Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1633993 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-05-02 00:00 +0200 |
| Last post | 2017-05-02 19:40 +0200 |
| Articles | 7 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.9 00/54] 4.9.26-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
[PATCH 4.9 09/54] net/mlx5: Avoid dereferencing uninitialized pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
[PATCH 4.9 35/54] tcp: memset ca_priv data to 0 properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
[PATCH 4.9 34/54] ipv6: check skb->protocol before lookup for nexthop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
[PATCH 4.9 32/54] net: ipv6: regenerate host route if moved to gc list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-02 00:00 +0200
Re: [PATCH 4.9 00/54] 4.9.26-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-02 16:00 +0200
Re: [PATCH 4.9 00/54] 4.9.26-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-02 19:40 +0200
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-02 00:00 +0200 |
| Subject | [PATCH 4.9 00/54] 4.9.26-stable review |
| Message-ID | <tCrcZ-5UI-9@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.9.26 release.
There are 54 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed May 3 21:26:19 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.26-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.9.26-rc1
Josh Poimboeuf <jpoimboe@redhat.com>
ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram
Vineet Gupta <vgupta@synopsys.com>
ARCv2: save r30 on kernel entry as gcc uses it for code-gen
Maksim Salau <maksim.salau@gmail.com>
net: can: usb: gs_usb: Fix buffer on stack
Jason A. Donenfeld <Jason@zx2c4.com>
macsec: avoid heap overflow in skb_to_sgvec
Yan, Zheng <zyan@redhat.com>
ceph: fix recursion between ceph_set_acl() and __ceph_setattr()
J. Bruce Fields <bfields@redhat.com>
nfsd: stricter decoding of write-like NFSv2/v3 ops
J. Bruce Fields <bfields@redhat.com>
nfsd4: minor NFSv2/v3 write decoding cleanup
J. Bruce Fields <bfields@redhat.com>
nfsd: check for oversized NFSv2/v3 arguments
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: i8042 - add Clevo P650RS to the i8042 reset list
Takashi Iwai <tiwai@suse.de>
ASoC: intel: Fix PM and non-atomic crash in bytcr drivers
Al Viro <viro@zeniv.linux.org.uk>
p9_client_readdir() fix
James Cowgill <James.Cowgill@imgtec.com>
MIPS: Avoid BUG warning in arch_check_elf
James Hogan <james.hogan@imgtec.com>
MIPS: cevt-r4k: Fix out-of-bounds array access
James Hogan <james.hogan@imgtec.com>
MIPS: KGDB: Use kernel context for sleeping threads
Noam Camus <noamca@mellanox.com>
ARC: [plat-eznps] Fix build error
Takashi Iwai <tiwai@suse.de>
ALSA: seq: Don't break snd_use_lock_sync() loop by timeout
Takashi Sakamoto <o-takashi@sakamocchi.jp>
ALSA: firewire-lib: fix inappropriate assignment between signed/unsigned type
Takashi Sakamoto <o-takashi@sakamocchi.jp>
ALSA: oxfw: fix regression to handle Stanton SCS.1m/1d
Jamie Bainbridge <jbainbri@redhat.com>
ipv6: check raw payload size correctly in ioctl
Wei Wang <weiwan@google.com>
tcp: memset ca_priv data to 0 properly
WANG Cong <xiyou.wangcong@gmail.com>
ipv6: check skb->protocol before lookup for nexthop
Alexander Kochetkov <al.kochet@gmail.com>
net: phy: fix auto-negotiation stall due to unavailable interrupt
David Ahern <dsa@cumulusnetworks.com>
net: ipv6: regenerate host route if moved to gc list
Herbert Xu <herbert@gondor.apana.org.au>
macvlan: Fix device ref leak when purging bc_queue
Ilan Tayari <ilant@mellanox.com>
net/mlx5e: Fix ETHTOOL_GRXCLSRLALL handling
