From b70855359ada82c92eb677ff7ba1034228d54bb2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 20 Aug 2019 09:31:02 -0700 Subject: [PATCH] 4.9-stable patches added patches: arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch --- ...le-byte-watchpoints-on-all-addresses.patch | 42 ++++++++++++ ...se-consistent-ct-id-hash-calculation.patch | 65 +++++++++++++++++++ queue-4.9/series | 2 + 3 files changed, 109 insertions(+) create mode 100644 queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch create mode 100644 queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch diff --git a/queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch b/queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch new file mode 100644 index 00000000000..22775e90291 --- /dev/null +++ b/queue-4.9/arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch @@ -0,0 +1,42 @@ +From 849adec41203ac5837c40c2d7e08490ffdef3c2c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Mon, 29 Jul 2019 11:06:17 +0100 +Subject: arm64: compat: Allow single-byte watchpoints on all addresses + +From: Will Deacon + +commit 849adec41203ac5837c40c2d7e08490ffdef3c2c upstream. + +Commit d968d2b801d8 ("ARM: 7497/1: hw_breakpoint: allow single-byte +watchpoints on all addresses") changed the validation requirements for +hardware watchpoints on arch/arm/. Update our compat layer to implement +the same relaxation. + +Cc: +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/hw_breakpoint.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/hw_breakpoint.c ++++ b/arch/arm64/kernel/hw_breakpoint.c +@@ -508,13 +508,14 @@ int arch_validate_hwbkpt_settings(struct + /* Aligned */ + break; + case 1: +- /* Allow single byte watchpoint. */ +- if (info->ctrl.len == ARM_BREAKPOINT_LEN_1) +- break; + case 2: + /* Allow halfword watchpoints and breakpoints. */ + if (info->ctrl.len == ARM_BREAKPOINT_LEN_2) + break; ++ case 3: ++ /* Allow single byte watchpoint. */ ++ if (info->ctrl.len == ARM_BREAKPOINT_LEN_1) ++ break; + default: + return -EINVAL; + } diff --git a/queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch b/queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch new file mode 100644 index 00000000000..7a86a01d1b6 --- /dev/null +++ b/queue-4.9/netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch @@ -0,0 +1,65 @@ +From 656c8e9cc1badbc18eefe6ba01d33ebbcae61b9a Mon Sep 17 00:00:00 2001 +From: Dirk Morris +Date: Thu, 8 Aug 2019 13:57:51 -0700 +Subject: netfilter: conntrack: Use consistent ct id hash calculation + +From: Dirk Morris + +commit 656c8e9cc1badbc18eefe6ba01d33ebbcae61b9a upstream. + +Change ct id hash calculation to only use invariants. + +Currently the ct id hash calculation is based on some fields that can +change in the lifetime on a conntrack entry in some corner cases. The +current hash uses the whole tuple which contains an hlist pointer which +will change when the conntrack is placed on the dying list resulting in +a ct id change. + +This patch also removes the reply-side tuple and extension pointer from +the hash calculation so that the ct id will will not change from +initialization until confirmation. + +Fixes: 3c79107631db1f7 ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") +Signed-off-by: Dirk Morris +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_conntrack_core.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -308,13 +308,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple); + * table location, we assume id gets exposed to userspace. + * + * Following nf_conn items do not change throughout lifetime +- * of the nf_conn after it has been committed to main hash table: ++ * of the nf_conn: + * + * 1. nf_conn address +- * 2. nf_conn->ext address +- * 3. nf_conn->master address (normally NULL) +- * 4. tuple +- * 5. the associated net namespace ++ * 2. nf_conn->master address (normally NULL) ++ * 3. the associated net namespace ++ * 4. the original direction tuple + */ + u32 nf_ct_get_id(const struct nf_conn *ct) + { +@@ -324,9 +323,10 @@ u32 nf_ct_get_id(const struct nf_conn *c + net_get_random_once(&ct_id_seed, sizeof(ct_id_seed)); + + a = (unsigned long)ct; +- b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct)); +- c = (unsigned long)ct->ext; +- d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash), ++ b = (unsigned long)ct->master; ++ c = (unsigned long)nf_ct_net(ct); ++ d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, ++ sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple), + &ct_id_seed); + #ifdef CONFIG_64BIT + return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed); diff --git a/queue-4.9/series b/queue-4.9/series index 72123d53278..d0d94f138e2 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -90,3 +90,5 @@ usb-serial-option-add-the-broadmobi-bm818-card.patch usb-serial-option-add-motorola-modem-uarts.patch asm-generic-fix-wtype-limits-compiler-warnings.patch bpf-fix-bpf_jit_limit-knob-for-page_size-64k.patch +arm64-compat-allow-single-byte-watchpoints-on-all-addresses.patch +netfilter-conntrack-use-consistent-ct-id-hash-calculation.patch -- 2.47.3