_lock is acquired while already
holding the read_lock. Back trace below -
INFO: rcu_preempt self-detected stall on CPU { 1} (t=2100 jiffies
g=3992 c=3991 q=4471)
<6> Task dump for CPU 1:
<2> kworker/1:0 R running task 12168 15 2 0x00000002
<2> Workqueue: ipv6_addrconf addrconf_dad_work
<6> Call trace:
<2> [<ffffffc000084da8>] el1_irq+0x68/0xdc
<2> [<ffffffc000cc4e0c>] _raw_write_lock_bh+0x20/0x30
<2> [<ffffffc000bc5dd8>] __ipv6_dev_ac_inc+0x64/0x1b4
<2> [<ffffffc000bcbd2c>] addrconf_join_anycast+0x9c/0xc4
<2> [<ffffffc000bcf9f0>] __ipv6_ifa_notify+0x160/0x29c
<2> [<ffffffc000bcfb7c>] ipv6_ifa_notify+0x50/0x70
<2> [<ffffffc000bd035c>] addrconf_dad_work+0x314/0x334
<2> [<ffffffc0000b64c8>] process_one_work+0x244/0x3fc
<2> [<ffffffc0000b7324>] worker_thread+0x2f8/0x418
<2> [<ffffffc0000bb40c>] kthread+0xe0/0xec
v2: do addrconf_dad_kick inside read lock and then acquire write
lock for ipv6_ifa_notify as suggested by Eric
Fixes: 7fd2561e4ebdd ("net: ipv6: Add a sysctl to make optimistic
addresses useful candidates")
Cc: Eric Dumazet <edumazet@google.com>
Cc: Erik Kline <ek@google.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv6/addrconf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 54fb696..ff6e0dc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3425,6 +3425,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
{
struct inet6_dev *idev = ifp->idev;
struct net_device *dev = idev->dev;
+ bool notify = false;
addrconf_join_solict(dev, &ifp->addr);
@@ -3470,7 +3471,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
/* Because optimistic nodes can use this address,
* notify listeners. If DAD fails, RTM_DELADDR is sent.
*/
- ipv6_ifa_notify(RTM_NEWADDR, ifp);
+ notify = true;
}
}
@@ -3478,6 +3479,8 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
out:
spin_unlock(&ifp->lock);
read_unlock_bh(&idev->lock);
+ if (notify)
+ ipv6_ifa_notify(RTM_NEWADDR, ifp);
}
static void addrconf_dad_start(struct inet6_ifaddr *ifp)
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 228/273] ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail() |
| Message-ID | <racBu-YH-63@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 6f21c96a78b835259546d8f3fb4edff0f651d478 ]
The current implementation of ip6_dst_lookup_tail basically
ignore the egress ifindex match: if the saddr is set,
ip6_route_output() purposefully ignores flowi6_oif, due
to the commit d46a9d678e4c ("net: ipv6: Dont add RT6_LOOKUP_F_IFACE
flag if saddr set"), if the saddr is 'any' the first route lookup
in ip6_dst_lookup_tail fails, but upon failure a second lookup will
be performed with saddr set, thus ignoring the ifindex constraint.
This commit adds an output route lookup function variant, which
allows the caller to specify lookup flags, and modify
ip6_dst_lookup_tail() to enforce the ifindex match on the second
lookup via said helper.
