5.4-stable patches

added patches:
	btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
	driver-core-bus-fix-double-free-in-driver-api-bus_register.patch
	ima-fix-use-after-free-on-a-dentry-s-dname.name.patch
	pps-fix-a-use-after-free.patch
	revert-btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
	scsi-storvsc-set-correct-data-length-for-sending-scsi-command-without-payload.patch
	vlan-introduce-vlan_dev_free_egress_priority.patch
	vlan-move-dev_put-into-vlan_dev_uninit.patch

diff --git a/queue-5.4/btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch b/queue-5.4/btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
new file mode 100644 (file)
index 0000000..9d1324b
--- /dev/null
+++ b/queue-5.4/btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
@@ -0,0 +1,42 @@
+From stable+bounces-114125-greg=kroah.com@vger.kernel.org Thu Feb  6 17:19:13 2025
+From: Koichiro Den <koichiro.den@canonical.com>
+Date: Fri,  7 Feb 2025 01:18:25 +0900
+Subject: btrfs: avoid monopolizing a core when activating a swap file
+To: gregkh@linuxfoundation.org, stable@vger.kernel.org
+Cc: wqu@suse.com, fdmanana@suse.com, dsterba@suse.com
+Message-ID: <20250206161825.1386953-2-koichiro.den@canonical.com>
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 2c8507c63f5498d4ee4af404a8e44ceae4345056 upstream.
+
+This commit re-attempts the backport of the change to the linux-5.4.y
+branch. Commit 3d770d44dd5c ("btrfs: avoid monopolizing a core when
+activating a swap file") on this branch was reverted.
+
+During swap activation we iterate over the extents of a file and we can
+have many thousands of them, so we can end up in a busy loop monopolizing
+a core. Avoid this by doing a voluntary reschedule after processing each
+extent.
+
+CC: stable@vger.kernel.org # 5.4+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -11079,6 +11079,8 @@ static int btrfs_swap_activate(struct sw
+               }
+ 
+               start += len;
++
++              cond_resched();
+       }
+ 
+       if (bsi.block_len)

diff --git a/queue-5.4/driver-core-bus-fix-double-free-in-driver-api-bus_register.patch b/queue-5.4/driver-core-bus-fix-double-free-in-driver-api-bus_register.patch
new file mode 100644 (file)
index 0000000..c1d0e23
--- /dev/null
+++ b/queue-5.4/driver-core-bus-fix-double-free-in-driver-api-bus_register.patch
@@ -0,0 +1,33 @@
+From bfa54a793ba77ef696755b66f3ac4ed00c7d1248 Mon Sep 17 00:00:00 2001
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+Date: Sat, 27 Jul 2024 16:34:01 +0800
+Subject: driver core: bus: Fix double free in driver API bus_register()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 upstream.
+
+For bus_register(), any error which happens after kset_register() will
+cause that @priv are freed twice, fixed by setting @priv with NULL after
+the first free.
+
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Link: https://lore.kernel.org/r/20240727-bus_register_fix-v1-1-fed8dd0dba7a@quicinc.com
+[ hagar : required setting bus->p with NULL instead of priv]
+Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/bus.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -873,6 +873,8 @@ bus_devices_fail:
+       bus_remove_file(bus, &bus_attr_uevent);
+ bus_uevent_fail:
+       kset_unregister(&bus->p->subsys);
++      /* Above kset_unregister() will kfree @bus->p */
++      bus->p = NULL;
+ out:
+       kfree(bus->p);
+       bus->p = NULL;

diff --git a/queue-5.4/ima-fix-use-after-free-on-a-dentry-s-dname.name.patch b/queue-5.4/ima-fix-use-after-free-on-a-dentry-s-dname.name.patch
new file mode 100644 (file)
index 0000000..322711d
--- /dev/null
+++ b/queue-5.4/ima-fix-use-after-free-on-a-dentry-s-dname.name.patch
@@ -0,0 +1,115 @@
+From be84f32bb2c981ca670922e047cdde1488b233de Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.ibm.com>
+Date: Fri, 22 Mar 2024 10:03:12 -0400
+Subject: ima: Fix use-after-free on a dentry's dname.name
+
+From: Stefan Berger <stefanb@linux.ibm.com>
+
+commit be84f32bb2c981ca670922e047cdde1488b233de upstream.
+
+->d_name.name can change on rename and the earlier value can be freed;
+there are conditions sufficient to stabilize it (->d_lock on dentry,
+->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
+rename_lock), but none of those are met at any of the sites. Take a stable
+snapshot of the name instead.
