From: Greg Kroah-Hartman Date: Thu, 8 Nov 2018 17:38:48 +0000 (-0800) Subject: drop broken patch from 3.18 X-Git-Tag: v3.18.125~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f33ceb315375a173fa468cfb6db72c54a77ed288;p=thirdparty%2Fkernel%2Fstable-queue.git drop broken patch from 3.18 --- diff --git a/queue-3.18/llc-set-sock_rcu_free-in-llc_sap_add_socket.patch b/queue-3.18/llc-set-sock_rcu_free-in-llc_sap_add_socket.patch deleted file mode 100644 index 6b17d3c3b28..00000000000 --- a/queue-3.18/llc-set-sock_rcu_free-in-llc_sap_add_socket.patch +++ /dev/null @@ -1,37 +0,0 @@ -From foo@baz Thu Nov 8 07:52:16 PST 2018 -From: Cong Wang -Date: Thu, 11 Oct 2018 11:15:13 -0700 -Subject: llc: set SOCK_RCU_FREE in llc_sap_add_socket() - -From: Cong Wang - -[ Upstream commit 5a8e7aea953bdb6d4da13aff6f1e7f9c62023499 ] - -WHen an llc sock is added into the sk_laddr_hash of an llc_sap, -it is not marked with SOCK_RCU_FREE. - -This causes that the sock could be freed while it is still being -read by __llc_lookup_established() with RCU read lock. sock is -refcounted, but with RCU read lock, nothing prevents the readers -getting a zero refcnt. - -Fix it by setting SOCK_RCU_FREE in llc_sap_add_socket(). - -Reported-by: syzbot+11e05f04c15e03be5254@syzkaller.appspotmail.com -Signed-off-by: Cong Wang -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/llc/llc_conn.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/llc/llc_conn.c -+++ b/net/llc/llc_conn.c -@@ -734,6 +734,7 @@ void llc_sap_add_socket(struct llc_sap * - llc_sk(sk)->sap = sap; - - spin_lock_bh(&sap->sk_lock); -+ sock_set_flag(sk, SOCK_RCU_FREE); - sap->sk_count++; - sk_nulls_add_node_rcu(sk, laddr_hb); - hlist_add_head(&llc->dev_hash_node, dev_hb); diff --git a/queue-3.18/series b/queue-3.18/series index 68d0cae5104..bad5ab07732 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -130,7 +130,6 @@ proc-iomem-only-expose-physical-resource-addresses-to-privileged-users.patch mremap-properly-flush-tlb-before-releasing-the-page.patch ipv6-mcast-fix-a-use-after-free-in-inet6_mc_check.patch ipv6-ndisc-preserve-ipv6-control-buffer-if-protocol-error-handlers-are-called.patch -llc-set-sock_rcu_free-in-llc_sap_add_socket.patch net-ipv6-fix-index-counter-for-unicast-addresses-in-in6_dump_addrs.patch net-socket-fix-a-missing-check-bug.patch net-stmmac-fix-stmmac_mdio_reset-when-building-stmmac-as-modules.patch