ip6_route_output() becames now a static inline function build on
top of ip6_route_output_flags(); as a side effect, out-of-tree
modules need now a GPL license to access the output route lookup
functionality.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/net/ip6_route.h | 12 ++++++++++--
net/ipv6/ip6_output.c | 6 +++++-
net/ipv6/route.c | 8 +++-----
3 files changed, 18 insertions(+), 8 deletions(-)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 297629a..bc5013c 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -64,8 +64,16 @@ static inline bool rt6_need_strict(const struct in6_addr *daddr)
void ip6_route_input(struct sk_buff *skb);
-struct dst_entry *ip6_route_output(struct net *net, const struct sock *sk,
- struct flowi6 *fl6);
+struct dst_entry *ip6_route_output_flags(struct net *net, const struct sock *sk,
+ struct flowi6 *fl6, int flags);
+
+static inline struct dst_entry *ip6_route_output(struct net *net,
+ const struct sock *sk,
+ struct flowi6 *fl6)
+{
+ return ip6_route_output_flags(net, sk, fl6, 0);
+}
+
struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
int flags);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 18382b0..8a94048 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -890,6 +890,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
struct rt6_info *rt;
#endif
int err;
+ int flags = 0;
/* The correct way to handle this would be to do
* ip6_route_get_saddr, and then ip6_route_output; however,
@@ -921,10 +922,13 @@ static int ip6_dst_lookup_tail(struct sock *sk,
dst_release(*dst);
*dst = NULL;
}
+
+ if (fl6->flowi6_oif)
+ flags |= RT6_LOOKUP_F_IFACE;
}
if (!*dst)
- *dst = ip6_route_output(net, sk, fl6);
+ *dst = ip6_route_output_flags(net, sk, fl6, flags);
err = (*dst)->error;
if (err)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8478719..e36b7fe 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1181,11 +1181,9 @@ static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table
return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
}
-struct dst_entry *ip6_route_output(struct net *net, const struct sock *sk,
- struct flowi6 *fl6)
+struct dst_entry *ip6_route_output_flags(struct net *net, const struct sock *sk,
+ struct flowi6 *fl6, int flags)
{
- int flags = 0;
-
fl6->flowi6_iif = LOOPBACK_IFINDEX;
if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
@@ -1198,7 +1196,7 @@ struct dst_entry *ip6_route_output(struct net *net, const struct sock *sk,
return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_output);
}
-EXPORT_SYMBOL(ip6_route_output);
+EXPORT_SYMBOL_GPL(ip6_route_output_flags);
struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
{
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 227/273] tcp: beware of alignments in tcp_get_info() |
| Message-ID | <racBu-YH-65@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit ff5d749772018602c47509bdc0093ff72acd82ec ]
With some combinations of user provided flags in netlink command,
it is possible to call tcp_get_info() with a buffer that is not 8-bytes
aligned.
It does matter on some arches, so we need to use put_unaligned() to
store the u64 fields.
Current iproute2 package does not trigger this particular issue.
Fixes: 0df48c26d841 ("tcp: add tcpi_bytes_acked to tcp_info")
Fixes: 977cb0ecf82e ("tcp: add pacing_rate information into tcp_info")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv4/tcp.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 45534a5..a7b4cf6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -279,6 +279,7 @@
#include <asm/uaccess.h>
#include <asm/ioctls.h>
+#include <asm/unaligned.h>
#include <net/busy_poll.h>
int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
@@ -2634,6 +2635,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
const struct inet_connection_sock *icsk = inet_csk(sk);
u32 now = tcp_time_stamp;
unsigned int start;
+ u64 rate64;
u32 rate;
memset(info, 0, sizeof(*info));
@@ -2698,15 +2700,17 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
info->tcpi_total_retrans = tp->total_retrans;
rate = READ_ONCE(sk->sk_pacing_rate);
- info->tcpi_pacing_rate = rate != ~0U ? rate : ~0ULL;
+ rate64 = rate != ~0U ? rate : ~0ULL;
+ put_unaligned(rate64, &info->tcpi_pacing_rate);
rate = READ_ONCE(sk->sk_max_pacing_rate);
- info->tcpi_max_pacing_rate = rate != ~0U ? rate : ~0ULL;
+ rate64 = rate != ~0U ? rate : ~0ULL;
