Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1605060 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-03-20 19:50 +0100 |
| Last post | 2017-03-21 03:20 +0100 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.4 00/28] 4.4.56-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:50 +0100
[PATCH 4.4 11/28] net: fix socket refcounting in skb_complete_tx_timestamp() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:50 +0100
[PATCH 4.4 10/28] net: fix socket refcounting in skb_complete_wifi_ack() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-20 19:50 +0100
Re: [PATCH 4.4 00/28] 4.4.56-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-21 01:30 +0100
Re: [PATCH 4.4 00/28] 4.4.56-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-21 03:20 +0100
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-03-20 19:50 +0100 |
| Subject | [PATCH 4.4 00/28] 4.4.56-stable review |
| Message-ID | <tn9L4-89w-15@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.4.56 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Mar 22 17:47:06 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.56-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.4.56-rc1
Peter Zijlstra <peterz@infradead.org>
futex: Add missing error handling to FUTEX_REQUEUE_PI
Peter Zijlstra <peterz@infradead.org>
futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
Andy Lutomirski <luto@kernel.org>
x86/perf: Fix CR4.PCE propagation to use active_mm instead of mm
Andrey Ryabinin <aryabinin@virtuozzo.com>
x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y
Eric Biggers <ebiggers@google.com>
fscrypto: lock inode while setting encryption policy
Eric Biggers <ebiggers@google.com>
fscrypt: fix renaming and linking special files
Roman Mashak <mrv@mojatatu.com>
net sched actions: decrement module reference count after table flush.
Hannes Frederic Sowa <hannes@stressinduktion.org>
dccp: fix memory leak during tear-down of unsuccessful connection request
Jon Maxwell <jmaxwell37@gmail.com>
dccp/tcp: fix routing redirect race
Florian Westphal <fw@strlen.de>
bridge: drop netfilter fake rtable unconditionally
Florian Westphal <fw@strlen.de>
ipv6: avoid write to a possibly cloned skb
Sabrina Dubroca <sd@queasysnail.net>
ipv6: make ECMP route replacement less greedy
David Ahern <dsa@cumulusnetworks.com>
mpls: Send route delete notifications when router module is unloaded
Etienne Noss <etienne.noss@wifirst.fr>
act_connmark: avoid crashing on malformed nlattrs with null parms
Dmitry V. Levin <ldv@altlinux.org>
uapi: fix linux/packet_diag.h userspace compilation error
David Ahern <dsa@cumulusnetworks.com>
vrf: Fix use-after-free in vrf_xmit
Eric Dumazet <edumazet@google.com>
dccp: fix use-after-free in dccp_feat_activate_values
Eric Dumazet <edumazet@google.com>
net: fix socket refcounting in skb_complete_tx_timestamp()
Eric Dumazet <edumazet@google.com>
net: fix socket refcounting in skb_complete_wifi_ack()
Eric Dumazet <edumazet@google.com>
tcp: fix various issues for sockets morphing to listen state
Arnaldo Carvalho de Melo <acme@redhat.com>
dccp: Unlock sock before calling sk_free()
Eric Dumazet <edumazet@google.com>
net: net_enable_timestamp() can be called from irq contexts
Alexander Potapenko <glider@google.com>
net: don't call strlen() on the user buffer in packet_bind_spkt()
Paul Hüber <phueber@kernsp.in>
l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
Julian Anastasov <ja@ssi.bg>
ipv4: mask tos for input route
David Forster <dforster@brocade.com>
vti6: return GRE_KEY for vti6
Matthias Schiffer <mschiffer@universe-factory.net>
vxlan: correctly validate VXLAN ID against VXLAN_N_VID
Florian Westphal <fw@strlen.de>
netlink: remove mmapped netlink support
-------------
Diffstat:
Documentation/networking/netlink_mmap.txt | 332 -------------
Makefile | 4 +-
arch/x86/kernel/cpu/perf_event.c | 4 +-
arch/x86/kernel/head64.c | 1 +
arch/x86/mm/kasan_init_64.c | 1 +
drivers/net/vrf.c | 3 +-
drivers/net/vxlan.c | 2 +-
fs/ext4/crypto_policy.c | 6 +
fs/ext4/ioctl.c | 4 +
fs/f2fs/crypto_policy.c | 5 +
fs/f2fs/file.c | 9 +-
include/linux/dccp.h | 1 +
include/uapi/linux/netlink.h | 4 +
include/uapi/linux/netlink_diag.h | 2 +
include/uapi/linux/packet_diag.h | 2 +-
kernel/futex.c | 22 +-
net/bridge/br_input.c | 1 +
net/bridge/br_netfilter_hooks.c | 21 -
net/core/dev.c | 35 +-
net/core/skbuff.c | 30 +-
net/dccp/ccids/ccid2.c | 1 +
net/dccp/ipv4.c | 3 +-
net/dccp/ipv6.c | 8 +-
net/dccp/minisocks.c | 25 +-
net/ipv4/route.c | 1 +
net/ipv4/tcp_ipv4.c | 10 +-
net/ipv4/tcp_timer.c | 6 +-
net/ipv6/ip6_fib.c | 2 +
net/ipv6/ip6_output.c | 7 +-
net/ipv6/ip6_vti.c | 4 +
net/ipv6/tcp_ipv6.c | 8 +-
net/l2tp/l2tp_ip.c | 2 +-
net/mpls/af_mpls.c | 1 +
net/netlink/Kconfig | 9 -
net/netlink/af_netlink.c | 751 +-----------------------------
net/netlink/af_netlink.h | 15 -
net/netlink/diag.c | 39 --
net/packet/af_packet.c | 8 +-
net/sched/act_api.c | 5 +-
net/sched/act_connmark.c | 3 +
40 files changed, 175 insertions(+), 1222 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-03-20 19:50 +0100 |
| Subject | [PATCH 4.4 11/28] net: fix socket refcounting in skb_complete_tx_timestamp() |
| Message-ID | <tnaxt-nq-57@gated-at.bofh.it> |
| In reply to | #1605060 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9ac25fc063751379cb77434fef9f3b088cd3e2f7 ]
TX skbs do not necessarily hold a reference on skb->sk->sk_refcnt
By the time TX completion happens, sk_refcnt might be already 0.