Eugenia Emantayev <eugenia@mellanox.com>
net/mlx5e: Fix small packet threshold
Mohamad Haj Yahia <mohamad@mellanox.com>
net/mlx5: Fix driver load bad flow when having fw initializing timeout
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
ip6mr: fix notification device destruction
Tushar Dave <tushar.n.dave@oracle.com>
netpoll: Check for skb->queue_mapping
David Ahern <dsa@cumulusnetworks.com>
net: ipv6: RTF_PCPU should not be settable from userspace
Ilan Tayari <ilant@mellanox.com>
gso: Validate assumption of frag_list segementation
Dan Carpenter <dan.carpenter@oracle.com>
dp83640: don't recieve time stamps twice
Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
sh_eth: unmap DMA buffers when freeing rings
David Ahern <dsa@cumulusnetworks.com>
net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule
Willem de Bruijn <willemb@google.com>
net-timestamp: avoid use-after-free in ip_recv_error
Rabin Vincent <rabinv@axis.com>
ipv6: Fix idev->addr_list corruption
Eric Dumazet <edumazet@google.com>
tcp: clear saved_syn in tcp_disconnect()
Xin Long <lucien.xin@gmail.com>
sctp: listen on the sock only when it's state is listening or closed
Florian Larysch <fl@n621.de>
net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given
Guillaume Nault <g.nault@alphalink.fr>
l2tp: fix PPP pseudo-wire auto-loading
Guillaume Nault <g.nault@alphalink.fr>
l2tp: take reference on sessions being dumped
Andrey Konovalov <andreyknvl@google.com>
net/packet: fix overflow in check for tp_reserve
Andrey Konovalov <andreyknvl@google.com>
net/packet: fix overflow in check for tp_frame_nr
Guillaume Nault <g.nault@alphalink.fr>
l2tp: purge socket queues in the .destruct() callback
Guillaume Nault <g.nault@alphalink.fr>
l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6
Talat Batheesh <talatb@mellanox.com>
net/mlx5: Avoid dereferencing uninitialized pointer
Alexei Starovoitov <ast@fb.com>
bpf: improve verifier packet range checks
WANG Cong <xiyou.wangcong@gmail.com>
kcm: return immediately after copy_from_user() failure
Nathan Sullivan <nathan.sullivan@ni.com>
net: phy: handle state correctly in phy_stop_machine
Eric Dumazet <edumazet@google.com>
net: neigh: guard against NULL solicit() method
Tom Hromatka <tom.hromatka@oracle.com>
sparc64: Fix kernel panic due to erroneous #ifdef surrounding pmd_write()
bob picco <bob.picco@oracle.com>
sparc64: kern_addr_valid regression
Eric Dumazet <edumazet@google.com>
ping: implement proper locking
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Revert "mmc: sdhci-msm: Enable few quirks"
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/atomic.h | 3 +-
arch/arc/include/asm/entry-arcv2.h | 2 +
arch/arc/include/asm/ptrace.h | 2 +-
arch/mips/kernel/cevt-r4k.c | 2 +-
arch/mips/kernel/elf.c | 2 +-
arch/mips/kernel/kgdb.c | 48 +++++---
arch/sparc/include/asm/pgtable_64.h | 15 +--
arch/sparc/mm/init_64.c | 2 +-
arch/x86/kernel/ftrace.c | 12 ++
drivers/input/serio/i8042-x86ia64io.h | 7 ++
drivers/mmc/host/sdhci-msm.c | 4 +-
drivers/net/can/usb/gs_usb.c | 17 ++-
drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
.../ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 1 +
drivers/net/ethernet/mellanox/mlx5/core/lag.c | 5 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +-
drivers/net/ethernet/renesas/sh_eth.c | 122 +++++++++++----------
drivers/net/macsec.c | 2 +-
drivers/net/macvlan.c | 11 +-
drivers/net/phy/dp83640.c | 2 -
drivers/net/phy/phy.c | 42 ++++++-
drivers/net/vrf.c | 2 +-
fs/ceph/inode.c | 22 ++--
fs/nfsd/nfs3xdr.c | 13 ++-
fs/nfsd/nfssvc.c | 36 ++++++
fs/nfsd/nfsxdr.c | 10 +-
include/linux/phy.h | 1 +