+ put_unaligned(rate64, &info->tcpi_max_pacing_rate);
do {
start = u64_stats_fetch_begin_irq(&tp->syncp);
- info->tcpi_bytes_acked = tp->bytes_acked;
- info->tcpi_bytes_received = tp->bytes_received;
+ put_unaligned(tp->bytes_acked, &info->tcpi_bytes_acked);
+ put_unaligned(tp->bytes_received, &info->tcpi_bytes_received);
} while (u64_stats_fetch_retry_irq(&tp->syncp, start));
info->tcpi_segs_out = tp->segs_out;
info->tcpi_segs_in = tp->segs_in;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 229/273] ipv6/udp: use sticky pktinfo egress ifindex on connect() |
| Message-ID | <racBu-YH-75@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Paolo Abeni <pabeni@redhat.com> [ Upstream commit 1cdda91871470f15e79375991bd2eddc6e86ddb1 ] Currently, the egress interface index specified via IPV6_PKTINFO is ignored by __ip6_datagram_connect(), so that RFC 3542 section 6.7 can be subverted when the user space application calls connect() before sendmsg(). Fix it by initializing properly flowi6_oif in connect() before performing the route lookup. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- net/ipv6/datagram.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index 13ca4cf..8e6cb3f 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -162,6 +162,9 @@ ipv4_connected: fl6.fl6_dport = inet->inet_dport; fl6.fl6_sport = inet->inet_sport; + if (!fl6.flowi6_oif) + fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex; + if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST)) fl6.flowi6_oif = np->mcast_oif; -- 2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 219/273] af_iucv: Validate socket address length in iucv_sock_bind() |
| Message-ID | <racBu-YH-77@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ursula Braun <ursula.braun@de.ibm.com>
[ Upstream commit 52a82e23b9f2a9e1d429c5207f8575784290d008 ]
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Evgeny Cherkashin <Eugene.Crosser@ru.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/iucv/af_iucv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 918151c..3a743d8e 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -709,6 +709,9 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
if (!addr || addr->sa_family != AF_IUCV)
return -EINVAL;
+ if (addr_len < sizeof(struct sockaddr_iucv))
+ return -EINVAL;
+
lock_sock(sk);
if (sk->sk_state != IUCV_OPEN) {
err = -EBADFD;
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 226/273] switchdev: Require RTNL mutex to be held when sending FDB notifications |
| Message-ID | <racBv-YH-83@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ido Schimmel <idosch@mellanox.com>
[ Upstream commit 4f2c6ae5c64c353fb1b0425e4747e5603feadba1 ]
When switchdev drivers process FDB notifications from the underlying
device they resolve the netdev to which the entry points to and notify
the bridge using the switchdev notifier.
However, since the RTNL mutex is not held there is nothing preventing
the netdev from disappearing in the middle, which will cause
br_switchdev_event() to dereference a non-existing netdev.
Make switchdev drivers hold the lock at the beginning of the
notification processing session and release it once it ends, after
notifying the bridge.
Also, remove switchdev_mutex and fdb_lock, as they are no longer needed
when RTNL mutex is held.
Fixes: 03bf0c281234 ("switchdev: introduce switchdev notifier")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/ethernet/rocker/rocker.c | 2 ++
net/bridge/br.c | 3 +--
net/switchdev/switchdev.c | 15 ++++++++-------
3 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
index 2e7f9a2..348f047 100644
--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -3493,12 +3493,14 @@ static void rocker_port_fdb_learn_work(struct work_struct *work)
info.addr = lw->addr;
info.vid = lw->vid;
+ rtnl_lock();
if (learned && removing)
call_switchdev_notifiers(SWITCHDEV_FDB_DEL,
lw->rocker_port->dev, &info.info);
else if (learned && !removing)
call_switchdev_notifiers(SWITCHDEV_FDB_ADD,
lw->rocker_port->dev, &info.info);
+ rtnl_unlock();
rocker_port_kfree(lw->trans, work);
}
diff --git a/net/bridge/br.c b/net/bridge/br.c
index a1abe49..3addc05 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -121,6 +121,7 @@ static struct notifier_block br_device_notifier = {
.notifier_call = br_device_event
};
+/* called with RTNL */
