4.19-stable patches

added patches:
	net-sched-make-function-qdisc_free_cb-static.patch
	net_sched-fix-a-crash-in-tc_new_tfilter.patch

diff --git a/queue-4.19/net-sched-make-function-qdisc_free_cb-static.patch b/queue-4.19/net-sched-make-function-qdisc_free_cb-static.patch
new file mode 100644 (file)
index 0000000..12a8340
--- /dev/null
+++ b/queue-4.19/net-sched-make-function-qdisc_free_cb-static.patch
@@ -0,0 +1,33 @@
+From 5362700c942b2cc4bab328361545a6d6fe649534 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Thu, 27 Sep 2018 14:47:56 +0000
+Subject: net: sched: make function qdisc_free_cb() static
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 5362700c942b2cc4bab328361545a6d6fe649534 upstream.
+
+Fixes the following sparse warning:
+
+net/sched/sch_generic.c:944:6: warning:
+ symbol 'qdisc_free_cb' was not declared. Should it be static?
+
+Fixes: 3a7d0d07a386 ("net: sched: extend Qdisc with rcu")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_generic.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -958,7 +958,7 @@ void qdisc_free(struct Qdisc *qdisc)
+       kfree((char *) qdisc - qdisc->padded);
+ }
+ 
+-void qdisc_free_cb(struct rcu_head *head)
++static void qdisc_free_cb(struct rcu_head *head)
+ {
+       struct Qdisc *q = container_of(head, struct Qdisc, rcu);
+ 

diff --git a/queue-4.19/net_sched-fix-a-crash-in-tc_new_tfilter.patch b/queue-4.19/net_sched-fix-a-crash-in-tc_new_tfilter.patch
new file mode 100644 (file)
index 0000000..9f16b03
--- /dev/null
+++ b/queue-4.19/net_sched-fix-a-crash-in-tc_new_tfilter.patch
@@ -0,0 +1,36 @@
+From 460b360104d51552a57f39e54b2589c9fd7fa0b3 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 27 Sep 2018 13:42:19 -0700
+Subject: net_sched: fix a crash in tc_new_tfilter()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+commit 460b360104d51552a57f39e54b2589c9fd7fa0b3 upstream.
+
+When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
+so its caller doesn't need to clean up this again. Avoid calling
+qdisc_put() again by resetting qdisc to NULL for callers.
+
+Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com
+Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/cls_api.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -629,8 +629,10 @@ static struct tcf_block *tcf_block_find(
+ errout_rcu:
+       rcu_read_unlock();
+ errout_qdisc:
+-      if (*q)
++      if (*q) {
+               qdisc_put(*q);
++              *q = NULL;
++      }
+       return ERR_PTR(err);
+ }
+ 

diff --git a/queue-4.19/series b/queue-4.19/series
index f3bbe9bdff6282d6ed47986168db8c1391fcf1ae..4d62f38938e877702c1de87d47b5e5c82407f932 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -70,3 +70,5 @@ irqchip-armada-370-xp-fix-return-value-of-armada_370_xp_msi_alloc.patch
 irqchip-armada-370-xp-fix-support-for-multi-msi-interrupts.patch
 irqchip-irq-gic-v3-its.c-force-synchronisation-when-issuing-invall.patch
 irqchip-nvic-fix-offset-for-interrupt-priority-offsets.patch
+net_sched-fix-a-crash-in-tc_new_tfilter.patch
+net-sched-make-function-qdisc_free_cb-static.patch