+
+Link: https://lore.kernel.org/all/20240202182732.GE2087318@ZenIV/
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+[ Samasth: bp to fix CVE-2024-39494; Minor conflict resolved due to code context change ]
+Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/integrity/ima/ima_api.c          |   16 ++++++++++++----
+ security/integrity/ima/ima_template_lib.c |   17 ++++++++++++++---
+ 2 files changed, 26 insertions(+), 7 deletions(-)
+
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -210,7 +210,7 @@ int ima_collect_measurement(struct integ
+       const char *audit_cause = "failed";
+       struct inode *inode = file_inode(file);
+       struct inode *real_inode = d_real_inode(file_dentry(file));
+-      const char *filename = file->f_path.dentry->d_name.name;
++      struct name_snapshot filename;
+       int result = 0;
+       int length;
+       void *tmpbuf;
+@@ -273,9 +273,13 @@ out:
+               if (file->f_flags & O_DIRECT)
+                       audit_cause = "failed(directio)";
+ 
++              take_dentry_name_snapshot(&filename, file->f_path.dentry);
++
+               integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
+-                                  filename, "collect_data", audit_cause,
+-                                  result, 0);
++                                  filename.name.name, "collect_data",
++                                  audit_cause, result, 0);
++
++              release_dentry_name_snapshot(&filename);
+       }
+       return result;
+ }
+@@ -388,6 +392,7 @@ out:
+  */
+ const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf)
+ {
++      struct name_snapshot filename;
+       char *pathname = NULL;
+ 
+       *pathbuf = __getname();
+@@ -401,7 +406,10 @@ const char *ima_d_path(const struct path
+       }
+ 
+       if (!pathname) {
+-              strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX);
++              take_dentry_name_snapshot(&filename, path->dentry);
++              strscpy(namebuf, filename.name.name, NAME_MAX);
++              release_dentry_name_snapshot(&filename);
++
+               pathname = namebuf;
+       }
+ 
+--- a/security/integrity/ima/ima_template_lib.c
++++ b/security/integrity/ima/ima_template_lib.c
+@@ -387,7 +387,10 @@ static int ima_eventname_init_common(str
+                                    bool size_limit)
+ {
+       const char *cur_filename = NULL;
++      struct name_snapshot filename;
+       u32 cur_filename_len = 0;
++      bool snapshot = false;
++      int ret;
+ 
+       BUG_ON(event_data->filename == NULL && event_data->file == NULL);
+ 
+@@ -400,7 +403,10 @@ static int ima_eventname_init_common(str
+       }
+ 
+       if (event_data->file) {
+-              cur_filename = event_data->file->f_path.dentry->d_name.name;
++              take_dentry_name_snapshot(&filename,
++                                        event_data->file->f_path.dentry);
++              snapshot = true;
++              cur_filename = filename.name.name;
+               cur_filename_len = strlen(cur_filename);
+       } else
+               /*
+@@ -409,8 +415,13 @@ static int ima_eventname_init_common(str
+                */
+               cur_filename_len = IMA_EVENT_NAME_LEN_MAX;
+ out:
+-      return ima_write_template_field_data(cur_filename, cur_filename_len,
+-                                           DATA_FMT_STRING, field_data);
++      ret = ima_write_template_field_data(cur_filename, cur_filename_len,
++                                          DATA_FMT_STRING, field_data);
++
++      if (snapshot)
++              release_dentry_name_snapshot(&filename);
++
++      return ret;
+ }
+ 
+ /*

diff --git a/queue-5.4/pps-fix-a-use-after-free.patch b/queue-5.4/pps-fix-a-use-after-free.patch
new file mode 100644 (file)
index 0000000..6f9cf50
--- /dev/null
+++ b/queue-5.4/pps-fix-a-use-after-free.patch
@@ -0,0 +1,587 @@
+From c79a39dc8d060b9e64e8b0fa9d245d44befeefbe Mon Sep 17 00:00:00 2001
+From: Calvin Owens <calvin@wbinvd.org>
+Date: Mon, 11 Nov 2024 20:13:29 -0800
+Subject: pps: Fix a use-after-free
+
+From: Calvin Owens <calvin@wbinvd.org>
+
+commit c79a39dc8d060b9e64e8b0fa9d245d44befeefbe upstream.
+
+On a board running ntpd and gpsd, I'm seeing a consistent use-after-free
+in sys_exit() from gpsd when rebooting:
+
+    pps pps1: removed
+    ------------[ cut here ]------------
+    kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.
+    WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150
+    CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1
+    Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
+    pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+    pc : kobject_put+0x120/0x150
+    lr : kobject_put+0x120/0x150
+    sp : ffffffc0803d3ae0
+    x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001
+    x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440
+    x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600
+    x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000
+    x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20
+    x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000
+    x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
+    x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
+    x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
+    x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
+    Call trace:
+     kobject_put+0x120/0x150
+     cdev_put+0x20/0x3c
+     __fput+0x2c4/0x2d8
+     ____fput+0x1c/0x38
+     task_work_run+0x70/0xfc
+     do_exit+0x2a0/0x924
+     do_group_exit+0x34/0x90
+     get_signal+0x7fc/0x8c0
+     do_signal+0x128/0x13b4
+     do_notify_resume+0xdc/0x160
+     el0_svc+0xd4/0xf8
+     el0t_64_sync_handler+0x140/0x14c
+     el0t_64_sync+0x190/0x194
+    ---[ end trace 0000000000000000 ]---
+
+...followed by more symptoms of corruption, with similar stacks:
+
+    refcount_t: underflow; use-after-free.
+    kernel BUG at lib/list_debug.c:62!
+    Kernel panic - not syncing: Oops - BUG: Fatal exception
+
+This happens because pps_device_destruct() frees the pps_device with the
+embedded cdev immediately after calling cdev_del(), but, as the comment
+above cdev_del() notes, fops for previously opened cdevs are still
+callable even after cdev_del() returns. I think this bug has always
+been there: I can't explain why it suddenly started happening every time
+I reboot this particular board.
+
+In commit d953e0e837e6 ("pps: Fix a use-after free bug when
+unregistering a source."), George Spelvin suggested removing the
+embedded cdev. That seems like the simplest way to fix this, so I've
+implemented his suggestion, using __register_chrdev() with pps_idr
+becoming the source of truth for which minor corresponds to which
+device.
+
+But now that pps_idr defines userspace visibility instead of cdev_add(),
+we need to be sure the pps->dev refcount can't reach zero while
+userspace can still find it again. So, the idr_remove() call moves to
+pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.
