3.18-stable patches

added patches:
	netem-fix-skb_orphan_partial.patch

diff --git a/queue-3.18/netem-fix-skb_orphan_partial.patch b/queue-3.18/netem-fix-skb_orphan_partial.patch
new file mode 100644 (file)
index 0000000..1242d71
--- /dev/null
+++ b/queue-3.18/netem-fix-skb_orphan_partial.patch
@@ -0,0 +1,54 @@
+From f6ba8d33cfbb46df569972e64dbb5bb7e929bfd9 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 11 May 2017 15:24:41 -0700
+Subject: netem: fix skb_orphan_partial()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit f6ba8d33cfbb46df569972e64dbb5bb7e929bfd9 upstream.
+
+I should have known that lowering skb->truesize was dangerous :/
+
+In case packets are not leaving the host via a standard Ethernet device,
+but looped back to local sockets, bad things can happen, as reported
+by Michael Madsen ( https://bugzilla.kernel.org/show_bug.cgi?id=195713 )
+
+So instead of tweaking skb->truesize, lets change skb->destructor
+and keep a reference on the owner socket via its sk_refcnt.
+
+Fixes: f2f872f9272a ("netem: Introduce skb_orphan_partial() helper")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Michael Madsen <mkm@nabto.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/sock.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1633,17 +1633,17 @@ EXPORT_SYMBOL(sock_wfree);
+ 
+ void skb_orphan_partial(struct sk_buff *skb)
+ {
+-      /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
+-       * so we do not completely orphan skb, but transfert all
+-       * accounted bytes but one, to avoid unexpected reorders.
+-       */
+       if (skb->destructor == sock_wfree
+ #ifdef CONFIG_INET
+           || skb->destructor == tcp_wfree
+ #endif
+               ) {
+-              atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
+-              skb->truesize = 1;
++              struct sock *sk = skb->sk;
++
++              if (atomic_inc_not_zero(&sk->sk_refcnt)) {
++                      atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
++                      skb->destructor = sock_efree;
++              }
+       } else {
+               skb_orphan(skb);
+       }

diff --git a/queue-3.18/series b/queue-3.18/series
index ffbda86072570fba5bfde46e0d78e5eb245f81b6..859878b1edf0bf39a61d21a802d38f75baee41a9 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -1 +1,2 @@
 revert-stackprotector-increase-the-per-task-stack-canary-s-random-range-from-32-bits-to-64-bits-on-64-bit-platforms.patch
+netem-fix-skb_orphan_partial.patch