Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1633993 > unrolled thread

[PATCH 4.9 00/54] 4.9.26-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2017-05-02 00:00 +0200
Last post2017-05-02 19:40 +0200
Articles 7 — 3 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 4.9 00/54] 4.9.26-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
    [PATCH 4.9 09/54] net/mlx5: Avoid dereferencing uninitialized pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
    [PATCH 4.9 35/54] tcp: memset ca_priv data to 0 properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
    [PATCH 4.9 34/54] ipv6: check skb->protocol before lookup for nexthop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
    [PATCH 4.9 32/54] net: ipv6: regenerate host route if moved to gc list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
    Re: [PATCH 4.9 00/54] 4.9.26-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-02 16:00 +0200
    Re: [PATCH 4.9 00/54] 4.9.26-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-02 19:40 +0200

#1633993 — [PATCH 4.9 00/54] 4.9.26-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-05-02 00:00 +0200
Subject[PATCH 4.9 00/54] 4.9.26-stable review
Message-ID<tCrcZ-5UI-9@gated-at.bofh.it>
This is the start of the stable review cycle for the 4.9.26 release.
There are 54 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed May  3 21:26:19 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.26-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.9.26-rc1

Josh Poimboeuf <jpoimboe@redhat.com>
    ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram

Vineet Gupta <vgupta@synopsys.com>
    ARCv2: save r30 on kernel entry as gcc uses it for code-gen

Maksim Salau <maksim.salau@gmail.com>
    net: can: usb: gs_usb: Fix buffer on stack

Jason A. Donenfeld <Jason@zx2c4.com>
    macsec: avoid heap overflow in skb_to_sgvec

Yan, Zheng <zyan@redhat.com>
    ceph: fix recursion between ceph_set_acl() and __ceph_setattr()

J. Bruce Fields <bfields@redhat.com>
    nfsd: stricter decoding of write-like NFSv2/v3 ops

J. Bruce Fields <bfields@redhat.com>
    nfsd4: minor NFSv2/v3 write decoding cleanup

J. Bruce Fields <bfields@redhat.com>
    nfsd: check for oversized NFSv2/v3 arguments

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: i8042 - add Clevo P650RS to the i8042 reset list

Takashi Iwai <tiwai@suse.de>
    ASoC: intel: Fix PM and non-atomic crash in bytcr drivers

Al Viro <viro@zeniv.linux.org.uk>
    p9_client_readdir() fix

James Cowgill <James.Cowgill@imgtec.com>
    MIPS: Avoid BUG warning in arch_check_elf

James Hogan <james.hogan@imgtec.com>
    MIPS: cevt-r4k: Fix out-of-bounds array access

James Hogan <james.hogan@imgtec.com>
    MIPS: KGDB: Use kernel context for sleeping threads

Noam Camus <noamca@mellanox.com>
    ARC: [plat-eznps] Fix build error

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Don't break snd_use_lock_sync() loop by timeout

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    ALSA: firewire-lib: fix inappropriate assignment between signed/unsigned type

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    ALSA: oxfw: fix regression to handle Stanton SCS.1m/1d

Jamie Bainbridge <jbainbri@redhat.com>
    ipv6: check raw payload size correctly in ioctl

Wei Wang <weiwan@google.com>
    tcp: memset ca_priv data to 0 properly

WANG Cong <xiyou.wangcong@gmail.com>
    ipv6: check skb->protocol before lookup for nexthop

Alexander Kochetkov <al.kochet@gmail.com>
    net: phy: fix auto-negotiation stall due to unavailable interrupt

David Ahern <dsa@cumulusnetworks.com>
    net: ipv6: regenerate host route if moved to gc list

Herbert Xu <herbert@gondor.apana.org.au>
    macvlan: Fix device ref leak when purging bc_queue

Ilan Tayari <ilant@mellanox.com>
    net/mlx5e: Fix ETHTOOL_GRXCLSRLALL handling

Eugenia Emantayev <eugenia@mellanox.com>
    net/mlx5e: Fix small packet threshold

Mohamad Haj Yahia <mohamad@mellanox.com>
    net/mlx5: Fix driver load bad flow when having fw initializing timeout

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    ip6mr: fix notification device destruction

Tushar Dave <tushar.n.dave@oracle.com>
    netpoll: Check for skb->queue_mapping

David Ahern <dsa@cumulusnetworks.com>
    net: ipv6: RTF_PCPU should not be settable from userspace

Ilan Tayari <ilant@mellanox.com>
    gso: Validate assumption of frag_list segementation