+
+    pps_core: source serial1 got cdev (251:1)
+    <...>
+    pps pps1: removed
+    pps_core: unregistering pps1
+    pps_core: deallocating pps1
+
+Fixes: d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Calvin Owens <calvin@wbinvd.org>
+Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
+Link: https://lore.kernel.org/r/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pps/clients/pps-gpio.c    |    4 -
+ drivers/pps/clients/pps-ktimer.c  |    4 -
+ drivers/pps/clients/pps-ldisc.c   |    6 -
+ drivers/pps/clients/pps_parport.c |    4 -
+ drivers/pps/kapi.c                |   10 +-
+ drivers/pps/kc.c                  |   10 +-
+ drivers/pps/pps.c                 |  127 +++++++++++++++++++-------------------
+ include/linux/pps_kernel.h        |    3 
+ 8 files changed, 86 insertions(+), 82 deletions(-)
+
+--- a/drivers/pps/clients/pps-gpio.c
++++ b/drivers/pps/clients/pps-gpio.c
+@@ -232,8 +232,8 @@ static int pps_gpio_probe(struct platfor
+               return -EINVAL;
+       }
+ 
+-      dev_info(data->pps->dev, "Registered IRQ %d as PPS source\n",
+-               data->irq);
++      dev_dbg(&data->pps->dev, "Registered IRQ %d as PPS source\n",
++              data->irq);
+ 
+       return 0;
+ }
+--- a/drivers/pps/clients/pps-ktimer.c
++++ b/drivers/pps/clients/pps-ktimer.c
+@@ -56,7 +56,7 @@ static struct pps_source_info pps_ktimer
+ 
+ static void __exit pps_ktimer_exit(void)
+ {
+-      dev_info(pps->dev, "ktimer PPS source unregistered\n");
++      dev_dbg(&pps->dev, "ktimer PPS source unregistered\n");
+ 
+       del_timer_sync(&ktimer);
+       pps_unregister_source(pps);
+@@ -74,7 +74,7 @@ static int __init pps_ktimer_init(void)
+       timer_setup(&ktimer, pps_ktimer_event, 0);
+       mod_timer(&ktimer, jiffies + HZ);
+ 
+-      dev_info(pps->dev, "ktimer PPS source registered\n");
++      dev_dbg(&pps->dev, "ktimer PPS source registered\n");
+ 
+       return 0;
+ }
+--- a/drivers/pps/clients/pps-ldisc.c
++++ b/drivers/pps/clients/pps-ldisc.c
+@@ -34,7 +34,7 @@ static void pps_tty_dcd_change(struct tt
+       pps_event(pps, &ts, status ? PPS_CAPTUREASSERT :
+                       PPS_CAPTURECLEAR, NULL);
+ 
+-      dev_dbg(pps->dev, "PPS %s at %lu\n",
++      dev_dbg(&pps->dev, "PPS %s at %lu\n",
+                       status ? "assert" : "clear", jiffies);
+ }
+ 
+@@ -71,7 +71,7 @@ static int pps_tty_open(struct tty_struc
+               goto err_unregister;
+       }
+ 
+-      dev_info(pps->dev, "source \"%s\" added\n", info.path);
++      dev_dbg(&pps->dev, "source \"%s\" added\n", info.path);
+ 
+       return 0;
+ 
+@@ -91,7 +91,7 @@ static void pps_tty_close(struct tty_str
+       if (WARN_ON(!pps))
+               return;
+ 
+-      dev_info(pps->dev, "removed\n");
++      dev_info(&pps->dev, "removed\n");
+       pps_unregister_source(pps);
+ }
+ 
+--- a/drivers/pps/clients/pps_parport.c
++++ b/drivers/pps/clients/pps_parport.c
+@@ -83,7 +83,7 @@ static void parport_irq(void *handle)
+       /* check the signal (no signal means the pulse is lost this time) */
+       if (!signal_is_set(port)) {
+               local_irq_restore(flags);
+-              dev_err(dev->pps->dev, "lost the signal\n");
++              dev_err(&dev->pps->dev, "lost the signal\n");
+               goto out_assert;
+       }
+ 
+@@ -100,7 +100,7 @@ static void parport_irq(void *handle)
+       /* timeout */
+       dev->cw_err++;
+       if (dev->cw_err >= CLEAR_WAIT_MAX_ERRORS) {
+-              dev_err(dev->pps->dev, "disabled clear edge capture after %d"
++              dev_err(&dev->pps->dev, "disabled clear edge capture after %d"
+                               " timeouts\n", dev->cw_err);
+               dev->cw = 0;
+               dev->cw_err = 0;
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -41,7 +41,7 @@ static void pps_add_offset(struct pps_kt
+ static void pps_echo_client_default(struct pps_device *pps, int event,
+               void *data)
+ {
+-      dev_info(pps->dev, "echo %s %s\n",
++      dev_info(&pps->dev, "echo %s %s\n",
+               event & PPS_CAPTUREASSERT ? "assert" : "",
+               event & PPS_CAPTURECLEAR ? "clear" : "");
+ }
+@@ -112,7 +112,7 @@ struct pps_device *pps_register_source(s
+               goto kfree_pps;
+       }
+ 
+-      dev_info(pps->dev, "new PPS source %s\n", info->name);
++      dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+ 
+       return pps;
+ 
+@@ -166,7 +166,7 @@ void pps_event(struct pps_device *pps, s
+       /* check event type */
+       BUG_ON((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0);
+ 
+-      dev_dbg(pps->dev, "PPS event at %lld.%09ld\n",
++      dev_dbg(&pps->dev, "PPS event at %lld.%09ld\n",
+                       (s64)ts->ts_real.tv_sec, ts->ts_real.tv_nsec);
+ 
+       timespec_to_pps_ktime(&ts_real, ts->ts_real);
+@@ -188,7 +188,7 @@ void pps_event(struct pps_device *pps, s
+               /* Save the time stamp */
+               pps->assert_tu = ts_real;
+               pps->assert_sequence++;
