--- /dev/null
+From foo@baz Fri Jul 3 20:01:12 PDT 2015
+From: Nikolay Aleksandrov <razor@blackwall.org>
+Date: Mon, 15 Jun 2015 20:28:51 +0300
+Subject: bridge: fix br_stp_set_bridge_priority race conditions
+
+From: Nikolay Aleksandrov <razor@blackwall.org>
+
+[ Upstream commit 2dab80a8b486f02222a69daca6859519e05781d9 ]
+
+After the ->set() spinlocks were removed br_stp_set_bridge_priority
+was left running without any protection when used via sysfs. It can
+race with port add/del and could result in use-after-free cases and
+corrupted lists. Tested by running port add/del in a loop with stp
+enabled while setting priority in a loop, crashes are easily
+reproducible.
+The spinlocks around sysfs ->set() were removed in commit:
+14f98f258f19 ("bridge: range check STP parameters")
+There's also a race condition in the netlink priority support that is
+fixed by this change, but it was introduced recently and the fixes tag
+covers it, just in case it's needed the commit is:
+af615762e972 ("bridge: add ageing_time, stp_state, priority over netlink")
+
+Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
+Fixes: 14f98f258f19 ("bridge: range check STP parameters")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_ioctl.c | 2 --
+ net/bridge/br_stp_if.c | 4 +++-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_devi
+ if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
+ return -EPERM;
+
+- spin_lock_bh(&br->lock);
+ br_stp_set_bridge_priority(br, args[1]);
+- spin_unlock_bh(&br->lock);
+ return 0;
+
+ case BRCTL_SET_PORT_PRIORITY:
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -241,12 +241,13 @@ bool br_stp_recalculate_bridge_id(struct
+ return true;
+ }
+
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ struct net_bridge_port *p;
+ int wasroot;
+
++ spin_lock_bh(&br->lock);
+ wasroot = br_is_root_bridge(br);
+
+ list_for_each_entry(p, &br->port_list, list) {
+@@ -264,6 +265,7 @@ void br_stp_set_bridge_priority(struct n
+ br_port_state_selection(br);
+ if (br_is_root_bridge(br) && !wasroot)
+ br_become_root_bridge(br);
++ spin_unlock_bh(&br->lock);
+ }
+
+ /* called under bridge lock */
--- /dev/null
+From foo@baz Fri Jul 3 20:01:12 PDT 2015
+From: Nikolay Aleksandrov <razor@blackwall.org>
+Date: Tue, 9 Jun 2015 10:23:57 -0700
+Subject: bridge: fix multicast router rlist endless loop
+
+From: Nikolay Aleksandrov <razor@blackwall.org>
+
+[ Upstream commit 1a040eaca1a22f8da8285ceda6b5e4a2cb704867 ]
+
+Since the addition of sysfs multicast router support if one set
+multicast_router to "2" more than once, then the port would be added to
+the hlist every time and could end up linking to itself and thus causing an
+endless loop for rlist walkers.
+So to reproduce just do:
+echo 2 > multicast_router; echo 2 > multicast_router;
+in a bridge port and let some igmp traffic flow, for me it hangs up
+in br_multicast_flood().
+Fix this by adding a check in br_multicast_add_router() if the port is
+already linked.
+The reason this didn't happen before the addition of multicast_router
+sysfs entries is because there's a !hlist_unhashed check that prevents
+it.
+
+Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
+Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries")
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_multicast.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1026,6 +1026,9 @@ static void br_multicast_add_router(stru
+ struct net_bridge_port *p;
+ struct hlist_node *slot = NULL;
+
++ if (!hlist_unhashed(&port->rlist))
++ return;
++
+ hlist_for_each_entry(p, &br->router_list, rlist) {
+ if ((unsigned long) port >= (unsigned long) p)
+ break;
+@@ -1053,12 +1056,8 @@ static void br_multicast_mark_router(str
+ if (port->multicast_router != 1)
+ return;
+
+- if (!hlist_unhashed(&port->rlist))
+- goto timer;
+-
+ br_multicast_add_router(br, port);
+
+-timer:
+ mod_timer(&port->multicast_router_timer,
+ now + br->multicast_querier_interval);
+ }
--- /dev/null
+From foo@baz Fri Jul 3 20:01:12 PDT 2015
+From: Willem de Bruijn <willemb@google.com>
+Date: Wed, 17 Jun 2015 15:59:34 -0400
+Subject: packet: avoid out of bounds read in round robin fanout
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]
+
+PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
+f->num_members. It returns the old value unconditionally, but
+f->num_members may have changed since the last store. Ensure
+that the return value is always < num.