include/uapi/linux/ipv6_route.h | 2 +-
kernel/bpf/verifier.c | 5 +-
net/9p/client.c | 4 +
net/core/neighbour.c | 3 +-
net/core/netpoll.c | 10 +-
net/core/skbuff.c | 19 +++-
net/ipv4/ip_sockglue.c | 9 +-
net/ipv4/ping.c | 5 +-
net/ipv4/route.c | 2 +-
net/ipv4/tcp.c | 1 +
net/ipv4/tcp_cong.c | 11 +-
net/ipv6/addrconf.c | 25 ++++-
net/ipv6/datagram.c | 10 +-
net/ipv6/ip6_tunnel.c | 34 +++---
net/ipv6/ip6mr.c | 13 +--
net/ipv6/raw.c | 3 +-
net/ipv6/route.c | 4 +
net/kcm/kcmsock.c | 6 +-
net/l2tp/l2tp_core.c | 8 +-
net/l2tp/l2tp_core.h | 3 +-
net/l2tp/l2tp_debugfs.c | 10 +-
net/l2tp/l2tp_ip.c | 5 +-
net/l2tp/l2tp_ip6.c | 5 +-
net/l2tp/l2tp_netlink.c | 7 +-
net/l2tp/l2tp_ppp.c | 19 ++--
net/packet/af_packet.c | 4 +
net/sctp/socket.c | 3 +
sound/core/seq/seq_lock.c | 9 +-
sound/firewire/lib.h | 2 +-
sound/firewire/oxfw/oxfw.c | 4 +-
sound/soc/intel/boards/bytcr_rt5640.c | 4 +-
sound/soc/intel/boards/bytcr_rt5651.c | 2 -
60 files changed, 417 insertions(+), 227 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-02 00:00 +0200 |
| Subject | [PATCH 4.9 09/54] net/mlx5: Avoid dereferencing uninitialized pointer |
| Message-ID | <tCrwn-626-63@gated-at.bofh.it> |
| In reply to | #1633993 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Talat Batheesh <talatb@mellanox.com>
[ Upstream commit e497ec680c4cd51e76bfcdd49363d9ab8d32a757 ]
In NETDEV_CHANGEUPPER event the upper_info field is valid
only when linking is true. Otherwise it should be ignored.
Fixes: 7907f23adc18 (net/mlx5: Implement RoCE LAG feature)
Signed-off-by: Talat Batheesh <talatb@mellanox.com>
Reviewed-by: Aviv Heller <avivh@mellanox.com>
Reviewed-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/lag.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -294,7 +294,7 @@ static int mlx5_handle_changeupper_event
struct netdev_notifier_changeupper_info *info)
{
struct net_device *upper = info->upper_dev, *ndev_tmp;
- struct netdev_lag_upper_info *lag_upper_info;
+ struct netdev_lag_upper_info *lag_upper_info = NULL;
bool is_bonded;
int bond_status = 0;
int num_slaves = 0;
@@ -303,7 +303,8 @@ static int mlx5_handle_changeupper_event
if (!netif_is_lag_master(upper))
return 0;
- lag_upper_info = info->upper_info;
+ if (info->linking)
+ lag_upper_info = info->upper_info;
/* The event may still be of interest if the slave does not belong to
* us, but is enslaved to a master which has one or more of our netdevs
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-02 00:00 +0200 |
| Subject | [PATCH 4.9 35/54] tcp: memset ca_priv data to 0 properly |
| Message-ID | <tCrwn-626-61@gated-at.bofh.it> |
| In reply to | #1633993 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
[ Upstream commit c1201444075009507a6818de6518e2822b9a87c8 ]
Always zero out ca_priv data in tcp_assign_congestion_control() so that
ca_priv data is cleared out during socket creation.
Also always zero out ca_priv data in tcp_reinit_congestion_control() so
that when cc algorithm is changed, ca_priv data is cleared out as well.
We should still zero out ca_priv data even in TCP_CLOSE state because
user could call connect() on AF_UNSPEC to disconnect the socket and
leave it in TCP_CLOSE state and later call setsockopt() to switch cc
algorithm on this socket.
Fixes: 2b0a8c9ee ("tcp: add CDG congestion control")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_cong.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -167,12 +167,8 @@ void tcp_assign_congestion_control(struc
}
out:
rcu_read_unlock();
+ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
- /* Clear out private data before diag gets it and
- * the ca has not been initialized.