+-              dev_dbg(pps->dev, "capture assert seq #%u\n",
++              dev_dbg(&pps->dev, "capture assert seq #%u\n",
+                       pps->assert_sequence);
+ 
+               captured = ~0;
+@@ -202,7 +202,7 @@ void pps_event(struct pps_device *pps, s
+               /* Save the time stamp */
+               pps->clear_tu = ts_real;
+               pps->clear_sequence++;
+-              dev_dbg(pps->dev, "capture clear seq #%u\n",
++              dev_dbg(&pps->dev, "capture clear seq #%u\n",
+                       pps->clear_sequence);
+ 
+               captured = ~0;
+--- a/drivers/pps/kc.c
++++ b/drivers/pps/kc.c
+@@ -43,11 +43,11 @@ int pps_kc_bind(struct pps_device *pps,
+                       pps_kc_hardpps_mode = 0;
+                       pps_kc_hardpps_dev = NULL;
+                       spin_unlock_irq(&pps_kc_hardpps_lock);
+-                      dev_info(pps->dev, "unbound kernel"
++                      dev_info(&pps->dev, "unbound kernel"
+                                       " consumer\n");
+               } else {
+                       spin_unlock_irq(&pps_kc_hardpps_lock);
+-                      dev_err(pps->dev, "selected kernel consumer"
++                      dev_err(&pps->dev, "selected kernel consumer"
+                                       " is not bound\n");
+                       return -EINVAL;
+               }
+@@ -57,11 +57,11 @@ int pps_kc_bind(struct pps_device *pps,
+                       pps_kc_hardpps_mode = bind_args->edge;
+                       pps_kc_hardpps_dev = pps;
+                       spin_unlock_irq(&pps_kc_hardpps_lock);
+-                      dev_info(pps->dev, "bound kernel consumer: "
++                      dev_info(&pps->dev, "bound kernel consumer: "
+                               "edge=0x%x\n", bind_args->edge);
+               } else {
+                       spin_unlock_irq(&pps_kc_hardpps_lock);
+-                      dev_err(pps->dev, "another kernel consumer"
++                      dev_err(&pps->dev, "another kernel consumer"
+                                       " is already bound\n");
+                       return -EINVAL;
+               }
+@@ -83,7 +83,7 @@ void pps_kc_remove(struct pps_device *pp
+               pps_kc_hardpps_mode = 0;
+               pps_kc_hardpps_dev = NULL;
+               spin_unlock_irq(&pps_kc_hardpps_lock);
+-              dev_info(pps->dev, "unbound kernel consumer"
++              dev_info(&pps->dev, "unbound kernel consumer"
+                               " on device removal\n");
+       } else
+               spin_unlock_irq(&pps_kc_hardpps_lock);
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -25,7 +25,7 @@
+  * Local variables
+  */
+ 
+-static dev_t pps_devt;
++static int pps_major;
+ static struct class *pps_class;
+ 
+ static DEFINE_MUTEX(pps_idr_lock);
+@@ -62,7 +62,7 @@ static int pps_cdev_pps_fetch(struct pps
+       else {
+               unsigned long ticks;
+ 
+-              dev_dbg(pps->dev, "timeout %lld.%09d\n",
++              dev_dbg(&pps->dev, "timeout %lld.%09d\n",
+                               (long long) fdata->timeout.sec,
+                               fdata->timeout.nsec);
+               ticks = fdata->timeout.sec * HZ;
+@@ -80,7 +80,7 @@ static int pps_cdev_pps_fetch(struct pps
+ 
+       /* Check for pending signals */
+       if (err == -ERESTARTSYS) {
+-              dev_dbg(pps->dev, "pending signal caught\n");
++              dev_dbg(&pps->dev, "pending signal caught\n");
+               return -EINTR;
+       }
+ 
+@@ -98,7 +98,7 @@ static long pps_cdev_ioctl(struct file *
+ 
+       switch (cmd) {
+       case PPS_GETPARAMS:
+-              dev_dbg(pps->dev, "PPS_GETPARAMS\n");
++              dev_dbg(&pps->dev, "PPS_GETPARAMS\n");
+ 
+               spin_lock_irq(&pps->lock);
+ 
+@@ -114,7 +114,7 @@ static long pps_cdev_ioctl(struct file *
+               break;
+ 
+       case PPS_SETPARAMS:
+-              dev_dbg(pps->dev, "PPS_SETPARAMS\n");
++              dev_dbg(&pps->dev, "PPS_SETPARAMS\n");
+ 
+               /* Check the capabilities */
+               if (!capable(CAP_SYS_TIME))
+@@ -124,14 +124,14 @@ static long pps_cdev_ioctl(struct file *
+               if (err)
+                       return -EFAULT;
+               if (!(params.mode & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR))) {
+-                      dev_dbg(pps->dev, "capture mode unspecified (%x)\n",
++                      dev_dbg(&pps->dev, "capture mode unspecified (%x)\n",
+                                                               params.mode);
+                       return -EINVAL;
+               }
+ 
+               /* Check for supported capabilities */
+               if ((params.mode & ~pps->info.mode) != 0) {
+-                      dev_dbg(pps->dev, "unsupported capabilities (%x)\n",
++                      dev_dbg(&pps->dev, "unsupported capabilities (%x)\n",
+                                                               params.mode);