static int br_switchdev_event(struct notifier_block *unused,
unsigned long event, void *ptr)
{
@@ -130,7 +131,6 @@ static int br_switchdev_event(struct notifier_block *unused,
struct switchdev_notifier_fdb_info *fdb_info;
int err = NOTIFY_DONE;
- rtnl_lock();
p = br_port_get_rtnl(dev);
if (!p)
goto out;
@@ -155,7 +155,6 @@ static int br_switchdev_event(struct notifier_block *unused,
}
out:
- rtnl_unlock();
return err;
}
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 9f2add3..69bd2b7 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -16,6 +16,7 @@
#include <linux/notifier.h>
#include <linux/netdevice.h>
#include <linux/if_bridge.h>
+#include <linux/rtnetlink.h>
#include <net/ip_fib.h>
#include <net/switchdev.h>
@@ -333,7 +334,6 @@ int switchdev_port_obj_dump(struct net_device *dev, struct switchdev_obj *obj)
}
EXPORT_SYMBOL_GPL(switchdev_port_obj_dump);
-static DEFINE_MUTEX(switchdev_mutex);
static RAW_NOTIFIER_HEAD(switchdev_notif_chain);
/**
@@ -348,9 +348,9 @@ int register_switchdev_notifier(struct notifier_block *nb)
{
int err;
- mutex_lock(&switchdev_mutex);
+ rtnl_lock();
err = raw_notifier_chain_register(&switchdev_notif_chain, nb);
- mutex_unlock(&switchdev_mutex);
+ rtnl_unlock();
return err;
}
EXPORT_SYMBOL_GPL(register_switchdev_notifier);
@@ -366,9 +366,9 @@ int unregister_switchdev_notifier(struct notifier_block *nb)
{
int err;
- mutex_lock(&switchdev_mutex);
+ rtnl_lock();
err = raw_notifier_chain_unregister(&switchdev_notif_chain, nb);
- mutex_unlock(&switchdev_mutex);
+ rtnl_unlock();
return err;
}
EXPORT_SYMBOL_GPL(unregister_switchdev_notifier);
@@ -382,16 +382,17 @@ EXPORT_SYMBOL_GPL(unregister_switchdev_notifier);
* Call all network notifier blocks. This should be called by driver
* when it needs to propagate hardware event.
* Return values are same as for atomic_notifier_call_chain().
+ * rtnl_lock must be held.
*/
int call_switchdev_notifiers(unsigned long val, struct net_device *dev,
struct switchdev_notifier_info *info)
{
int err;
+ ASSERT_RTNL();
+
info->dev = dev;
- mutex_lock(&switchdev_mutex);
err = raw_notifier_call_chain(&switchdev_notif_chain, val, info);
- mutex_unlock(&switchdev_mutex);
return err;
}
EXPORT_SYMBOL_GPL(call_switchdev_notifiers);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 237/273] flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen |
| Message-ID | <racBu-YH-71@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Alexander Duyck <aduyck@mirantis.com>
[ Upstream commit 461547f3158978c180d74484d58e82be9b8e7357, since
we lack the flow dissector flags in this release we guard the
flow label access using a test on 'skb' being NULL ]
This patch fixes an issue with unaligned accesses when using
eth_get_headlen on a page that was DMA aligned instead of being IP aligned.
The fact is when trying to check the length we don't need to be looking at
the flow label so we can reorder the checks to first check if we are
supposed to gather the flow label and then make the call to actually get
it.
v2: Updated path so that either STOP_AT_FLOW_LABEL or KEY_FLOW_LABEL can
cause us to check for the flow label.
Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Alexander Duyck <aduyck@mirantis.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/core/flow_dissector.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 2a834c6..bb98f8b 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -192,7 +192,6 @@ ip:
case htons(ETH_P_IPV6): {
const struct ipv6hdr *iph;
struct ipv6hdr _iph;
- __be32 flow_label;
ipv6:
iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
@@ -214,8 +213,9 @@ ipv6:
key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
}
- flow_label = ip6_flowlabel(iph);
- if (flow_label) {
+ if (skb && ip6_flowlabel(iph)) {
+ __be32 flow_label = ip6_flowlabel(iph);
+
if (skb_flow_dissector_uses_key(flow_dissector,
FLOW_DISSECTOR_KEY_FLOW_LABEL)) {
key_tags = skb_flow_dissector_target(flow_dissector,
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 171/273] x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable |
| Message-ID | <racBv-YH-87@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Toshi Kani <toshi.kani@hpe.com>
commit ee9737c924706aaa72c2ead93e3ad5644681dc1c upstream.
Add comments to __copy_user_nocache() to clarify its procedures
and alignment requirements.
Also change numeric branch target labels to named local labels.
