4.9-stable patches

added patches:
	net-mlx5-don-t-unlock-fte-while-still-using-it.patch
	tcp-fix-mark-propagation-with-fwmark_reflect-enabled.patch

diff --git a/queue-4.9/net-mlx5-don-t-unlock-fte-while-still-using-it.patch b/queue-4.9/net-mlx5-don-t-unlock-fte-while-still-using-it.patch
new file mode 100644 (file)
index 0000000..eeeb0d3
--- /dev/null
+++ b/queue-4.9/net-mlx5-don-t-unlock-fte-while-still-using-it.patch
@@ -0,0 +1,52 @@
+From 0fd758d6112f867b2cc6df0f6a856048ff99b211 Mon Sep 17 00:00:00 2001
+From: Mark Bloch <markb@mellanox.com>
+Date: Mon, 5 Sep 2016 10:58:04 +0000
+Subject: net/mlx5: Don't unlock fte while still using it
+
+From: Mark Bloch <markb@mellanox.com>
+
+commit 0fd758d6112f867b2cc6df0f6a856048ff99b211 upstream.
+
+When adding a new rule to an fte, we need to hold the fte lock
+until we add that rule to the fte and increase the fte ref count.
+
+Fixes: 0c56b97503fd ("net/mlx5_core: Introduce flow steering API")
+Signed-off-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1110,9 +1110,8 @@ static struct mlx5_flow_rule *add_rule_f
+                               return rule;
+                       }
+                       rule = add_rule_fte(fte, fg, dest);
+-                      unlock_ref_node(&fte->node);
+                       if (IS_ERR(rule))
+-                              goto unlock_fg;
++                              goto unlock_fte;
+                       else
+                               goto add_rule;
+               }
+@@ -1130,6 +1129,7 @@ static struct mlx5_flow_rule *add_rule_f
+               goto unlock_fg;
+       }
+       tree_init_node(&fte->node, 0, del_fte);
++      nested_lock_ref_node(&fte->node, FS_MUTEX_CHILD);
+       rule = add_rule_fte(fte, fg, dest);
+       if (IS_ERR(rule)) {
+               kfree(fte);
+@@ -1142,6 +1142,8 @@ static struct mlx5_flow_rule *add_rule_f
+       list_add(&fte->node.list, prev);
+ add_rule:
+       tree_add_node(&rule->node, &fte->node);
++unlock_fte:
++      unlock_ref_node(&fte->node);
+ unlock_fg:
+       unlock_ref_node(&fg->node);
+       return rule;

diff --git a/queue-4.9/series b/queue-4.9/series
index 199377112174043a56274d10ebada1a87404c5f1..82d0d01750170ce7384428233066d87024b0577c 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -28,3 +28,5 @@ net-dsa-do-not-destroy-invalid-network-devices.patch
 l2tp-do-not-use-udp_ioctl.patch
 mld-do-not-remove-mld-souce-list-info-when-set-link-down.patch
 igmp-mld-fix-memory-leak-in-igmpv3-mld_del_delrec.patch
+tcp-fix-mark-propagation-with-fwmark_reflect-enabled.patch
+net-mlx5-don-t-unlock-fte-while-still-using-it.patch

diff --git a/queue-4.9/tcp-fix-mark-propagation-with-fwmark_reflect-enabled.patch b/queue-4.9/tcp-fix-mark-propagation-with-fwmark_reflect-enabled.patch
new file mode 100644 (file)
index 0000000..66eb5a9
--- /dev/null
+++ b/queue-4.9/tcp-fix-mark-propagation-with-fwmark_reflect-enabled.patch
@@ -0,0 +1,46 @@
+From bf99b4ded5f8a4767dbb9d180626f06c51f9881f Mon Sep 17 00:00:00 2001
+From: Pau Espin Pedrol <pespin.shar@gmail.com>
+Date: Fri, 6 Jan 2017 20:33:28 +0100
+Subject: tcp: fix mark propagation with fwmark_reflect enabled
+
+From: Pau Espin Pedrol <pespin.shar@gmail.com>
+
+commit bf99b4ded5f8a4767dbb9d180626f06c51f9881f upstream.
+
+Otherwise, RST packets generated by the TCP stack for non-existing
+sockets always have mark 0.
+The mark from the original packet is assigned to the netns_ipv4/6
+socket used to send the response so that it can get copied into the
+response skb when the socket sends it.
+
+Fixes: e110861f8609 ("net: add a sysctl to reflect the fwmark on replies")
+Cc: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Pau Espin Pedrol <pau.espin@tessares.net>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ip_output.c |    1 +
+ net/ipv6/tcp_ipv6.c  |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1606,6 +1606,7 @@ void ip_send_unicast_reply(struct sock *
+       sk->sk_protocol = ip_hdr(skb)->protocol;
+       sk->sk_bound_dev_if = arg->bound_dev_if;
+       sk->sk_sndbuf = sysctl_wmem_default;
++      sk->sk_mark = fl4.flowi4_mark;
+       err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
+                            len, 0, &ipc, &rt, MSG_DONTWAIT);
+       if (unlikely(err)) {
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -837,6 +837,7 @@ static void tcp_v6_send_response(const s
+       dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
+       if (!IS_ERR(dst)) {
+               skb_dst_set(buff, dst);
++              ctl_sk->sk_mark = fl6.flowi6_mark;
+               ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
+               TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
+               if (rst)