+
+When modifying the logic, simplify it further by replacing the loop
+with an unconditional atomic increment.
+
+Fixes: dc99f600698d ("packet: Add fanout support.")
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 18 ++----------------
+ 1 file changed, 2 insertions(+), 16 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1150,16 +1150,6 @@ static void packet_sock_destruct(struct
+ sk_refcnt_debug_dec(sk);
+ }
+
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+- int x = atomic_read(&f->rr_cur) + 1;
+-
+- if (x >= num)
+- x = 0;
+-
+- return x;
+-}
+-
+ static unsigned int fanout_demux_hash(struct packet_fanout *f,
+ struct sk_buff *skb,
+ unsigned int num)
+@@ -1171,13 +1161,9 @@ static unsigned int fanout_demux_lb(stru
+ struct sk_buff *skb,
+ unsigned int num)
+ {
+- int cur, old;
++ unsigned int val = atomic_inc_return(&f->rr_cur);
+
+- cur = atomic_read(&f->rr_cur);
+- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+- fanout_rr_next(f, num))) != cur)
+- cur = old;
+- return cur;
++ return val % num;
+ }
+
+ static unsigned int fanout_demux_cpu(struct packet_fanout *f,
--- /dev/null
+From foo@baz Fri Jul 3 20:01:12 PDT 2015
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 16 Jun 2015 07:59:11 -0700
+Subject: packet: read num_members once in packet_rcv_fanout()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f98f4514d07871da7a113dd9e3e330743fd70ae4 ]
+
+We need to tell compiler it must not read f->num_members multiple
+times. Otherwise testing if num is not zero is flaky, and we could
+attempt an invalid divide by 0 in fanout_demux_cpu()
+
+Note bug was present in packet_rcv_fanout_hash() and
+packet_rcv_fanout_lb() but final 3.1 had a simple location
+after commit 95ec3eb417115fb ("packet: Add 'cpu' fanout policy.")
+
+Fixes: dc99f600698dc ("packet: Add fanout support.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1217,7 +1217,7 @@ static int packet_rcv_fanout(struct sk_b
+ struct packet_type *pt, struct net_device *orig_dev)
+ {
+ struct packet_fanout *f = pt->af_packet_priv;
+- unsigned int num = f->num_members;
++ unsigned int num = ACCESS_ONCE(f->num_members);
+ struct packet_sock *po;
+ unsigned int idx;
+
--- /dev/null
+From foo@baz Fri Jul 3 20:01:12 PDT 2015
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Mon, 29 Jun 2015 10:41:03 +0200
+Subject: sctp: Fix race between OOTB responce and route removal
+
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+
+[ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ]
+
+There is NULL pointer dereference possible during statistics update if the route
+used for OOTB responce is removed at unfortunate time. If the route exists when
+we receive OOTB packet and we finally jump into sctp_packet_transmit() to send
+ABORT, but in the meantime route is removed under our feet, we take "no_route"
+path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...).
+
+But sctp_ootb_pkt_new() used to prepare responce packet doesn't call
+sctp_transport_set_owner() and therefore there is no asoc associated with this
+packet. Probably temporary asoc just for OOTB responces is overkill, so just
+introduce a check like in all other places in sctp_packet_transmit(), where
+"asoc" is dereferenced.
+
+To reproduce this, one needs to
+0. ensure that sctp module is loaded (otherwise ABORT is not generated)
+1. remove default route on the machine
+2. while true; do
+ ip route del [interface-specific route]
+ ip route add [interface-specific route]
+ done
+3. send enough OOTB packets (i.e. HB REQs) from another host to trigger ABORT
+ responce
+
+On x86_64 the crash looks like this:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
+IP: [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
+PGD 0
+Oops: 0000 [#1] PREEMPT SMP
+Modules linked in: ...
+CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.0.5-1-ARCH #1
+Hardware name: ...
