From: Greg Kroah-Hartman Date: Sat, 4 Aug 2018 07:33:14 +0000 (+0200) Subject: 3.18-stable patches X-Git-Tag: v4.17.13~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bd823b6ffefeb9027e97ff38b2c6f601758199d7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: inet-frag-enforce-memory-limits-earlier.patch net-dsa-do-not-suspend-resume-closed-slave_dev.patch --- diff --git a/queue-3.18/inet-frag-enforce-memory-limits-earlier.patch b/queue-3.18/inet-frag-enforce-memory-limits-earlier.patch new file mode 100644 index 00000000000..80881725fa3 --- /dev/null +++ b/queue-3.18/inet-frag-enforce-memory-limits-earlier.patch @@ -0,0 +1,60 @@ +From foo@baz Sat Aug 4 09:17:19 CEST 2018 +From: Eric Dumazet +Date: Mon, 30 Jul 2018 20:09:11 -0700 +Subject: inet: frag: enforce memory limits earlier + +From: Eric Dumazet + +[ Upstream commit 56e2c94f055d328f5f6b0a5c1721cca2f2d4e0a1 ] + +We currently check current frags memory usage only when +a new frag queue is created. This allows attackers to first +consume the memory budget (default : 4 MB) creating thousands +of frag queues, then sending tiny skbs to exceed high_thresh +limit by 2 to 3 order of magnitude. + +Note that before commit 648700f76b03 ("inet: frags: use rhashtables +for reassembly units"), work queue could be starved under DOS, +getting no cpu cycles. +After commit 648700f76b03, only the per frag queue timer can eventually +remove an incomplete frag queue and its skbs. + +Fixes: b13d3cbfb8e8 ("inet: frag: move eviction of queues to work queue") +Signed-off-by: Eric Dumazet +Reported-by: Jann Horn +Cc: Florian Westphal +Cc: Peter Oskolkov +Cc: Paolo Abeni +Acked-by: Florian Westphal +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_fragment.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -379,11 +379,6 @@ static struct inet_frag_queue *inet_frag + { + struct inet_frag_queue *q; + +- if (frag_mem_limit(nf) > nf->high_thresh) { +- inet_frag_schedule_worker(f); +- return NULL; +- } +- + q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); + if (q == NULL) + return NULL; +@@ -420,6 +415,11 @@ struct inet_frag_queue *inet_frag_find(s + struct inet_frag_queue *q; + int depth = 0; + ++ if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { ++ inet_frag_schedule_worker(f); ++ return NULL; ++ } ++ + if (frag_mem_limit(nf) > nf->low_thresh) + inet_frag_schedule_worker(f); + diff --git a/queue-3.18/net-dsa-do-not-suspend-resume-closed-slave_dev.patch b/queue-3.18/net-dsa-do-not-suspend-resume-closed-slave_dev.patch new file mode 100644 index 00000000000..da030ccff57 --- /dev/null +++ b/queue-3.18/net-dsa-do-not-suspend-resume-closed-slave_dev.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Aug 4 09:17:19 CEST 2018 +From: Florian Fainelli +Date: Tue, 31 Jul 2018 17:12:52 -0700 +Subject: net: dsa: Do not suspend/resume closed slave_dev + +From: Florian Fainelli + +[ Upstream commit a94c689e6c9e72e722f28339e12dff191ee5a265 ] + +If a DSA slave network device was previously disabled, there is no need +to suspend or resume it. + +Fixes: 2446254915a7 ("net: dsa: allow switch drivers to implement suspend/resume hooks") +Signed-off-by: Florian Fainelli +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/slave.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -503,6 +503,9 @@ int dsa_slave_suspend(struct net_device + { + struct dsa_slave_priv *p = netdev_priv(slave_dev); + ++ if (!netif_running(slave_dev)) ++ return 0; ++ + netif_device_detach(slave_dev); + + if (p->phy) { +@@ -520,6 +523,9 @@ int dsa_slave_resume(struct net_device * + { + struct dsa_slave_priv *p = netdev_priv(slave_dev); + ++ if (!netif_running(slave_dev)) ++ return 0; ++ + netif_device_attach(slave_dev); + + if (p->phy) { diff --git a/queue-3.18/series b/queue-3.18/series index e69870448e0..64d84b23cb1 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -71,3 +71,5 @@ tcp-do-not-aggressively-quick-ack-after-ecn-events.patch tcp-refactor-tcp_ecn_check_ce-to-remove-sk-type-cast.patch tcp-add-one-more-quick-ack-after-after-ecn-events.patch ipv4-remove-bug_on-from-fib_compute_spec_dst.patch +inet-frag-enforce-memory-limits-earlier.patch +net-dsa-do-not-suspend-resume-closed-slave_dev.patch diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..50d1d250760 --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,8 @@ +bonding-avoid-lockdep-confusion-in-bond_get_stats.patch +inet-frag-enforce-memory-limits-earlier.patch +ipv4-frags-handle-possible-skb-truesize-change.patch +net-dsa-do-not-suspend-resume-closed-slave_dev.patch +netlink-fix-spectre-v1-gadget-in-netlink_create.patch +net-stmmac-fix-wol-for-pci-based-setups.patch +rxrpc-fix-user-call-id-check-in-rxrpc_service_prealloc_one.patch +net-mlx5e-e-switch-initialize-eswitch-only-if-eswitch-manager.patch