From: Greg Kroah-Hartman Date: Mon, 18 Feb 2019 12:48:28 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v3.18.135~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=872cfe29f93194a9064d1f6aca3dec959d42ee83;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ch9200-use-skb_cow_head-to-deal-with-cloned-skbs.patch kaweth-use-skb_cow_head-to-deal-with-cloned-skbs.patch smsc95xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch usb-dwc2-remove-unnecessary-kfree.patch --- diff --git a/queue-4.4/ch9200-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/queue-4.4/ch9200-use-skb_cow_head-to-deal-with-cloned-skbs.patch new file mode 100644 index 00000000000..b5d9ddb12e2 --- /dev/null +++ b/queue-4.4/ch9200-use-skb_cow_head-to-deal-with-cloned-skbs.patch @@ -0,0 +1,45 @@ +From 6bc6895bdd6744e0136eaa4a11fbdb20a7db4e40 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 19 Apr 2017 09:59:25 -0700 +Subject: ch9200: use skb_cow_head() to deal with cloned skbs + +From: Eric Dumazet + +commit 6bc6895bdd6744e0136eaa4a11fbdb20a7db4e40 upstream. + +We need to ensure there is enough headroom to push extra header, +but we also need to check if we are allowed to change headers. + +skb_cow_head() is the proper helper to deal with this. + +Fixes: 4a476bd6d1d9 ("usbnet: New driver for QinHeng CH9200 devices") +Signed-off-by: Eric Dumazet +Cc: James Hughes +Cc: Matthew Garrett +Signed-off-by: David S. Miller +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/ch9200.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/drivers/net/usb/ch9200.c ++++ b/drivers/net/usb/ch9200.c +@@ -255,14 +255,9 @@ static struct sk_buff *ch9200_tx_fixup(s + tx_overhead = 0x40; + + len = skb->len; +- if (skb_headroom(skb) < tx_overhead) { +- struct sk_buff *skb2; +- +- skb2 = skb_copy_expand(skb, tx_overhead, 0, flags); ++ if (skb_cow_head(skb, tx_overhead)) { + dev_kfree_skb_any(skb); +- skb = skb2; +- if (!skb) +- return NULL; ++ return NULL; + } + + __skb_push(skb, tx_overhead); diff --git a/queue-4.4/kaweth-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/queue-4.4/kaweth-use-skb_cow_head-to-deal-with-cloned-skbs.patch new file mode 100644 index 00000000000..3e05edbc7a2 --- /dev/null +++ b/queue-4.4/kaweth-use-skb_cow_head-to-deal-with-cloned-skbs.patch @@ -0,0 +1,50 @@ +From 39fba7835aacda65284a86e611774cbba71dac20 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 19 Apr 2017 09:59:26 -0700 +Subject: kaweth: use skb_cow_head() to deal with cloned skbs + +From: Eric Dumazet + +commit 39fba7835aacda65284a86e611774cbba71dac20 upstream. + +We can use skb_cow_head() to properly deal with clones, +especially the ones coming from TCP stack that allow their head being +modified. This avoids a copy. + +Signed-off-by: Eric Dumazet +Cc: James Hughes +Signed-off-by: David S. Miller +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/kaweth.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +--- a/drivers/net/usb/kaweth.c ++++ b/drivers/net/usb/kaweth.c +@@ -812,18 +812,12 @@ static netdev_tx_t kaweth_start_xmit(str + } + + /* We now decide whether we can put our special header into the sk_buff */ +- if (skb_cloned(skb) || skb_headroom(skb) < 2) { +- /* no such luck - we make our own */ +- struct sk_buff *copied_skb; +- copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC); +- dev_kfree_skb_irq(skb); +- skb = copied_skb; +- if (!copied_skb) { +- kaweth->stats.tx_errors++; +- netif_start_queue(net); +- spin_unlock_irq(&kaweth->device_lock); +- return