4.9-stable patches

added patches:
	arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch
	netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch

diff --git a/queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch b/queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch
new file mode 100644 (file)
index 0000000..22775e9
--- /dev/null
+++ b/queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch
@@ -0,0 +1,42 @@
+From 849adec41203ac5837c40c2d7e08490ffdef3c2c Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Mon, 29 Jul 2019 11:06:17 +0100
+Subject: arm64: compat: Allow single-byte watchpoints on all addresses
+
+From: Will Deacon <will@kernel.org>
+
+commit 849adec41203ac5837c40c2d7e08490ffdef3c2c upstream.
+
+Commit d968d2b801d8 ("ARM: 7497/1: hw_breakpoint: allow single-byte
+watchpoints on all addresses") changed the validation requirements for
+hardware watchpoints on arch/arm/. Update our compat layer to implement
+the same relaxation.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/hw_breakpoint.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/kernel/hw_breakpoint.c
++++ b/arch/arm64/kernel/hw_breakpoint.c
+@@ -508,13 +508,14 @@ int arch_validate_hwbkpt_settings(struct
+                       /* Aligned */
+                       break;
+               case 1:
+-                      /* Allow single byte watchpoint. */
+-                      if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
+-                              break;
+               case 2:
+                       /* Allow halfword watchpoints and breakpoints. */
+                       if (info->ctrl.len == ARM_BREAKPOINT_LEN_2)
+                               break;
++              case 3:
++                      /* Allow single byte watchpoint. */
++                      if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
++                              break;
+               default:
+                       return -EINVAL;
+               }

diff --git a/queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch b/queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch
new file mode 100644 (file)
index 0000000..7a86a01
--- /dev/null
+++ b/queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch
@@ -0,0 +1,65 @@
+From 656c8e9cc1badbc18eefe6ba01d33ebbcae61b9a Mon Sep 17 00:00:00 2001
+From: Dirk Morris <dmorris@metaloft.com>
+Date: Thu, 8 Aug 2019 13:57:51 -0700
+Subject: netfilter: conntrack: Use consistent ct id hash calculation
+
+From: Dirk Morris <dmorris@metaloft.com>
+
+commit 656c8e9cc1badbc18eefe6ba01d33ebbcae61b9a upstream.
+
+Change ct id hash calculation to only use invariants.
+
+Currently the ct id hash calculation is based on some fields that can
+change in the lifetime on a conntrack entry in some corner cases. The
+current hash uses the whole tuple which contains an hlist pointer which
+will change when the conntrack is placed on the dying list resulting in
+a ct id change.
+
+This patch also removes the reply-side tuple and extension pointer from
+the hash calculation so that the ct id will will not change from
+initialization until confirmation.
+
+Fixes: 3c79107631db1f7 ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id")
+Signed-off-by: Dirk Morris <dmorris@metaloft.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/nf_conntrack_core.c |   16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -308,13 +308,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
+  * table location, we assume id gets exposed to userspace.
+  *
+  * Following nf_conn items do not change throughout lifetime
+- * of the nf_conn after it has been committed to main hash table:
++ * of the nf_conn:
+  *
+  * 1. nf_conn address
+- * 2. nf_conn->ext address
+- * 3. nf_conn->master address (normally NULL)
+- * 4. tuple
+- * 5. the associated net namespace
++ * 2. nf_conn->master address (normally NULL)
++ * 3. the associated net namespace
++ * 4. the original direction tuple
+  */
+ u32 nf_ct_get_id(const struct nf_conn *ct)
+ {
+@@ -324,9 +323,10 @@ u32 nf_ct_get_id(const struct nf_conn *c
+       net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
+ 
+       a = (unsigned long)ct;
+-      b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
+-      c = (unsigned long)ct->ext;
+-      d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
++      b = (unsigned long)ct->master;
++      c = (unsigned long)nf_ct_net(ct);
++      d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
++                                 sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
+                                  &ct_id_seed);
+ #ifdef CONFIG_64BIT
+       return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);

diff --git a/queue-4.9/series b/queue-4.9/series
index 72123d532780e7b96b73dd0b0b830cf7cbba5e67..d0d94f138e26bd9e923e39a6c8ec0b56fb098725 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -90,3 +90,5 @@ usb-serial-option-add-the-broadmobi-bm818-card.patch
 usb-serial-option-add-motorola-modem-uarts.patch
 asm-generic-fix-wtype-limits-compiler-warnings.patch
 bpf-fix-bpf_jit_limit-knob-for-page_size-64k.patch
+arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch
+netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch