4.4-stable patches

added patches:
	net-check-before-dereferencing-netdev_ops-during-busy-poll.patch

diff --git a/queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch b/queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch
new file mode 100644 (file)
index 0000000..09f9c60
--- /dev/null
+++ b/queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch
@@ -0,0 +1,72 @@
+From jelsasser@appneta.com  Tue Jul  2 07:48:39 2019
+From: Josh Elsasser <jelsasser@appneta.com>
+Date: Mon,  1 Jul 2019 16:48:47 -0700
+Subject: net: check before dereferencing netdev_ops during busy poll
+To: stable@vger.kernel.org
+Cc: Josh Elsasser <jelsasser@appneta.com>, gregkh@linuxfoundation.org, netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>, Jiri Pirko <jiri@mellanox.com>, Edward Cree <ecree@solarflare.com>, Eric Dumazet <edumazet@google.com>, Alexander Duyck <alexander.h.duyck@intel.com>, Matteo Croce <mcroce@redhat.com>
+Message-ID: <20190701234847.73385-1-jelsasser@appneta.com>
+
+From: Josh Elsasser <jelsasser@appneta.com>
+
+init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads
+to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi
+wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll.
+
+Avoid this by ensuring napi->dev->netdev_ops is valid before following
+the pointer, avoiding the following panic when busy polling on a dummy
+netdev:
+
+  BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8
+  IP: [<ffffffff817b4b72>] sk_busy_loop+0x92/0x2f0
+  Call Trace:
+   [<ffffffff815a3134>] ? uart_write_room+0x74/0xf0
+   [<ffffffff817964a9>] sock_poll+0x99/0xa0
+   [<ffffffff81223142>] do_sys_poll+0x2e2/0x520
+   [<ffffffff8118d3fc>] ? get_page_from_freelist+0x3bc/0xa30
+   [<ffffffff810ada22>] ? update_curr+0x62/0x140
+   [<ffffffff811ea671>] ? __slab_free+0xa1/0x2a0
+   [<ffffffff811ea671>] ? __slab_free+0xa1/0x2a0
+   [<ffffffff8179dbb1>] ? skb_free_head+0x21/0x30
+   [<ffffffff81221bd0>] ? poll_initwait+0x50/0x50
+   [<ffffffff811eaa36>] ? kmem_cache_free+0x1c6/0x1e0
+   [<ffffffff815a4884>] ? uart_write+0x124/0x1d0
+   [<ffffffff810bd1cd>] ? remove_wait_queue+0x4d/0x60
+   [<ffffffff810bd224>] ? __wake_up+0x44/0x50
+   [<ffffffff81582731>] ? tty_write_unlock+0x31/0x40
+   [<ffffffff8158c5c6>] ? tty_ldisc_deref+0x16/0x20
+   [<ffffffff81584820>] ? tty_write+0x1e0/0x2f0
+   [<ffffffff81587e50>] ? process_echoes+0x80/0x80
+   [<ffffffff8120c17b>] ? __vfs_write+0x2b/0x130
+   [<ffffffff8120d09a>] ? vfs_write+0x15a/0x1a0
+   [<ffffffff81223455>] SyS_poll+0x75/0x100
+   [<ffffffff819a6524>] entry_SYSCALL_64_fastpath+0x24/0xcf
+
+Commit 79e7fff47b7b ("net: remove support for per driver ndo_busy_poll()")
+indirectly fixed this upstream in linux-4.11 by removing the offending
+pointer usage. No other users of napi->dev touch its netdev_ops.
+
+Fixes: 8b80cda536ea ("net: rename include/net/ll_poll.h to include/net/busy_poll.h") # 4.4.y
+Signed-off-by: Josh Elsasser <jelsasser@appneta.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+
+This is a straightforward backport of the 4.9.y fix[1] for this crash, which doesn't
+apply to the older LTS releases. Only build-tested on 4.4.y, as I don't have access
+to wireless hardware and firmware that runs on older LTS kernels.
+
+[1]: https://lore.kernel.org/stable/20190701234143.72631-1-jelsasser@appneta.com/T/#u
+
+ include/net/busy_poll.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/busy_poll.h
++++ b/include/net/busy_poll.h
+@@ -93,7 +93,7 @@ static inline bool sk_busy_loop(struct s
+               goto out;
+ 
+       ops = napi->dev->netdev_ops;
+-      if (!ops->ndo_busy_poll)
++      if (!ops || !ops->ndo_busy_poll)
+               goto out;
+ 
+       do {

diff --git a/queue-4.4/series b/queue-4.4/series
index 313ab09844c2b9c9016bd7026b6319f58a96723c..3388c147470cc797e7278f7a1930dc267cddf303 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -44,3 +44,4 @@ team-always-enable-vlan-tx-offload.patch
 ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch
 bonding-always-enable-vlan-tx-offload.patch
 af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch
+net-check-before-dereferencing-netdev_ops-during-busy-poll.patch