3.18-stable patches

added patches:
	inet-frag-enforce-memory-limits-earlier.patch
	net-dsa-do-not-suspend-resume-closed-slave_dev.patch

diff --git a/queue-3.18/inet-frag-enforce-memory-limits-earlier.patch b/queue-3.18/inet-frag-enforce-memory-limits-earlier.patch
new file mode 100644 (file)
index 0000000..8088172
--- /dev/null
+++ b/queue-3.18/inet-frag-enforce-memory-limits-earlier.patch
@@ -0,0 +1,60 @@
+From foo@baz Sat Aug  4 09:17:19 CEST 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 30 Jul 2018 20:09:11 -0700
+Subject: inet: frag: enforce memory limits earlier
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 56e2c94f055d328f5f6b0a5c1721cca2f2d4e0a1 ]
+
+We currently check current frags memory usage only when
+a new frag queue is created. This allows attackers to first
+consume the memory budget (default : 4 MB) creating thousands
+of frag queues, then sending tiny skbs to exceed high_thresh
+limit by 2 to 3 order of magnitude.
+
+Note that before commit 648700f76b03 ("inet: frags: use rhashtables
+for reassembly units"), work queue could be starved under DOS,
+getting no cpu cycles.
+After commit 648700f76b03, only the per frag queue timer can eventually
+remove an incomplete frag queue and its skbs.
+
+Fixes: b13d3cbfb8e8 ("inet: frag: move eviction of queues to work queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Jann Horn <jannh@google.com>
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Peter Oskolkov <posk@google.com>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/inet_fragment.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -379,11 +379,6 @@ static struct inet_frag_queue *inet_frag
+ {
+       struct inet_frag_queue *q;
+ 
+-      if (frag_mem_limit(nf) > nf->high_thresh) {
+-              inet_frag_schedule_worker(f);
+-              return NULL;
+-      }
+-
+       q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
+       if (q == NULL)
+               return NULL;
+@@ -420,6 +415,11 @@ struct inet_frag_queue *inet_frag_find(s
+       struct inet_frag_queue *q;
+       int depth = 0;
+ 
++      if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) {
++              inet_frag_schedule_worker(f);
++              return NULL;
++      }
++
+       if (frag_mem_limit(nf) > nf->low_thresh)
+               inet_frag_schedule_worker(f);
+ 

diff --git a/queue-3.18/net-dsa-do-not-suspend-resume-closed-slave_dev.patch b/queue-3.18/net-dsa-do-not-suspend-resume-closed-slave_dev.patch
new file mode 100644 (file)
index 0000000..da030cc
--- /dev/null
+++ b/queue-3.18/net-dsa-do-not-suspend-resume-closed-slave_dev.patch
@@ -0,0 +1,43 @@
+From foo@baz Sat Aug  4 09:17:19 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Tue, 31 Jul 2018 17:12:52 -0700
+Subject: net: dsa: Do not suspend/resume closed slave_dev
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit a94c689e6c9e72e722f28339e12dff191ee5a265 ]
+
+If a DSA slave network device was previously disabled, there is no need
+to suspend or resume it.
+
+Fixes: 2446254915a7 ("net: dsa: allow switch drivers to implement suspend/resume hooks")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/slave.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -503,6 +503,9 @@ int dsa_slave_suspend(struct net_device
+ {
+       struct dsa_slave_priv *p = netdev_priv(slave_dev);
+ 
++      if (!netif_running(slave_dev))
++              return 0;
++
+       netif_device_detach(slave_dev);
+ 
+       if (p->phy) {
+@@ -520,6 +523,9 @@ int dsa_slave_resume(struct net_device *
+ {
+       struct dsa_slave_priv *p = netdev_priv(slave_dev);
+ 
++      if (!netif_running(slave_dev))
++              return 0;
++
+       netif_device_attach(slave_dev);
+ 
+       if (p->phy) {

diff --git a/queue-3.18/series b/queue-3.18/series
index e69870448e04fe566a811bdbfa73be852d586f7f..64d84b23cb1c8aee8c78194db24ade3a375901a8 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -71,3 +71,5 @@ tcp-do-not-aggressively-quick-ack-after-ecn-events.patch
 tcp-refactor-tcp_ecn_check_ce-to-remove-sk-type-cast.patch
 tcp-add-one-more-quick-ack-after-after-ecn-events.patch
 ipv4-remove-bug_on-from-fib_compute_spec_dst.patch
+inet-frag-enforce-memory-limits-earlier.patch
+net-dsa-do-not-suspend-resume-closed-slave_dev.patch

diff --git a/queue-4.14/series b/queue-4.14/series
new file mode 100644 (file)
index 0000000..50d1d25
--- /dev/null
+++ b/queue-4.14/series
@@ -0,0 +1,8 @@
+bonding-avoid-lockdep-confusion-in-bond_get_stats.patch
+inet-frag-enforce-memory-limits-earlier.patch
+ipv4-frags-handle-possible-skb-truesize-change.patch
+net-dsa-do-not-suspend-resume-closed-slave_dev.patch
+netlink-fix-spectre-v1-gadget-in-netlink_create.patch
+net-stmmac-fix-wol-for-pci-based-setups.patch
+rxrpc-fix-user-call-id-check-in-rxrpc_service_prealloc_one.patch
+net-mlx5e-e-switch-initialize-eswitch-only-if-eswitch-manager.patch