No code changed:
arch/x86/lib/copy_user_64.o:
text data bss dec hex filename
1239 0 0 1239 4d7 copy_user_64.o.before
1239 0 0 1239 4d7 copy_user_64.o.after
md5:
58bed94c2db98c1ca9a2d46d0680aaae copy_user_64.o.before.asm
58bed94c2db98c1ca9a2d46d0680aaae copy_user_64.o.after.asm
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Luis R. Rodriguez <mcgrof@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: brian.boylston@hpe.com
Cc: dan.j.williams@intel.com
Cc: linux-nvdimm@lists.01.org
Cc: micah.parrish@hpe.com
Cc: ross.zwisler@linux.intel.com
Cc: vishal.l.verma@intel.com
Link: http://lkml.kernel.org/r/1455225857-12039-2-git-send-email-toshi.kani@hpe.com
[ Small readability edits and added object file comparison. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/lib/copy_user_64.S | 114 ++++++++++++++++++++++++++++----------------
1 file changed, 73 insertions(+), 41 deletions(-)
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index 982ce34..a644aad 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -232,17 +232,30 @@ ENDPROC(copy_user_enhanced_fast_string)
/*
* copy_user_nocache - Uncached memory copy with exception handling
- * This will force destination/source out of cache for more performance.
+ * This will force destination out of cache for more performance.
+ *
+ * Note: Cached memory copy is used when destination or size is not
+ * naturally aligned. That is:
+ * - Require 8-byte alignment when size is 8 bytes or larger.
*/
ENTRY(__copy_user_nocache)
ASM_STAC
+
+ /* If size is less than 8 bytes, go to byte copy */
cmpl $8,%edx
- jb 20f /* less then 8 bytes, go to byte copy loop */
+ jb .L_1b_cache_copy_entry
+
+ /* If destination is not 8-byte aligned, "cache" copy to align it */
ALIGN_DESTINATION
+
+ /* Set 4x8-byte copy count and remainder */
movl %edx,%ecx
andl $63,%edx
shrl $6,%ecx
- jz 17f
+ jz .L_8b_nocache_copy_entry /* jump if count is 0 */
+
+ /* Perform 4x8-byte nocache loop-copy */
+.L_4x8b_nocache_copy_loop:
1: movq (%rsi),%r8
2: movq 1*8(%rsi),%r9
3: movq 2*8(%rsi),%r10
@@ -262,60 +275,79 @@ ENTRY(__copy_user_nocache)
leaq 64(%rsi),%rsi
leaq 64(%rdi),%rdi
decl %ecx
- jnz 1b
-17: movl %edx,%ecx
+ jnz .L_4x8b_nocache_copy_loop
+
+ /* Set 8-byte copy count and remainder */
+.L_8b_nocache_copy_entry:
+ movl %edx,%ecx
andl $7,%edx
shrl $3,%ecx
- jz 20f
-18: movq (%rsi),%r8
-19: movnti %r8,(%rdi)
+ jz .L_1b_cache_copy_entry /* jump if count is 0 */
+
+ /* Perform 8-byte nocache loop-copy */
+.L_8b_nocache_copy_loop:
+20: movq (%rsi),%r8
+21: movnti %r8,(%rdi)
leaq 8(%rsi),%rsi
leaq 8(%rdi),%rdi
decl %ecx
- jnz 18b
-20: andl %edx,%edx
- jz 23f
+ jnz .L_8b_nocache_copy_loop
+
+ /* If no byte left, we're done */
+.L_1b_cache_copy_entry:
+ andl %edx,%edx
+ jz .L_finish_copy
+
+ /* Perform byte "cache" loop-copy for the remainder */
movl %edx,%ecx
-21: movb (%rsi),%al
-22: movb %al,(%rdi)
+.L_1b_cache_copy_loop:
+40: movb (%rsi),%al
+41: movb %al,(%rdi)
incq %rsi
incq %rdi
decl %ecx
- jnz 21b
-23: xorl %eax,%eax
+ jnz .L_1b_cache_copy_loop
+
+ /* Finished copying; fence the prior stores */
+.L_finish_copy:
+ xorl %eax,%eax
ASM_CLAC
sfence
ret
.section .fixup,"ax"
-30: shll $6,%ecx
+.L_fixup_4x8b_copy:
+ shll $6,%ecx
addl %ecx,%edx
- jmp 60f
-40: lea (%rdx,%rcx,8),%rdx
- jmp 60f
-50: movl %ecx,%edx
-60: sfence
+ jmp .L_fixup_handle_tail
+.L_fixup_8b_copy:
+ lea (%rdx,%rcx,8),%rdx
+ jmp .L_fixup_handle_tail
+.L_fixup_1b_copy:
+ movl %ecx,%edx
+.L_fixup_handle_tail:
+ sfence
jmp copy_user_handle_tail
.previous
- _ASM_EXTABLE(1b,30b)
- _ASM_EXTABLE(2b,30b)
- _ASM_EXTABLE(3b,30b)
- _ASM_EXTABLE(4b,30b)
- _ASM_EXTABLE(5b,30b)
- _ASM_EXTABLE(6b,30b)
- _ASM_EXTABLE(7b,30b)
- _ASM_EXTABLE(8b,30b)
- _ASM_EXTABLE(9b,30b)
- _ASM_EXTABLE(10b,30b)
- _ASM_EXTABLE(11b,30b)
- _ASM_EXTABLE(12b,30b)
- _ASM_EXTABLE(13b,30b)
- _ASM_EXTABLE(14b,30b)
- _ASM_EXTABLE(15b,30b)
- _ASM_EXTABLE(16b,30b)
- _ASM_EXTABLE(18b,40b)
- _ASM_EXTABLE(19b,40b)
- _ASM_EXTABLE(21b,50b)
- _ASM_EXTABLE(22b,50b)