+                       return -EINVAL;
+               }
+@@ -144,7 +144,7 @@ static long pps_cdev_ioctl(struct file *
+               /* Restore the read only parameters */
+               if ((params.mode & (PPS_TSFMT_TSPEC | PPS_TSFMT_NTPFP)) == 0) {
+                       /* section 3.3 of RFC 2783 interpreted */
+-                      dev_dbg(pps->dev, "time format unspecified (%x)\n",
++                      dev_dbg(&pps->dev, "time format unspecified (%x)\n",
+                                                               params.mode);
+                       pps->params.mode |= PPS_TSFMT_TSPEC;
+               }
+@@ -165,7 +165,7 @@ static long pps_cdev_ioctl(struct file *
+               break;
+ 
+       case PPS_GETCAP:
+-              dev_dbg(pps->dev, "PPS_GETCAP\n");
++              dev_dbg(&pps->dev, "PPS_GETCAP\n");
+ 
+               err = put_user(pps->info.mode, iuarg);
+               if (err)
+@@ -176,7 +176,7 @@ static long pps_cdev_ioctl(struct file *
+       case PPS_FETCH: {
+               struct pps_fdata fdata;
+ 
+-              dev_dbg(pps->dev, "PPS_FETCH\n");
++              dev_dbg(&pps->dev, "PPS_FETCH\n");
+ 
+               err = copy_from_user(&fdata, uarg, sizeof(struct pps_fdata));
+               if (err)
+@@ -206,7 +206,7 @@ static long pps_cdev_ioctl(struct file *
+       case PPS_KC_BIND: {
+               struct pps_bind_args bind_args;
+ 
+-              dev_dbg(pps->dev, "PPS_KC_BIND\n");
++              dev_dbg(&pps->dev, "PPS_KC_BIND\n");
+ 
+               /* Check the capabilities */
+               if (!capable(CAP_SYS_TIME))
+@@ -218,7 +218,7 @@ static long pps_cdev_ioctl(struct file *
+ 
+               /* Check for supported capabilities */
+               if ((bind_args.edge & ~pps->info.mode) != 0) {
+-                      dev_err(pps->dev, "unsupported capabilities (%x)\n",
++                      dev_err(&pps->dev, "unsupported capabilities (%x)\n",
+                                       bind_args.edge);
+                       return -EINVAL;
+               }
+@@ -227,7 +227,7 @@ static long pps_cdev_ioctl(struct file *
+               if (bind_args.tsformat != PPS_TSFMT_TSPEC ||
+                               (bind_args.edge & ~PPS_CAPTUREBOTH) != 0 ||
+                               bind_args.consumer != PPS_KC_HARDPPS) {
+-                      dev_err(pps->dev, "invalid kernel consumer bind"
++                      dev_err(&pps->dev, "invalid kernel consumer bind"
+                                       " parameters (%x)\n", bind_args.edge);
+                       return -EINVAL;
+               }
+@@ -259,7 +259,7 @@ static long pps_cdev_compat_ioctl(struct
+               struct pps_fdata fdata;
+               int err;
+ 
+-              dev_dbg(pps->dev, "PPS_FETCH\n");
++              dev_dbg(&pps->dev, "PPS_FETCH\n");
+ 
+               err = copy_from_user(&compat, uarg, sizeof(struct pps_fdata_compat));
+               if (err)
+@@ -296,20 +296,36 @@ static long pps_cdev_compat_ioctl(struct
+ #define pps_cdev_compat_ioctl NULL
+ #endif
+ 
++static struct pps_device *pps_idr_get(unsigned long id)
++{
++      struct pps_device *pps;
++
++      mutex_lock(&pps_idr_lock);
++      pps = idr_find(&pps_idr, id);
++      if (pps)
++              get_device(&pps->dev);
++
++      mutex_unlock(&pps_idr_lock);
++      return pps;
++}
++
+ static int pps_cdev_open(struct inode *inode, struct file *file)
+ {
+-      struct pps_device *pps = container_of(inode->i_cdev,
+-                                              struct pps_device, cdev);
++      struct pps_device *pps = pps_idr_get(iminor(inode));
++
++      if (!pps)
++              return -ENODEV;
++
+       file->private_data = pps;
+-      kobject_get(&pps->dev->kobj);
+       return 0;
+ }
+ 
+ static int pps_cdev_release(struct inode *inode, struct file *file)
+ {
+-      struct pps_device *pps = container_of(inode->i_cdev,
+-                                              struct pps_device, cdev);
+-      kobject_put(&pps->dev->kobj);
++      struct pps_device *pps = file->private_data;
++
++      WARN_ON(pps->id != iminor(inode));
++      put_device(&pps->dev);
+       return 0;
+ }
+ 
+@@ -332,22 +348,13 @@ static void pps_device_destruct(struct d
+ {
+       struct pps_device *pps = dev_get_drvdata(dev);
+ 
+-      cdev_del(&pps->cdev);
+-
+-      /* Now we can release the ID for re-use */
+       pr_debug("deallocating pps%d\n", pps->id);
+-      mutex_lock(&pps_idr_lock);
+-      idr_remove(&pps_idr, pps->id);
+-      mutex_unlock(&pps_idr_lock);
+-
+-      kfree(dev);
+       kfree(pps);
+ }
+ 
+ int pps_register_cdev(struct pps_device *pps)
+ {
+       int err;
+-      dev_t devt;
+ 
+       mutex_lock(&pps_idr_lock);
+       /*
+@@ -364,40 +371,29 @@ int pps_register_cdev(struct pps_device
+               goto out_unlock;
+       }
+       pps->id = err;
+-      mutex_unlock(&pps_idr_lock);
+-
+-      devt = MKDEV(MAJOR(pps_devt), pps->id);
+-
+-      cdev_init(&pps->cdev, &pps_cdev_fops);
+-      pps->cdev.owner = pps->info.owner;
+ 
+-      err = cdev_add(&pps->cdev, devt, 1);
+-      if (err) {
+-              pr_err("%s: failed to add char device %d:%d\n",
+-                              pps->info.name, MAJOR(pps_devt), pps->id);
++      pps->dev.class = pps_class;
++      pps->dev.parent = pps->info.dev;
++      pps->dev.devt = MKDEV(pps_major, pps->id);
++      dev_set_drvdata(&pps->dev, pps);
++      dev_set_name(&pps->dev, "pps%d", pps->id);
++      err = device_register(&pps->dev);
++      if (err)
+               goto free_idr;
+-      }
+-      pps->dev = device_create(pps_class, pps->info.dev, devt, pps,
+-                                                      "pps%d", pps->id);
+-      if (IS_ERR(pps->dev)) {
+-              err = PTR_ERR(pps->dev);
+-              goto del_cdev;
+-      }
+ 
+       /* Override the release function with our own */
+-      pps->dev->release = pps_device_destruct;
++      pps->dev.release = pps_device_destruct;
+ 
+-      pr_debug("source %s got cdev (%d:%d)\n", pps->info.name,
+-                      MAJOR(pps_devt), pps->id);
++      pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
++               pps->id);
+ 
++      get_device(&pps->dev);
++      mutex_unlock(&pps_idr_lock);
+       return 0;
+ 
+-del_cdev:
+-      cdev_del(&pps->cdev);
+-
+ free_idr:
+-      mutex_lock(&pps_idr_lock);
+       idr_remove(&pps_idr, pps->id);
++      put_device(&pps->dev);
+ out_unlock:
+       mutex_unlock(&pps_idr_lock);
+       return err;
+@@ -407,7 +403,13 @@ void pps_unregister_cdev(struct pps_devi
+ {
+       pr_debug("unregistering pps%d\n", pps->id);
+       pps->lookup_cookie = NULL;
+-      device_destroy(pps_class, pps->dev->devt);
++      device_destroy(pps_class, pps->dev.devt);
++
++      /* Now we can release the ID for re-use */
++      mutex_lock(&pps_idr_lock);
++      idr_remove(&pps_idr, pps->id);
++      put_device(&pps->dev);
++      mutex_unlock(&pps_idr_lock);
+ }
+ 
+ /*
+@@ -427,6 +429,11 @@ void pps_unregister_cdev(struct pps_devi
+  * so that it will not be used again, even if the pps device cannot
+  * be removed from the idr due to pending references holding the minor
+  * number in use.
++ *
++ * Since pps_idr holds a reference to the device, the returned
++ * pps_device is guaranteed to be valid until pps_unregister_cdev() is
++ * called on it. But after calling pps_unregister_cdev(), it may be
++ * freed at any time.
+  */
+ struct pps_device *pps_lookup_dev(void const *cookie)
+ {
+@@ -449,13 +456,11 @@ EXPORT_SYMBOL(pps_lookup_dev);
+ static void __exit pps_exit(void)
+ {
+       class_destroy(pps_class);
+-      unregister_chrdev_region(pps_devt, PPS_MAX_SOURCES);
++      __unregister_chrdev(pps_major, 0, PPS_MAX_SOURCES, "pps");
+ }
+ 
+ static int __init pps_init(void)
+ {
+-      int err;
+-
+       pps_class = class_create(THIS_MODULE, "pps");
+       if (IS_ERR(pps_class)) {
+               pr_err("failed to allocate class\n");
+@@ -463,8 +468,9 @@ static int __init pps_init(void)
+       }
+       pps_class->dev_groups = pps_groups;
+ 
+-      err = alloc_chrdev_region(&pps_devt, 0, PPS_MAX_SOURCES, "pps");
+-      if (err < 0) {
++      pps_major = __register_chrdev(0, 0, PPS_MAX_SOURCES, "pps",
++                                    &pps_cdev_fops);
++      if (pps_major < 0) {
+               pr_err("failed to allocate char device region\n");
+               goto remove_class;
+       }
+@@ -477,8 +483,7 @@ static int __init pps_init(void)
+ 
+ remove_class:
+       class_destroy(pps_class);
+-
+-      return err;
++      return pps_major;
+ }
+ 
+ subsys_initcall(pps_init);
+--- a/include/linux/pps_kernel.h
++++ b/include/linux/pps_kernel.h
+@@ -56,8 +56,7 @@ struct pps_device {
+ 
+       unsigned int id;                        /* PPS source unique ID */
+       void const *lookup_cookie;              /* For pps_lookup_dev() only */
+-      struct cdev cdev;
+-      struct device *dev;
++      struct device dev;
+       struct fasync_struct *async_queue;      /* fasync method */
+       spinlock_t lock;
+ };

diff --git a/queue-5.4/revert-btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch b/queue-5.4/revert-btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
new file mode 100644 (file)
index 0000000..d7ff820
--- /dev/null
+++ b/queue-5.4/revert-btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
@@ -0,0 +1,36 @@
+From stable+bounces-114126-greg=kroah.com@vger.kernel.org Thu Feb  6 17:19:17 2025
+From: Koichiro Den <koichiro.den@canonical.com>
+Date: Fri,  7 Feb 2025 01:18:24 +0900
+Subject: Revert "btrfs: avoid monopolizing a core when activating a swap file"
+To: gregkh@linuxfoundation.org, stable@vger.kernel.org
+Cc: wqu@suse.com, fdmanana@suse.com, dsterba@suse.com
+Message-ID: <20250206161825.1386953-1-koichiro.den@canonical.com>
+
+From: Koichiro Den <koichiro.den@canonical.com>
+
+This reverts commit 3d770d44dd5c6316913b003790998404636ec2a8.