+task: ffffffff818124c0 ti: ffffffff81800000 task.ti: ffffffff81800000
+RIP: 0010:[<ffffffffa05ec9ac>] [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
+RSP: 0018:ffff880127c037b8 EFLAGS: 00010296
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000015ff66b480
+RDX: 00000015ff66b400 RSI: ffff880127c17200 RDI: ffff880123403700
+RBP: ffff880127c03888 R08: 0000000000017200 R09: ffffffff814625af
+R10: ffffea00047e4680 R11: 00000000ffffff80 R12: ffff8800b0d38a28
+R13: ffff8800b0d38a28 R14: ffff8800b3e88000 R15: ffffffffa05f24e0
+FS: 0000000000000000(0000) GS:ffff880127c00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 0000000000000020 CR3: 00000000c855b000 CR4: 00000000000007f0
+Stack:
+ ffff880127c03910 ffff8800b0d38a28 ffffffff8189d240 ffff88011f91b400
+ ffff880127c03828 ffffffffa05c94c5 0000000000000000 ffff8800baa1c520
+ 0000000000000000 0000000000000001 0000000000000000 0000000000000000
+Call Trace:
+ <IRQ>
+ [<ffffffffa05c94c5>] ? sctp_sf_tabort_8_4_8.isra.20+0x85/0x140 [sctp]
+ [<ffffffffa05d6b42>] ? sctp_transport_put+0x52/0x80 [sctp]
+ [<ffffffffa05d0bfc>] sctp_do_sm+0xb8c/0x19a0 [sctp]
+ [<ffffffff810b0e00>] ? trigger_load_balance+0x90/0x210
+ [<ffffffff810e0329>] ? update_process_times+0x59/0x60
+ [<ffffffff812c7a40>] ? timerqueue_add+0x60/0xb0
+ [<ffffffff810e0549>] ? enqueue_hrtimer+0x29/0xa0
+ [<ffffffff8101f599>] ? read_tsc+0x9/0x10
+ [<ffffffff8116d4b5>] ? put_page+0x55/0x60
+ [<ffffffff810ee1ad>] ? clockevents_program_event+0x6d/0x100
+ [<ffffffff81462b68>] ? skb_free_head+0x58/0x80
+ [<ffffffffa029a10b>] ? chksum_update+0x1b/0x27 [crc32c_generic]
+ [<ffffffff81283f3e>] ? crypto_shash_update+0xce/0xf0
+ [<ffffffffa05d3993>] sctp_endpoint_bh_rcv+0x113/0x280 [sctp]
+ [<ffffffffa05dd4e6>] sctp_inq_push+0x46/0x60 [sctp]
+ [<ffffffffa05ed7a0>] sctp_rcv+0x880/0x910 [sctp]
+ [<ffffffffa05ecb50>] ? sctp_packet_transmit_chunk+0xb0/0xb0 [sctp]
+ [<ffffffffa05ecb70>] ? sctp_csum_update+0x20/0x20 [sctp]
+ [<ffffffff814b05a5>] ? ip_route_input_noref+0x235/0xd30
+ [<ffffffff81051d6b>] ? ack_ioapic_level+0x7b/0x150
+ [<ffffffff814b27be>] ip_local_deliver_finish+0xae/0x210
+ [<ffffffff814b2e15>] ip_local_deliver+0x35/0x90
+ [<ffffffff814b2a15>] ip_rcv_finish+0xf5/0x370
+ [<ffffffff814b3128>] ip_rcv+0x2b8/0x3a0
+ [<ffffffff81474193>] __netif_receive_skb_core+0x763/0xa50
+ [<ffffffff81476c28>] __netif_receive_skb+0x18/0x60
+ [<ffffffff81476cb0>] netif_receive_skb_internal+0x40/0xd0
+ [<ffffffff814776c8>] napi_gro_receive+0xe8/0x120
+ [<ffffffffa03946aa>] rtl8169_poll+0x2da/0x660 [r8169]
+ [<ffffffff8147896a>] net_rx_action+0x21a/0x360
+ [<ffffffff81078dc1>] __do_softirq+0xe1/0x2d0
+ [<ffffffff8107912d>] irq_exit+0xad/0xb0
+ [<ffffffff8157d158>] do_IRQ+0x58/0xf0
+ [<ffffffff8157b06d>] common_interrupt+0x6d/0x6d
+ <EOI>
+ [<ffffffff810e1218>] ? hrtimer_start+0x18/0x20
+ [<ffffffffa05d65f9>] ? sctp_transport_destroy_rcu+0x29/0x30 [sctp]
+ [<ffffffff81020c50>] ? mwait_idle+0x60/0xa0
+ [<ffffffff810216ef>] arch_cpu_idle+0xf/0x20
+ [<ffffffff810b731c>] cpu_startup_entry+0x3ec/0x480
+ [<ffffffff8156b365>] rest_init+0x85/0x90
+ [<ffffffff818eb035>] start_kernel+0x48b/0x4ac
+ [<ffffffff818ea120>] ? early_idt_handlers+0x120/0x120
+ [<ffffffff818ea339>] x86_64_start_reservations+0x2a/0x2c
+ [<ffffffff818ea49c>] x86_64_start_kernel+0x161/0x184