+ _ASM_EXTABLE(1b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(2b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(3b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(4b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(5b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(6b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(7b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(8b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(9b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(10b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(11b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(12b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(13b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(14b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(15b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(16b,.L_fixup_4x8b_copy)
+ _ASM_EXTABLE(20b,.L_fixup_8b_copy)
+ _ASM_EXTABLE(21b,.L_fixup_8b_copy)
+ _ASM_EXTABLE(40b,.L_fixup_1b_copy)
+ _ASM_EXTABLE(41b,.L_fixup_1b_copy)
ENDPROC(__copy_user_nocache)
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 233/273] unix: correctly track in-flight fds in sending process user_struct |
| Message-ID | <racBv-YH-89@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
[ Upstream commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 ]
The commit referenced in the Fixes tag incorrectly accounted the number
of in-flight fds over a unix domain socket to the original opener
of the file-descriptor. This allows another process to arbitrary
deplete the original file-openers resource limit for the maximum of
open files. Instead the sending processes and its struct cred should
be credited.
To do so, we add a reference counted struct user_struct pointer to the
scm_fp_list and use it to account for the number of inflight unix fds.
Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets")
Reported-by: David Herrmann <dh.herrmann@gmail.com>
Cc: David Herrmann <dh.herrmann@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/net/af_unix.h | 4 ++--
include/net/scm.h | 1 +
net/core/scm.c | 7 +++++++
net/unix/af_unix.c | 4 ++--
net/unix/garbage.c | 8 ++++----
5 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 49c7683..cdb0a93 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -6,8 +6,8 @@
#include <linux/mutex.h>
#include <net/sock.h>
-void unix_inflight(struct file *fp);
-void unix_notinflight(struct file *fp);
+void unix_inflight(struct user_struct *user, struct file *fp);
+void unix_notinflight(struct user_struct *user, struct file *fp);
void unix_gc(void);
void wait_for_unix_gc(void);
struct sock *unix_get_socket(struct file *filp);
diff --git a/include/net/scm.h b/include/net/scm.h
index 262532d..59fa93c 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -21,6 +21,7 @@ struct scm_creds {
struct scm_fp_list {
short count;
short max;
+ struct user_struct *user;
struct file *fp[SCM_MAX_FD];
};
diff --git a/net/core/scm.c b/net/core/scm.c
index 8a1741b..dce0acb 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
*fplp = fpl;
fpl->count = 0;
fpl->max = SCM_MAX_FD;
+ fpl->user = NULL;
}
fpp = &fpl->fp[fpl->count];
@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
*fpp++ = file;
fpl->count++;
}
+
+ if (!fpl->user)
+ fpl->user = get_uid(current_user());
+
return num;
}
@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm)
scm->fp = NULL;
for (i=fpl->count-1; i>=0; i--)
fput(fpl->fp[i]);
+ free_uid(fpl->user);
kfree(fpl);
}
}
@@ -336,6 +342,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
for (i = 0; i < fpl->count; i++)
get_file(fpl->fp[i]);
new_fpl->max = new_fpl->count;
+ new_fpl->user = get_uid(fpl->user);
}
return new_fpl;
}
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7f4cc3e..7c29ec3 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1495,7 +1495,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
UNIXCB(skb).fp = NULL;
for (i = scm->fp->count-1; i >= 0; i--)
- unix_notinflight(scm->fp->fp[i]);
+ unix_notinflight(scm->fp->user, scm->fp->fp[i]);
}
static void unix_destruct_scm(struct sk_buff *skb)
@@ -1560,7 +1560,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
return -ENOMEM;
for (i = scm->fp->count - 1; i >= 0; i--)
- unix_inflight(scm->fp->fp[i]);
+ unix_inflight(scm->fp->user, scm->fp->fp[i]);
return max_level;
}
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 8fcdc22..6a0d485 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -116,7 +116,7 @@ struct sock *unix_get_socket(struct file *filp)
* descriptor if it is for an AF_UNIX socket.