Dan Carpenter <dan.carpenter@oracle.com>
    dp83640: don't recieve time stamps twice

Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    sh_eth: unmap DMA buffers when freeing rings

David Ahern <dsa@cumulusnetworks.com>
    net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule

Willem de Bruijn <willemb@google.com>
    net-timestamp: avoid use-after-free in ip_recv_error

Rabin Vincent <rabinv@axis.com>
    ipv6: Fix idev->addr_list corruption

Eric Dumazet <edumazet@google.com>
    tcp: clear saved_syn in tcp_disconnect()

Xin Long <lucien.xin@gmail.com>
    sctp: listen on the sock only when it's state is listening or closed

Florian Larysch <fl@n621.de>
    net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given

Guillaume Nault <g.nault@alphalink.fr>
    l2tp: fix PPP pseudo-wire auto-loading

Guillaume Nault <g.nault@alphalink.fr>
    l2tp: take reference on sessions being dumped

Andrey Konovalov <andreyknvl@google.com>
    net/packet: fix overflow in check for tp_reserve

Andrey Konovalov <andreyknvl@google.com>
    net/packet: fix overflow in check for tp_frame_nr

Guillaume Nault <g.nault@alphalink.fr>
    l2tp: purge socket queues in the .destruct() callback

Guillaume Nault <g.nault@alphalink.fr>
    l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

Talat Batheesh <talatb@mellanox.com>
    net/mlx5: Avoid dereferencing uninitialized pointer

Alexei Starovoitov <ast@fb.com>
    bpf: improve verifier packet range checks

WANG Cong <xiyou.wangcong@gmail.com>
    kcm: return immediately after copy_from_user() failure

Nathan Sullivan <nathan.sullivan@ni.com>
    net: phy: handle state correctly in phy_stop_machine

Eric Dumazet <edumazet@google.com>
    net: neigh: guard against NULL solicit() method

Tom Hromatka <tom.hromatka@oracle.com>
    sparc64: Fix kernel panic due to erroneous #ifdef surrounding pmd_write()

bob picco <bob.picco@oracle.com>
    sparc64: kern_addr_valid regression

Eric Dumazet <edumazet@google.com>
    ping: implement proper locking

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Revert "mmc: sdhci-msm: Enable few quirks"


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arc/include/asm/atomic.h                      |   3 +-
 arch/arc/include/asm/entry-arcv2.h                 |   2 +
 arch/arc/include/asm/ptrace.h                      |   2 +-
 arch/mips/kernel/cevt-r4k.c                        |   2 +-
 arch/mips/kernel/elf.c                             |   2 +-
 arch/mips/kernel/kgdb.c                            |  48 +++++---
 arch/sparc/include/asm/pgtable_64.h                |  15 +--
 arch/sparc/mm/init_64.c                            |   2 +-
 arch/x86/kernel/ftrace.c                           |  12 ++
 drivers/input/serio/i8042-x86ia64io.h              |   7 ++
 drivers/mmc/host/sdhci-msm.c                       |   4 +-
 drivers/net/can/usb/gs_usb.c                       |  17 ++-
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |   2 +-
 .../ethernet/mellanox/mlx5/core/en_fs_ethtool.c    |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/lag.c      |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   2 +-
 drivers/net/ethernet/renesas/sh_eth.c              | 122 +++++++++++----------
 drivers/net/macsec.c                               |   2 +-
 drivers/net/macvlan.c                              |  11 +-
 drivers/net/phy/dp83640.c                          |   2 -
 drivers/net/phy/phy.c                              |  42 ++++++-
 drivers/net/vrf.c                                  |   2 +-
 fs/ceph/inode.c                                    |  22 ++--
 fs/nfsd/nfs3xdr.c                                  |  13 ++-
 fs/nfsd/nfssvc.c                                   |  36 ++++++
 fs/nfsd/nfsxdr.c                                   |  10 +-
 include/linux/phy.h                                |   1 +
 include/uapi/linux/ipv6_route.h                    |   2 +-
 kernel/bpf/verifier.c                              |   5 +-
 net/9p/client.c                                    |   4 +
 net/core/neighbour.c                               |   3 +-
 net/core/netpoll.c                                 |  10 +-
 net/core/skbuff.c                                  |  19 +++-
 net/ipv4/ip_sockglue.c                             |   9 +-
 net/ipv4/ping.c                                    |   5 +-
 net/ipv4/route.c                                   |   2 +-
 net/ipv4/tcp.c                                     |   1 +
 net/ipv4/tcp_cong.c                                |  11 +-
 net/ipv6/addrconf.c                                |  25 ++++-
 net/ipv6/datagram.c                                |  10 +-
 net/ipv6/ip6_tunnel.c                              |  34 +++---
 net/ipv6/ip6mr.c                                   |  13 +--
 net/ipv6/raw.c                                     |   3 +-
 net/ipv6/route.c                                   |   4 +
 net/kcm/kcmsock.c                                  |   6 +-
 net/l2tp/l2tp_core.c                               |   8 +-
 net/l2tp/l2tp_core.h                               |   3 +-
 net/l2tp/l2tp_debugfs.c                            |  10 +-
 net/l2tp/l2tp_ip.c                                 |   5 +-
 net/l2tp/l2tp_ip6.c                                |   5 +-
 net/l2tp/l2tp_netlink.c                            |   7 +-
 net/l2tp/l2tp_ppp.c                                |  19 ++--
 net/packet/af_packet.c                             |   4 +
 net/sctp/socket.c                                  |   3 +
 sound/core/seq/seq_lock.c                          |   9 +-
 sound/firewire/lib.h                               |   2 +-
 sound/firewire/oxfw/oxfw.c                         |   4 +-
 sound/soc/intel/boards/bytcr_rt5640.c              |   4 +-
 sound/soc/intel/boards/bytcr_rt5651.c              |   2 -
 60 files changed, 417 insertions(+), 227 deletions(-)