- */
- if (ca->get_info)
- memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
if (ca->flags & TCP_CONG_NEEDS_ECN)
INET_ECN_xmit(sk);
else
@@ -199,11 +195,10 @@ static void tcp_reinit_congestion_contro
tcp_cleanup_congestion_control(sk);
icsk->icsk_ca_ops = ca;
icsk->icsk_ca_setsockopt = 1;
+ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
- if (sk->sk_state != TCP_CLOSE) {
- memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+ if (sk->sk_state != TCP_CLOSE)
tcp_init_congestion_control(sk);
- }
}
/* Manage refcounts on socket close. */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-02 00:00 +0200 |
| Subject | [PATCH 4.9 34/54] ipv6: check skb->protocol before lookup for nexthop |
| Message-ID | <tCrwo-626-65@gated-at.bofh.it> |
| In reply to | #1633993 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
[ Upstream commit 199ab00f3cdb6f154ea93fa76fd80192861a821d ]
Andrey reported a out-of-bound access in ip6_tnl_xmit(), this
is because we use an ipv4 dst in ip6_tnl_xmit() and cast an IPv4
neigh key as an IPv6 address:
neigh = dst_neigh_lookup(skb_dst(skb),
&ipv6_hdr(skb)->daddr);
if (!neigh)
goto tx_err_link_failure;
addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE
addr_type = ipv6_addr_type(addr6);
if (addr_type == IPV6_ADDR_ANY)
addr6 = &ipv6_hdr(skb)->daddr;
memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
Also the network header of the skb at this point should be still IPv4
for 4in6 tunnels, we shold not just use it as IPv6 header.
This patch fixes it by checking if skb->protocol is ETH_P_IPV6: if it
is, we are safe to do the nexthop lookup using skb_dst() and
ipv6_hdr(skb)->daddr; if not (aka IPv4), we have no clue about which
dest address we can pick here, we have to rely on callers to fill it
from tunnel config, so just fall to ip6_route_output() to make the
decision.
Fixes: ea3dc9601bda ("ip6_tunnel: Add support for wildcard tunnel endpoints.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_tunnel.c | 44 +++++++++++++++++++++++---------------------
1 file changed, 23 insertions(+), 21 deletions(-)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1037,7 +1037,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, st
struct ip6_tnl *t = netdev_priv(dev);
struct net *net = t->net;
struct net_device_stats *stats = &t->dev->stats;
- struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+ struct ipv6hdr *ipv6h;
struct ipv6_tel_txoption opt;
struct dst_entry *dst = NULL, *ndst = NULL;
struct net_device *tdev;
@@ -1057,26 +1057,28 @@ int ip6_tnl_xmit(struct sk_buff *skb, st
/* NBMA tunnel */
if (ipv6_addr_any(&t->parms.raddr)) {
- struct in6_addr *addr6;
- struct neighbour *neigh;
- int addr_type;
-
- if (!skb_dst(skb))
- goto tx_err_link_failure;
-
- neigh = dst_neigh_lookup(skb_dst(skb),
- &ipv6_hdr(skb)->daddr);
- if (!neigh)
- goto tx_err_link_failure;
-
- addr6 = (struct in6_addr *)&neigh->primary_key;
- addr_type = ipv6_addr_type(addr6);
-
- if (addr_type == IPV6_ADDR_ANY)
- addr6 = &ipv6_hdr(skb)->daddr;
-
- memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
- neigh_release(neigh);
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+ struct in6_addr *addr6;
+ struct neighbour *neigh;
+ int addr_type;
+
+ if (!skb_dst(skb))
+ goto tx_err_link_failure;
+
+ neigh = dst_neigh_lookup(skb_dst(skb),
+ &ipv6_hdr(skb)->daddr);
+ if (!neigh)
+ goto tx_err_link_failure;
+
+ addr6 = (struct in6_addr *)&neigh->primary_key;
+ addr_type = ipv6_addr_type(addr6);
+
+ if (addr_type == IPV6_ADDR_ANY)
+ addr6 = &ipv6_hdr(skb)->daddr;
+
+ memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
+ neigh_release(neigh);
+ }
} else if (!(t->parms.flags &
(IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) {
/* enable the cache only only if the routing decision does
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-02 00:00 +0200 |
| Subject | [PATCH 4.9 32/54] net: ipv6: regenerate host route if moved to gc list |
| Message-ID | <tCrwo-626-73@gated-at.bofh.it> |
| In reply to | #1633993 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsa@cumulusnetworks.com>
[ Upstream commit 8048ced9beb21a52e3305f3332ae82020619f24e ]
Taking down the loopback device wreaks havoc on IPv6 routing. By
extension, taking down a VRF device wreaks havoc on its table.