*/
-void unix_inflight(struct file *fp)
+void unix_inflight(struct user_struct *user, struct file *fp)
{
struct sock *s = unix_get_socket(fp);
@@ -133,11 +133,11 @@ void unix_inflight(struct file *fp)
}
unix_tot_inflight++;
}
- fp->f_cred->user->unix_inflight++;
+ user->unix_inflight++;
spin_unlock(&unix_gc_lock);
}
-void unix_notinflight(struct file *fp)
+void unix_notinflight(struct user_struct *user, struct file *fp)
{
struct sock *s = unix_get_socket(fp);
@@ -152,7 +152,7 @@ void unix_notinflight(struct file *fp)
list_del_init(&u->link);
unix_tot_inflight--;
}
- fp->f_cred->user->unix_inflight--;
+ user->unix_inflight--;
spin_unlock(&unix_gc_lock);
}
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 230/273] net/ipv6: add sysctl option accept_ra_min_hop_limit |
| Message-ID | <racBv-YH-91@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 ]
Commit 6fd99094de2b ("ipv6: Don't reduce hop limit for an interface")
disabled accept hop limit from RA if it is smaller than the current hop
limit for security stuff. But this behavior kind of break the RFC definition.
RFC 4861, 6.3.4. Processing Received Router Advertisements
A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time,
and Retrans Timer) may contain a value denoting that it is
unspecified. In such cases, the parameter should be ignored and the
host should continue using whatever value it is already using.
If the received Cur Hop Limit value is non-zero, the host SHOULD set
its CurHopLimit variable to the received value.
So add sysctl option accept_ra_min_hop_limit to let user choose the minimum
hop limit value they can accept from RA. And set default to 1 to meet RFC
standards.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: YOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
Documentation/networking/ip-sysctl.txt | 8 ++++++++
include/linux/ipv6.h | 1 +
include/uapi/linux/ipv6.h | 2 ++
net/ipv6/addrconf.c | 10 ++++++++++
net/ipv6/ndisc.c | 16 +++++++---------
5 files changed, 28 insertions(+), 9 deletions(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 5fae770..5d16013 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1340,6 +1340,14 @@ accept_ra_from_local - BOOLEAN
disabled if accept_ra_from_local is disabled
on a specific interface.
+accept_ra_min_hop_limit - INTEGER
+ Minimum hop limit Information in Router Advertisement.
+
+ Hop limit Information in Router Advertisement less than this
+ variable shall be ignored.
+
+ Default: 1
+
accept_ra_pinfo - BOOLEAN
Learn Prefix Information in Router Advertisement.