[toc] | [next] | [standalone]


#1633994 — [PATCH 4.9 09/54] net/mlx5: Avoid dereferencing uninitialized pointer

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-05-02 00:00 +0200
Subject[PATCH 4.9 09/54] net/mlx5: Avoid dereferencing uninitialized pointer
Message-ID<tCrwn-626-63@gated-at.bofh.it>
In reply to#1633993
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Talat Batheesh <talatb@mellanox.com>


[ Upstream commit e497ec680c4cd51e76bfcdd49363d9ab8d32a757 ]

In NETDEV_CHANGEUPPER event the upper_info field is valid
only when linking is true. Otherwise it should be ignored.

Fixes: 7907f23adc18 (net/mlx5: Implement RoCE LAG feature)
Signed-off-by: Talat Batheesh <talatb@mellanox.com>
Reviewed-by: Aviv Heller <avivh@mellanox.com>
Reviewed-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/lag.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -294,7 +294,7 @@ static int mlx5_handle_changeupper_event
 					 struct netdev_notifier_changeupper_info *info)
 {
 	struct net_device *upper = info->upper_dev, *ndev_tmp;
-	struct netdev_lag_upper_info *lag_upper_info;
+	struct netdev_lag_upper_info *lag_upper_info = NULL;
 	bool is_bonded;
 	int bond_status = 0;
 	int num_slaves = 0;
@@ -303,7 +303,8 @@ static int mlx5_handle_changeupper_event
 	if (!netif_is_lag_master(upper))
 		return 0;
 
-	lag_upper_info = info->upper_info;
+	if (info->linking)
+		lag_upper_info = info->upper_info;
 
 	/* The event may still be of interest if the slave does not belong to
 	 * us, but is enslaved to a master which has one or more of our netdevs

[toc] | [prev] | [next] | [standalone]


#1633995 — [PATCH 4.9 35/54] tcp: memset ca_priv data to 0 properly

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-05-02 00:00 +0200
Subject[PATCH 4.9 35/54] tcp: memset ca_priv data to 0 properly
Message-ID<tCrwn-626-61@gated-at.bofh.it>
In reply to#1633993
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Wang <weiwan@google.com>


[ Upstream commit c1201444075009507a6818de6518e2822b9a87c8 ]

Always zero out ca_priv data in tcp_assign_congestion_control() so that
ca_priv data is cleared out during socket creation.
Also always zero out ca_priv data in tcp_reinit_congestion_control() so
that when cc algorithm is changed, ca_priv data is cleared out as well.
We should still zero out ca_priv data even in TCP_CLOSE state because
user could call connect() on AF_UNSPEC to disconnect the socket and
leave it in TCP_CLOSE state and later call setsockopt() to switch cc
algorithm on this socket.