+Code: 90 48 8b 80 b8 00 00 00 48 89 85 70 ff ff ff 48 83 bd 70 ff ff ff 00 0f 85 cd fa ff ff 48 89 df 31 db e8 18 63 e7 e0 48 8b 45 80 <48> 8b 40 20 48 8b 40 30 48 8b 80 68 01 00 00 65 48 ff 40 78 e9
+RIP [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
+ RSP <ffff880127c037b8>
+CR2: 0000000000000020
+---[ end trace 5aec7fd2dc983574 ]---
+Kernel panic - not syncing: Fatal exception in interrupt
+Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
+drm_kms_helper: panic occurred, switching back to text console
+---[ end Kernel panic - not syncing: Fatal exception in interrupt
+
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Vlad Yasevich <vyasevich@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/output.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -618,7 +618,9 @@ out:
+ return err;
+ no_route:
+ kfree_skb(nskb);
+- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
++
++ if (asoc)
++ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
+
+ /* FIXME: Returning the 'err' will effect all the associations
+ * associated with a socket, although only one of the paths of the
--- /dev/null
+sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch
+bridge-fix-multicast-router-rlist-endless-loop.patch
+bridge-fix-br_stp_set_bridge_priority-race-conditions.patch
+packet-read-num_members-once-in-packet_rcv_fanout.patch
+packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch
+sctp-fix-race-between-ootb-responce-and-route-removal.patch
--- /dev/null
+From patchwork Tue Apr 21 14:30:41 2015
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in
+ softirq context
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+X-Patchwork-Id: 463148
+Message-Id: <1429626641-199974-1-git-send-email-sowmini.varadhan@oracle.com>
+To: sowmini.varadhan@oracle.com, sparclinux@vger.kernel.org
+Cc: david.stevens@oracle.com, davem@davemloft.net
+Date: Tue, 21 Apr 2015 10:30:41 -0400
+
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+
+Upstream commit 671d773297969bebb1732e1cdc1ec03aa53c6be2
+
+Since it is possible for vnet_event_napi to end up doing
+vnet_control_pkt_engine -> ... -> vnet_send_attr ->
+vnet_port_alloc_tx_ring -> ldc_alloc_exp_dring -> kzalloc()
+(i.e., in softirq context), kzalloc() should be called with
+GFP_ATOMIC from ldc_alloc_exp_dring.
+
+Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sparc/kernel/ldc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -2306,7 +2306,7 @@ void *ldc_alloc_exp_dring(struct ldc_cha
+ if (len & (8UL - 1))
+ return ERR_PTR(-EINVAL);
+
+- buf = kzalloc(len, GFP_KERNEL);
++ buf = kzalloc(len, GFP_ATOMIC);
+ if (!buf)
+ return ERR_PTR(-ENOMEM);
+
--- /dev/null
+sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch
+bridge-fix-multicast-router-rlist-endless-loop.patch
+net-don-t-wait-for-order-3-page-allocation.patch
+sctp-fix-asconf-list-handling.patch
+bridge-fix-br_stp_set_bridge_priority-race-conditions.patch
+packet-read-num_members-once-in-packet_rcv_fanout.patch
+packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch
+neigh-do-not-modify-unlinked-entries.patch
+tcp-do-not-call-tcp_fastopen_reset_cipher-from-interrupt-context.patch
+net-phy-fix-phy-link-up-when-limiting-speed-via-device-tree.patch
+sctp-fix-race-between-ootb-responce-and-route-removal.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