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index e4b4649..01c2592 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -29,6 +29,7 @@ struct ipv6_devconf {
__s32 max_desync_factor;
__s32 max_addresses;
__s32 accept_ra_defrtr;
+ __s32 accept_ra_min_hop_limit;
__s32 accept_ra_pinfo;
#ifdef CONFIG_IPV6_ROUTER_PREF
__s32 accept_ra_rtr_pref;
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 5efa54a..80f3b74 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -171,6 +171,8 @@ enum {
DEVCONF_USE_OPTIMISTIC,
DEVCONF_ACCEPT_RA_MTU,
DEVCONF_STABLE_SECRET,
+ DEVCONF_USE_OIF_ADDRS_ONLY,
+ DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
DEVCONF_MAX
};
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d956e30..54fb696 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -195,6 +195,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
.max_addresses = IPV6_MAX_ADDRESSES,
.accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
+ .accept_ra_min_hop_limit= 1,
.accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1,
@@ -236,6 +237,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
.max_addresses = IPV6_MAX_ADDRESSES,
.accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
+ .accept_ra_min_hop_limit= 1,
.accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1,
@@ -4567,6 +4569,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
+ array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
#ifdef CONFIG_IPV6_ROUTER_PREF
array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
@@ -5460,6 +5463,13 @@ static struct addrconf_sysctl_table
.proc_handler = proc_dointvec,
},
{
+ .procname = "accept_ra_min_hop_limit",
+ .data = &ipv6_devconf.accept_ra_min_hop_limit,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ {
.procname = "accept_ra_pinfo",
.data = &ipv6_devconf.accept_ra_pinfo,
.maxlen = sizeof(int),
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index c53331c..b305461 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1225,18 +1225,16 @@ static void ndisc_router_discovery(struct sk_buff *skb)
if (rt)
rt6_set_expires(rt, jiffies + (HZ * lifetime));
- if (ra_msg->icmph.icmp6_hop_limit) {
- /* Only set hop_limit on the interface if it is higher than
- * the current hop_limit.
- */
- if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+ if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
+ ra_msg->icmph.icmp6_hop_limit) {
+ if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+ if (rt)
+ dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+ ra_msg->icmph.icmp6_hop_limit);
} else {
- ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
}
- if (rt)
- dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
- ra_msg->icmph.icmp6_hop_limit);
}
skip_defrtr:
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:30 +0100 |
| Subject | [PATCH 4.2.y-ckt 190/273] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE |
| Message-ID | <racL8-13y-9@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Lisa Du <cldu@marvell.com>
commit 7a64cd887fdb97f074c3fda03bee0bfb9faceac3 upstream.
There's one point was missed in the patch commit da49889deb34 ("staging:
binder: Support concurrent 32 bit and 64 bit processes."). When configure
BINDER_IPC_32BIT, the size of binder_uintptr_t was 32bits, but size of
void * is 64bit on 64bit system. Correct it here.
Signed-off-by: Lisa Du <cldu@marvell.com>
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Fixes: da49889deb34 ("staging: binder: Support concurrent 32 bit and 64 bit processes.")
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/android/binder.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 6607f3c..f1a26d9 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2074,7 +2074,7 @@ static int binder_thread_write(struct binder_proc *proc,
if (get_user(cookie, (binder_uintptr_t __user *)ptr))
return -EFAULT;
- ptr += sizeof(void *);
+ ptr += sizeof(cookie);
list_for_each_entry(w, &proc->delivered_death, entry) {
struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-03-08 00:30 +0100 |
| Subject | [PATCH 4.2.y-ckt 215/273] do_last(): don't let a bogus return value from ->open() et.al. to confuse us |
| Message-ID | <racL8-13y-11@gated-at.bofh.it> |
| In reply to | #1352081 |
4.2.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit c80567c82ae4814a41287618e315a60ecf513be6 upstream.
... into returning a positive to path_openat(), which would interpret that
as "symlink had been encountered" and proceed to corrupt memory, etc.
It can only happen due to a bug in some ->open() instance or in some LSM
hook, etc., so we report any such event *and* make sure it doesn't trick
us into further unpleasantness.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/namei.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/namei.c b/fs/namei.c
index f39a798..3500b12 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3213,6 +3213,10 @@ opened:
goto exit_fput;
}
out:
+ if (unlikely(error > 0)) {
+ WARN_ON(1);
+ error = -EINVAL;
+ }
if (got_write)
mnt_drop_write(nd->path.mnt);
path_put(&save_parent);
--
2.7.0
[toc] | [prev] | [next] | [standalone]
Page 3 of 12 — ← Prev page 1 2 [3] 4 5 … 12 Next page →
Back to top | Article view | linux.kernel
csiph-web