Fixes: 2b0a8c9ee ("tcp: add CDG congestion control")
Reported-by: Andrey Konovalov  <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_cong.c |   11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -167,12 +167,8 @@ void tcp_assign_congestion_control(struc
 	}
 out:
 	rcu_read_unlock();
+	memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
 
-	/* Clear out private data before diag gets it and
-	 * the ca has not been initialized.
-	 */
-	if (ca->get_info)
-		memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
 	if (ca->flags & TCP_CONG_NEEDS_ECN)
 		INET_ECN_xmit(sk);
 	else
@@ -199,11 +195,10 @@ static void tcp_reinit_congestion_contro
 	tcp_cleanup_congestion_control(sk);
 	icsk->icsk_ca_ops = ca;
 	icsk->icsk_ca_setsockopt = 1;
+	memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
 
-	if (sk->sk_state != TCP_CLOSE) {
-		memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+	if (sk->sk_state != TCP_CLOSE)
 		tcp_init_congestion_control(sk);
-	}
 }
 
 /* Manage refcounts on socket close. */

[toc] | [prev] | [next] | [standalone]


#1633996 — [PATCH 4.9 34/54] ipv6: check skb->protocol before lookup for nexthop

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-05-02 00:00 +0200
Subject[PATCH 4.9 34/54] ipv6: check skb->protocol before lookup for nexthop
Message-ID<tCrwo-626-65@gated-at.bofh.it>
In reply to#1633993
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: WANG Cong <xiyou.wangcong@gmail.com>


[ Upstream commit 199ab00f3cdb6f154ea93fa76fd80192861a821d ]

Andrey reported a out-of-bound access in ip6_tnl_xmit(), this
is because we use an ipv4 dst in ip6_tnl_xmit() and cast an IPv4
neigh key as an IPv6 address:

        neigh = dst_neigh_lookup(skb_dst(skb),
                                 &ipv6_hdr(skb)->daddr);
        if (!neigh)
                goto tx_err_link_failure;

        addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE
        addr_type = ipv6_addr_type(addr6);

        if (addr_type == IPV6_ADDR_ANY)
                addr6 = &ipv6_hdr(skb)->daddr;

        memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));

Also the network header of the skb at this point should be still IPv4
for 4in6 tunnels, we shold not just use it as IPv6 header.

This patch fixes it by checking if skb->protocol is ETH_P_IPV6: if it
is, we are safe to do the nexthop lookup using skb_dst() and
ipv6_hdr(skb)->daddr; if not (aka IPv4), we have no clue about which
dest address we can pick here, we have to rely on callers to fill it
from tunnel config, so just fall to ip6_route_output() to make the
decision.

Fixes: ea3dc9601bda ("ip6_tunnel: Add support for wildcard tunnel endpoints.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_tunnel.c |   44 +++++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 21 deletions(-)

--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1037,7 +1037,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, st
 	struct ip6_tnl *t = netdev_priv(dev);
 	struct net *net = t->net;
 	struct net_device_stats *stats = &t->dev->stats;
-	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+	struct ipv6hdr *ipv6h;
 	struct ipv6_tel_txoption opt;
 	struct dst_entry *dst = NULL, *ndst = NULL;
 	struct net_device *tdev;
@@ -1057,26 +1057,28 @@ int ip6_tnl_xmit(struct sk_buff *skb, st
 
 	/* NBMA tunnel */
 	if (ipv6_addr_any(&t->parms.raddr)) {
-		struct in6_addr *addr6;
-		struct neighbour *neigh;
-		int addr_type;
-
-		if (!skb_dst(skb))
-			goto tx_err_link_failure;
-
-		neigh = dst_neigh_lookup(skb_dst(skb),
-					 &ipv6_hdr(skb)->daddr);
-		if (!neigh)
-			goto tx_err_link_failure;
-
-		addr6 = (struct in6_addr *)&neigh->primary_key;
-		addr_type = ipv6_addr_type(addr6);
-
-		if (addr_type == IPV6_ADDR_ANY)
-			addr6 = &ipv6_hdr(skb)->daddr;
-
-		memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
-		neigh_release(neigh);
+		if (skb->protocol == htons(ETH_P_IPV6)) {
+			struct in6_addr *addr6;
+			struct neighbour *neigh;
+			int addr_type;
+
+			if (!skb_dst(skb))
+				goto tx_err_link_failure;
+
+			neigh = dst_neigh_lookup(skb_dst(skb),
+						 &ipv6_hdr(skb)->daddr);
+			if (!neigh)
+				goto tx_err_link_failure;
+
+			addr6 = (struct in6_addr *)&neigh->primary_key;
+			addr_type = ipv6_addr_type(addr6);
+
+			if (addr_type == IPV6_ADDR_ANY)
+				addr6 = &ipv6_hdr(skb)->daddr;
+
+			memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
+			neigh_release(neigh);
+		}
 	} else if (!(t->parms.flags &
 		     (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) {
 		/* enable the cache only only if the routing decision does

[toc] | [prev] | [next] | [standalone]


#1633998 — [PATCH 4.9 32/54] net: ipv6: regenerate host route if moved to gc list

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-05-02 00:00 +0200
Subject[PATCH 4.9 32/54] net: ipv6: regenerate host route if moved to gc list
Message-ID<tCrwo-626-73@gated-at.bofh.it>
In reply to#1633993
4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Ahern <dsa@cumulusnetworks.com>


[ Upstream commit 8048ced9beb21a52e3305f3332ae82020619f24e ]

Taking down the loopback device wreaks havoc on IPv6 routing. By
extension, taking down a VRF device wreaks havoc on its table.

