--- /dev/null
+From f998b6b10144cd9809da6af02758615f789e8aa1 Mon Sep 17 00:00:00 2001
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Date: Sat, 6 Jan 2018 15:24:18 +0100
+Subject: netfilter: ipset: Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit()
+
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+commit f998b6b10144cd9809da6af02758615f789e8aa1 upstream.
+
+Patch "netfilter: ipset: use nfnl_mutex_is_locked" is added the real
+mutex locking check, which revealed the missing locking in ip_set_net_exit().
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Reported-by: syzbot+36b06f219f2439fe62e1@syzkaller.appspotmail.com
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index e00299051e79..728bf31bb386 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -2078,6 +2078,7 @@ ip_set_net_exit(struct net *net)
+
+ inst->is_deleted = true; /* flag for ip_set_nfnl_put */
+
++ nfnl_lock(NFNL_SUBSYS_IPSET);
+ for (i = 0; i < inst->ip_set_max; i++) {
+ set = ip_set(inst, i);
+ if (set) {
+@@ -2085,6 +2086,7 @@ ip_set_net_exit(struct net *net)
+ ip_set_destroy_set(set);
+ }
+ }
++ nfnl_unlock(NFNL_SUBSYS_IPSET);
+ kfree(rcu_dereference_protected(inst->ip_set_list, 1));
+ }
+
+++ /dev/null
-From a306343bcd7df89d9d45a601929e26866e7b7a81 Mon Sep 17 00:00:00 2001
-From: Manasi Navare <manasi.d.navare@intel.com>
-Date: Thu, 12 Oct 2017 12:13:38 -0700
-Subject: drm/i915/edp: Do not do link training fallback or prune modes on EDP
-
-From: Manasi Navare <manasi.d.navare@intel.com>
-
-commit a306343bcd7df89d9d45a601929e26866e7b7a81 upstream.
-
-In case of eDP because the panel has a fixed mode, the link rate
-and lane count at which it is trained corresponds to the link BW
-required to support the native resolution of the panel. In case of
-panles with lower resolutions where fewer lanes are hooked up internally,
-that number is reflected in the MAX_LANE_COUNT DPCD register of the panel.
-So it is pointless to fallback to lower link rate/lane count in case
-of link training failure on eDP connector since the lower link BW
-will not support the native resolution of the panel and we cannot
-prune the preferred mode on the eDP connector.
-
-In case of Link training failure on the eDP panel, something is wrong
-in the HW internally and hence driver errors out with a loud
-and clear DRM_ERROR message.
-
-v2:
-* Fix the DEBUG_ERROR and add {} in else (Ville Syrjala)
-
-Cc: Clinton Taylor <clinton.a.taylor@intel.com>
-Cc: Jim Bride <jim.bride@linux.intel.com>
-Cc: Jani Nikula <jani.nikula@linux.intel.com>
-Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
-Cc: Dave Airlie <airlied@redhat.com>
-Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
-Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>
-Reviewed-by: Ville Syrjala <ville.syrjala@linux.intel.com>
-Reference: https://bugs.freedesktop.org/show_bug.cgi?id=103369
-Signed-off-by: Imre Deak <imre.deak@intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/1507835618-23051-1-git-send-email-manasi.d.navare@intel.com
-(cherry picked from commit c0cfb10d9e1de490e36d3b9d4228c0ea0ca30677)
-Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/gpu/drm/i915/intel_dp_link_training.c | 26 +++++++++++++++++---------
- 1 file changed, 17 insertions(+), 9 deletions(-)
-
---- a/drivers/gpu/drm/i915/intel_dp_link_training.c
-+++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
-@@ -328,14 +328,22 @@ intel_dp_start_link_train(struct intel_d
- return;
-
- failure_handling:
-- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
-- intel_connector->base.base.id,
-- intel_connector->base.name,
-- intel_dp->link_rate, intel_dp->lane_count);
-- if (!intel_dp_get_link_train_fallback_values(intel_dp,
-- intel_dp->link_rate,
-- intel_dp->lane_count))
-- /* Schedule a Hotplug Uevent to userspace to start modeset */
-- schedule_work(&intel_connector->modeset_retry_work);
-+ /* Dont fallback and prune modes if its eDP */
-+ if (!intel_dp_is_edp(intel_dp)) {
-+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
-+ intel_connector->base.base.id,
-+ intel_connector->base.name,
-+ intel_dp->link_rate, intel_dp->lane_count);
-+ if (!intel_dp_get_link_train_fallback_values(intel_dp,
-+ intel_dp->link_rate,
-+ intel_dp->lane_count))
-+ /* Schedule a Hotplug Uevent to userspace to start modeset */
-+ schedule_work(&intel_connector->modeset_retry_work);
-+ } else {
-+ DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
-+ intel_connector->base.base.id,
-+ intel_connector->base.name,
-+ intel_dp->link_rate, intel_dp->lane_count);
-+ }
- return;
- }
projects / thirdparty / kernel / stable-queue.git / commitdiff