NETDEV_TX_OK; +- } ++ if (skb_cow_head(skb, 2)) { ++ kaweth->stats.tx_errors++; ++ netif_start_queue(net); ++ spin_unlock_irq(&kaweth->device_lock); ++ dev_kfree_skb_any(skb); ++ return NETDEV_TX_OK; + } + + private_header = (__le16 *)__skb_push(skb, 2); diff --git a/queue-4.4/series b/queue-4.4/series index 5b52b2255e8..88102af3d0c 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -136,3 +136,7 @@ x86-platform-uv-use-efi_runtime_lock-to-serialise-bios-calls.patch signal-restore-the-stop-ptrace_event_exit.patch x86-a.out-clear-the-dump-structure-initially.patch dm-thin-fix-bug-where-bio-that-overwrites-thin-block-ignores-fua.patch +smsc95xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch +ch9200-use-skb_cow_head-to-deal-with-cloned-skbs.patch +kaweth-use-skb_cow_head-to-deal-with-cloned-skbs.patch +usb-dwc2-remove-unnecessary-kfree.patch diff --git a/queue-4.4/smsc95xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch b/queue-4.4/smsc95xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch new file mode 100644 index 00000000000..069fe009643 --- /dev/null +++ b/queue-4.4/smsc95xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch @@ -0,0 +1,47 @@ +From e9156cd26a495a18706e796f02a81fee41ec14f4 Mon Sep 17 00:00:00 2001 +From: James Hughes +Date: Wed, 19 Apr 2017 11:13:40 +0100 +Subject: smsc95xx: Use skb_cow_head to deal with cloned skbs + +From: James Hughes + +commit e9156cd26a495a18706e796f02a81fee41ec14f4 upstream. + +The driver was failing to check that the SKB wasn't cloned +before adding checksum data. +Replace existing handling to extend/copy the header buffer +with skb_cow_head. + +Signed-off-by: James Hughes +Acked-by: Eric Dumazet +Acked-by: Woojung Huh +Signed-off-by: David S. Miller +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/smsc95xx.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1838,13 +1838,13 @@ static struct sk_buff *smsc95xx_tx_fixup + /* We do not advertise SG, so skbs should be already linearized */ + BUG_ON(skb_shinfo(skb)->nr_frags); + +- if (skb_headroom(skb) < overhead) { +- struct sk_buff *skb2 = skb_copy_expand(skb, +- overhead, 0, flags); ++ /* Make writable and expand header space by overhead if required */ ++ if (skb_cow_head(skb, overhead)) { ++ /* Must deallocate here as returning NULL to indicate error ++ * means the skb won't be deallocated in the caller. ++ */ + dev_kfree_skb_any(skb); +- skb = skb2; +- if (!skb) +- return NULL; ++ return NULL; + } + + if (csum) { diff --git a/queue-4.4/usb-dwc2-remove-unnecessary-kfree.patch b/queue-4.4/usb-dwc2-remove-unnecessary-kfree.patch new file mode 100644 index 00000000000..7d4c047e7f9 --- /dev/null +++ b/queue-4.4/usb-dwc2-remove-unnecessary-kfree.patch @@ -0,0 +1,31 @@ +From cd4b1e34655d46950c065d9284b596cd8d7b28cd Mon Sep 17 00:00:00 2001 +From: John Youn +Date: Thu, 3 Nov 2016 17:55:45 -0700 +Subject: usb: dwc2: Remove unnecessary kfree + +From: John Youn + +commit cd4b1e34655d46950c065d9284b596cd8d7b28cd upstream. + +This shouldn't be freed by the HCD as it is owned by the core and +allocated with devm_kzalloc. + +Signed-off-by: John Youn +Signed-off-by: Felipe Balbi +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/hcd.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -3164,7 +3164,6 @@ error3: + error2: + usb_put_hcd(hcd); + error1: +- kfree(hsotg->core_params); + + #ifdef CONFIG_USB_DWC2_TRACK_MISSED_SOFS + kfree(hsotg->last_frame_num_array);