Dmitry and Andrey both reported heap out-of-bounds reports in the IPv6
FIB code while running syzkaller fuzzer. The root cause is a dead dst
that is on the garbage list gets reinserted into the IPv6 FIB. While on
the gc (or perhaps when it gets added to the gc list) the dst->next is
set to an IPv4 dst. A subsequent walk of the ipv6 tables causes the
out-of-bounds access.

Andrey's reproducer was the key to getting to the bottom of this.

With IPv6, host routes for an address have the dst->dev set to the
loopback device. When the 'lo' device is taken down, rt6_ifdown initiates
a walk of the fib evicting routes with the 'lo' device which means all
host routes are removed. That process moves the dst which is attached to
an inet6_ifaddr to the gc list and marks it as dead.

The recent change to keep global IPv6 addresses added a new function,
fixup_permanent_addr, that is called on admin up. That function restarts
dad for an inet6_ifaddr and when it completes the host route attached
to it is inserted into the fib. Since the route was marked dead and
moved to the gc list, re-inserting the route causes the reported
out-of-bounds accesses. If the device with the address is taken down
or the address is removed, the WARN_ON in fib6_del is triggered.

All of those faults are fixed by regenerating the host route if the
existing one has been moved to the gc list, something that can be
determined by checking if the rt6i_ref counter is 0.

Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/addrconf.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3253,14 +3253,24 @@ static void addrconf_gre_config(struct n
 static int fixup_permanent_addr(struct inet6_dev *idev,
 				struct inet6_ifaddr *ifp)
 {
-	if (!ifp->rt) {
-		struct rt6_info *rt;
+	/* rt6i_ref == 0 means the host route was removed from the
+	 * FIB, for example, if 'lo' device is taken down. In that
+	 * case regenerate the host route.
+	 */
+	if (!ifp->rt || !atomic_read(&ifp->rt->rt6i_ref)) {
+		struct rt6_info *rt, *prev;
 
 		rt = addrconf_dst_alloc(idev, &ifp->addr, false);
 		if (unlikely(IS_ERR(rt)))
 			return PTR_ERR(rt);
 
+		/* ifp->rt can be accessed outside of rtnl */
+		spin_lock(&ifp->lock);
+		prev = ifp->rt;
 		ifp->rt = rt;
+		spin_unlock(&ifp->lock);
+
+		ip6_rt_put(prev);
 	}
 
 	if (!(ifp->flags & IFA_F_NOPREFIXROUTE)) {

[toc] | [prev] | [next] | [standalone]


#1634433

FromShuah Khan <shuahkh@osg.samsung.com>
Date2017-05-02 16:00 +0200
Message-ID<tCGvp-7oC-33@gated-at.bofh.it>
In reply to#1633993
On 05/01/2017 10:19 PM, kernelci.org bot wrote:
> stable-rc/linux-4.9.y boot: 96 boots: 0 failed, 96 passed (v4.9.25-55-g49bccd4690a2)
> 
> Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.25-55-g49bccd4690a2/
> Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.25-55-g49bccd4690a2/
> 
> Tree: stable-rc
> Branch: linux-4.9.y
> Git Describe: v4.9.25-55-g49bccd4690a2
> Git Commit: 49bccd4690a2adf6e3236fef3005d905b91cf520
> Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> Tested: 16 unique boards, 9 SoC families, 20 builds out of 203
> 
> ---
> For more info write to <info@kernelci.org>
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

[toc] | [prev] | [next] | [standalone]


#1634548

FromGuenter Roeck <linux@roeck-us.net>
Date2017-05-02 19:40 +0200
Message-ID<tCJWi-1h2-15@gated-at.bofh.it>
In reply to#1633993
On Mon, May 01, 2017 at 02:31:07PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.26 release.
> There are 54 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed May  3 21:26:19 UTC 2017.
> Anything received after that time might be too late.
> 

Build results:
	total: 149 pass: 149 fail: 0
Qemu test results:
        total: 122 pass: 122 fail: 0
		        
Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web