+
+The backport for linux-5.4.y, commit 3d770d44dd5c ("btrfs: avoid
+monopolizing a core when activating a swap file"), inserted
+cond_resched() in the wrong location.
+
+Revert it now; a subsequent commit will re-backport the original patch.
+
+Fixes: 3d770d44dd5c ("btrfs: avoid monopolizing a core when activating a swap file") # linux-5.4.y
+Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -7679,8 +7679,6 @@ noinline int can_nocow_extent(struct ino
+                       ret = -EAGAIN;
+                       goto out;
+               }
+-
+-              cond_resched();
+       }
+ 
+       btrfs_release_path(path);

diff --git a/queue-5.4/scsi-storvsc-set-correct-data-length-for-sending-scsi-command-without-payload.patch b/queue-5.4/scsi-storvsc-set-correct-data-length-for-sending-scsi-command-without-payload.patch
new file mode 100644 (file)
index 0000000..84b2419
--- /dev/null
+++ b/queue-5.4/scsi-storvsc-set-correct-data-length-for-sending-scsi-command-without-payload.patch
@@ -0,0 +1,45 @@
+From 87c4b5e8a6b65189abd9ea5010ab308941f964a4 Mon Sep 17 00:00:00 2001
+From: Long Li <longli@microsoft.com>
+Date: Wed, 22 Jan 2025 19:07:22 -0800
+Subject: scsi: storvsc: Set correct data length for sending SCSI command without payload
+
+From: Long Li <longli@microsoft.com>
+
+commit 87c4b5e8a6b65189abd9ea5010ab308941f964a4 upstream.
+
+In StorVSC, payload->range.len is used to indicate if this SCSI command
+carries payload. This data is allocated as part of the private driver data
+by the upper layer and may get passed to lower driver uninitialized.
+
+For example, the SCSI error handling mid layer may send TEST_UNIT_READY or
+REQUEST_SENSE while reusing the buffer from a failed command. The private
+data section may have stale data from the previous command.
+
+If the SCSI command doesn't carry payload, the driver may use this value as
+is for communicating with host, resulting in possible corruption.
+
+Fix this by always initializing this value.
+
+Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
+Cc: stable@kernel.org
+Tested-by: Roman Kisel <romank@linux.microsoft.com>
+Reviewed-by: Roman Kisel <romank@linux.microsoft.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Signed-off-by: Long Li <longli@microsoft.com>
+Link: https://lore.kernel.org/r/1737601642-7759-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/storvsc_drv.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1639,6 +1639,7 @@ static int storvsc_queuecommand(struct S
+       length = scsi_bufflen(scmnd);
+       payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;
+       payload_sz = sizeof(cmd_request->mpb);
++      payload->range.len = 0;
+ 
+       if (sg_count) {
+               if (sg_count > MAX_PAGE_BUFFER_COUNT) {

diff --git a/queue-5.4/series b/queue-5.4/series
index 6da2e6d68f7c96347603b1165b92d1866a9105f0..a3656ccb65c760797750d8e12efd2ea7eeba1b6c 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -210,3 +210,11 @@ can-ems_pci-move-asix-ax99100-ids-to-pci_ids.h.patch
 serial-8250_pci-add-support-for-asix-ax99100.patch
 parport_pc-add-support-for-asix-ax99100.patch
 x86-i8253-disable-pit-timer-0-when-not-in-use.patch
+revert-btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
+btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
+pps-fix-a-use-after-free.patch
+ima-fix-use-after-free-on-a-dentry-s-dname.name.patch
+vlan-introduce-vlan_dev_free_egress_priority.patch
+vlan-move-dev_put-into-vlan_dev_uninit.patch
+scsi-storvsc-set-correct-data-length-for-sending-scsi-command-without-payload.patch
+driver-core-bus-fix-double-free-in-driver-api-bus_register.patch

diff --git a/queue-5.4/vlan-introduce-vlan_dev_free_egress_priority.patch b/queue-5.4/vlan-introduce-vlan_dev_free_egress_priority.patch
new file mode 100644 (file)
index 0000000..9b08437
--- /dev/null
+++ b/queue-5.4/vlan-introduce-vlan_dev_free_egress_priority.patch
@@ -0,0 +1,83 @@
+From 37aa50c539bcbcc01767e515bd170787fcfc0f33 Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Wed, 9 Feb 2022 03:19:55 -0500
+Subject: vlan: introduce vlan_dev_free_egress_priority
+
+From: Xin Long <lucien.xin@gmail.com>
+
+commit 37aa50c539bcbcc01767e515bd170787fcfc0f33 upstream.
+
+This patch is to introduce vlan_dev_free_egress_priority() to
+free egress priority for vlan dev, and keep vlan_dev_uninit()
+static as .ndo_uninit. It makes the code more clear and safer
+when adding new code in vlan_dev_uninit() in the future.