sock_hold()/sock_put() would then corrupt critical state, like
sk_wmem_alloc and lead to leaks or use after free.
Fixes: 62bccb8cdb69 ("net-timestamp: Make the clone operation stand-alone from phy timestamping")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3678,13 +3678,14 @@ void skb_complete_tx_timestamp(struct sk
if (!skb_may_tx_timestamp(sk, false))
return;
- /* take a reference to prevent skb_orphan() from freeing the socket */
- sock_hold(sk);
-
- *skb_hwtstamps(skb) = *hwtstamps;
- __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
-
- sock_put(sk);
+ /* Take a reference to prevent skb_orphan() from freeing the socket,
+ * but only if the socket refcount is not zero.
+ */
+ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+ *skb_hwtstamps(skb) = *hwtstamps;
+ __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
+ sock_put(sk);
+ }
}
EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-03-20 19:50 +0100 |
| Subject | [PATCH 4.4 10/28] net: fix socket refcounting in skb_complete_wifi_ack() |
| Message-ID | <tnaxt-nq-49@gated-at.bofh.it> |
| In reply to | #1605060 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit dd4f10722aeb10f4f582948839f066bebe44e5fb ]
TX skbs do not necessarily hold a reference on skb->sk->sk_refcnt
By the time TX completion happens, sk_refcnt might be already 0.
sock_hold()/sock_put() would then corrupt critical state, like
sk_wmem_alloc.
Fixes: bf7fa551e0ce ("mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3735,7 +3735,7 @@ void skb_complete_wifi_ack(struct sk_buf
{
struct sock *sk = skb->sk;
struct sock_exterr_skb *serr;
- int err;
+ int err = 1;
skb->wifi_acked_valid = 1;
skb->wifi_acked = acked;
@@ -3745,14 +3745,15 @@ void skb_complete_wifi_ack(struct sk_buf
serr->ee.ee_errno = ENOMSG;
serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
- /* take a reference to prevent skb_orphan() from freeing the socket */
- sock_hold(sk);
-
- err = sock_queue_err_skb(sk, skb);
+ /* Take a reference to prevent skb_orphan() from freeing the socket,
+ * but only if the socket refcount is not zero.
+ */
+ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+ err = sock_queue_err_skb(sk, skb);
+ sock_put(sk);
+ }
if (err)
kfree_skb(skb);
-
- sock_put(sk);
}
EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
[toc] | [prev] | [next] | [standalone]
| From | Shuah Khan <shuahkh@osg.samsung.com> |
|---|---|
| Date | 2017-03-21 01:30 +0100 |
| Message-ID | <tnfQt-40s-3@gated-at.bofh.it> |
| In reply to | #1605060 |
On 03/20/2017 11:48 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.4.56 release. > There are 28 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Wed Mar 22 17:47:06 UTC 2017. > Anything received after that time might be too late. > > The whole patch series can be found in one patch at: > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.56-rc1.gz > or in the git tree and branch at: > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y > and the diffstat can be found below. > > thanks, > > greg k-h > Compiled and booted on my test system. No dmesg regressions. thanks, -- Shuah
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2017-03-21 03:20 +0100 |
| Message-ID | <tnhyW-5bM-5@gated-at.bofh.it> |
| In reply to | #1605060 |
On 03/20/2017 10:48 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.4.56 release. > There are 28 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Wed Mar 22 17:47:06 UTC 2017. > Anything received after that time might be too late. > Build results: total: 149 pass: 149 fail: 0 Qemu test results: total: 115 pass: 115 fail: 0 Details are available at http://kerneltests.org/builders. Guenter
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web