Dmitry and Andrey both reported heap out-of-bounds reports in the IPv6
FIB code while running syzkaller fuzzer. The root cause is a dead dst
that is on the garbage list gets reinserted into the IPv6 FIB. While on
the gc (or perhaps when it gets added to the gc list) the dst->next is
set to an IPv4 dst. A subsequent walk of the ipv6 tables causes the
out-of-bounds access.
Andrey's reproducer was the key to getting to the bottom of this.
With IPv6, host routes for an address have the dst->dev set to the
loopback device. When the 'lo' device is taken down, rt6_ifdown initiates
a walk of the fib evicting routes with the 'lo' device which means all
host routes are removed. That process moves the dst which is attached to
an inet6_ifaddr to the gc list and marks it as dead.
The recent change to keep global IPv6 addresses added a new function,
fixup_permanent_addr, that is called on admin up. That function restarts
dad for an inet6_ifaddr and when it completes the host route attached
to it is inserted into the fib. Since the route was marked dead and
moved to the gc list, re-inserting the route causes the reported
out-of-bounds accesses. If the device with the address is taken down
or the address is removed, the WARN_ON in fib6_del is triggered.
All of those faults are fixed by regenerating the host route if the
existing one has been moved to the gc list, something that can be
determined by checking if the rt6i_ref counter is 0.
Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/addrconf.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3253,14 +3253,24 @@ static void addrconf_gre_config(struct n
static int fixup_permanent_addr(struct inet6_dev *idev,
struct inet6_ifaddr *ifp)
{
- if (!ifp->rt) {
- struct rt6_info *rt;
+ /* rt6i_ref == 0 means the host route was removed from the
+ * FIB, for example, if 'lo' device is taken down. In that
+ * case regenerate the host route.
+ */
+ if (!ifp->rt || !atomic_read(&ifp->rt->rt6i_ref)) {
+ struct rt6_info *rt, *prev;
rt = addrconf_dst_alloc(idev, &ifp->addr, false);
if (unlikely(IS_ERR(rt)))
return PTR_ERR(rt);
+ /* ifp->rt can be accessed outside of rtnl */
+ spin_lock(&ifp->lock);
+ prev = ifp->rt;
ifp->rt = rt;
+ spin_unlock(&ifp->lock);
+
+ ip6_rt_put(prev);
}
if (!(ifp->flags & IFA_F_NOPREFIXROUTE)) {
[toc] | [prev] | [next] | [standalone]
| From | Shuah Khan <shuahkh@osg.samsung.com> |
|---|---|
| Date | 2017-05-02 16:00 +0200 |
| Message-ID | <tCGvp-7oC-33@gated-at.bofh.it> |
| In reply to | #1633993 |
On 05/01/2017 10:19 PM, kernelci.org bot wrote: > stable-rc/linux-4.9.y boot: 96 boots: 0 failed, 96 passed (v4.9.25-55-g49bccd4690a2) > > Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.25-55-g49bccd4690a2/ > Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.25-55-g49bccd4690a2/ > > Tree: stable-rc > Branch: linux-4.9.y > Git Describe: v4.9.25-55-g49bccd4690a2 > Git Commit: 49bccd4690a2adf6e3236fef3005d905b91cf520 > Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git > Tested: 16 unique boards, 9 SoC families, 20 builds out of 203 > > --- > For more info write to <info@kernelci.org> > Compiled and booted on my test system. No dmesg regressions. thanks, -- Shuah
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2017-05-02 19:40 +0200 |
| Message-ID | <tCJWi-1h2-15@gated-at.bofh.it> |
| In reply to | #1633993 |
On Mon, May 01, 2017 at 02:31:07PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.26 release.
> There are 54 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed May 3 21:26:19 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 149 pass: 149 fail: 0
Qemu test results:
total: 122 pass: 122 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web