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
+Signed-off-by: Ivan Delalande <colona@arista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/8021q/vlan.h         |    2 +-
+ net/8021q/vlan_dev.c     |    7 ++++++-
+ net/8021q/vlan_netlink.c |    7 ++++---
+ 3 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/net/8021q/vlan.h
++++ b/net/8021q/vlan.h
+@@ -117,6 +117,7 @@ void vlan_dev_set_ingress_priority(const
+                                  u32 skb_prio, u16 vlan_prio);
+ int vlan_dev_set_egress_priority(const struct net_device *dev,
+                                u32 skb_prio, u16 vlan_prio);
++void vlan_dev_free_egress_priority(const struct net_device *dev);
+ int vlan_dev_change_flags(const struct net_device *dev, u32 flag, u32 mask);
+ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result);
+ 
+@@ -126,7 +127,6 @@ int vlan_check_real_dev(struct net_devic
+ void vlan_setup(struct net_device *dev);
+ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack);
+ void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
+-void vlan_dev_uninit(struct net_device *dev);
+ bool vlan_dev_inherit_address(struct net_device *dev,
+                             struct net_device *real_dev);
+ 
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -590,7 +590,7 @@ static int vlan_dev_init(struct net_devi
+ }
+ 
+ /* Note: this function might be called multiple times for the same device. */
+-void vlan_dev_uninit(struct net_device *dev)
++void vlan_dev_free_egress_priority(const struct net_device *dev)
+ {
+       struct vlan_priority_tci_mapping *pm;
+       struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+@@ -604,6 +604,11 @@ void vlan_dev_uninit(struct net_device *
+       }
+ }
+ 
++static void vlan_dev_uninit(struct net_device *dev)
++{
++      vlan_dev_free_egress_priority(dev);
++}
++
+ static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
+       netdev_features_t features)
+ {
+--- a/net/8021q/vlan_netlink.c
++++ b/net/8021q/vlan_netlink.c
+@@ -187,10 +187,11 @@ static int vlan_newlink(struct net *src_
+               return -EINVAL;
+ 
+       err = vlan_changelink(dev, tb, data, extack);
+-      if (!err)
+-              err = register_vlan_dev(dev, extack);
+       if (err)
+-              vlan_dev_uninit(dev);
++              return err;
++      err = register_vlan_dev(dev, extack);
++      if (err)
++              vlan_dev_free_egress_priority(dev);
+       return err;
+ }
+ 

diff --git a/queue-5.4/vlan-move-dev_put-into-vlan_dev_uninit.patch b/queue-5.4/vlan-move-dev_put-into-vlan_dev_uninit.patch
new file mode 100644 (file)
index 0000000..b5da45a
--- /dev/null
+++ b/queue-5.4/vlan-move-dev_put-into-vlan_dev_uninit.patch
@@ -0,0 +1,70 @@
+From d6ff94afd90b0ce8d1715f8ef77d4347d7a7f2c0 Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Wed, 9 Feb 2022 03:19:56 -0500
+Subject: vlan: move dev_put into vlan_dev_uninit
+
+From: Xin Long <lucien.xin@gmail.com>
+
+commit d6ff94afd90b0ce8d1715f8ef77d4347d7a7f2c0 upstream.
+
+Shuang Li reported an QinQ issue by simply doing:
+
+  # ip link add dummy0 type dummy
+  # ip link add link dummy0 name dummy0.1 type vlan id 1
+  # ip link add link dummy0.1 name dummy0.1.2 type vlan id 2
+  # rmmod 8021q
+
+ unregister_netdevice: waiting for dummy0.1 to become free. Usage count = 1
+
+When rmmods 8021q, all vlan devs are deleted from their real_dev's vlan grp
+and added into list_kill by unregister_vlan_dev(). dummy0.1 is unregistered
+before dummy0.1.2, as it's using for_each_netdev() in __rtnl_kill_links().
+
+When unregisters dummy0.1, dummy0.1.2 is not unregistered in the event of
+NETDEV_UNREGISTER, as it's been deleted from dummy0.1's vlan grp. However,
+due to dummy0.1.2 still holding dummy0.1, dummy0.1 will keep waiting in
+netdev_wait_allrefs(), while dummy0.1.2 will never get unregistered and
+release dummy0.1, as it delays dev_put until calling dev->priv_destructor,
+vlan_dev_free().
+
+This issue was introduced by Commit 563bcbae3ba2 ("net: vlan: fix a UAF in
+vlan_dev_real_dev()"), and this patch is to fix it by moving dev_put() into
+vlan_dev_uninit(), which is called after NETDEV_UNREGISTER event but before
+netdev_wait_allrefs().
+
+Fixes: 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()")
+Reported-by: Shuang Li <shuali@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
+Signed-off-by: Ivan Delalande <colona@arista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/8021q/vlan_dev.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -606,7 +606,12 @@ void vlan_dev_free_egress_priority(const
+ 
+ static void vlan_dev_uninit(struct net_device *dev)
+ {
++      struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
++
+       vlan_dev_free_egress_priority(dev);
++
++      /* Get rid of the vlan's reference to real_dev */
++      dev_put(vlan->real_dev);
+ }
+ 
+ static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
+@@ -798,9 +803,6 @@ static void vlan_dev_free(struct net_dev
+ 
+       free_percpu(vlan->vlan_pcpu_stats);
+       vlan->vlan_pcpu_stats = NULL;
+-
+-      /* Get rid of the vlan's reference to real_dev */
+-      dev_put(vlan->real_dev);
+ }
+ 
+ void vlan_setup(struct net_device *dev)