4.9-stable patches

added patches:
	ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch
	tipc-fix-memory-leak-caused-by-tipc_buf_append.patch

diff --git a/queue-4.9/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch b/queue-4.9/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch
new file mode 100644 (file)
index 0000000..9a84a92
--- /dev/null
+++ b/queue-4.9/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch
@@ -0,0 +1,69 @@
+From foo@baz Sat Oct 31 10:48:31 AM CET 2020
+From: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+Date: Mon, 26 Oct 2020 05:21:30 -0500
+Subject: ravb: Fix bit fields checking in ravb_hwtstamp_get()
+
+From: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+
+[ Upstream commit 68b9f0865b1ef545da180c57d54b82c94cb464a4 ]
+
+In the function ravb_hwtstamp_get() in ravb_main.c with the existing
+values for RAVB_RXTSTAMP_TYPE_V2_L2_EVENT (0x2) and RAVB_RXTSTAMP_TYPE_ALL
+(0x6)
+
+if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT)
+       config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL)
+       config.rx_filter = HWTSTAMP_FILTER_ALL;
+
+if the test on RAVB_RXTSTAMP_TYPE_ALL should be true,
+it will never be reached.
+
+This issue can be verified with 'hwtstamp_config' testing program
+(tools/testing/selftests/net/hwtstamp_config.c). Setting filter type
+to ALL and subsequent retrieving it gives incorrect value:
+
+$ hwtstamp_config eth0 OFF ALL
+flags = 0
+tx_type = OFF
+rx_filter = ALL
+$ hwtstamp_config eth0
+flags = 0
+tx_type = OFF
+rx_filter = PTP_V2_L2_EVENT
+
+Correct this by converting if-else's to switch.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Reported-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
+Link: https://lore.kernel.org/r/20201026102130.29368-1-andrew_gabbasov@mentor.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c |   10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1729,12 +1729,16 @@ static int ravb_hwtstamp_get(struct net_
+       config.flags = 0;
+       config.tx_type = priv->tstamp_tx_ctrl ? HWTSTAMP_TX_ON :
+                                               HWTSTAMP_TX_OFF;
+-      if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT)
++      switch (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE) {
++      case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT:
+               config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+-      else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL)
++              break;
++      case RAVB_RXTSTAMP_TYPE_ALL:
+               config.rx_filter = HWTSTAMP_FILTER_ALL;
+-      else
++              break;
++      default:
+               config.rx_filter = HWTSTAMP_FILTER_NONE;
++      }
+ 
+       return copy_to_user(req->ifr_data, &config, sizeof(config)) ?
+               -EFAULT : 0;

diff --git a/queue-4.9/series b/queue-4.9/series
index 8e061647c55f9112ec06973860b1a20ee829cfaa..068533b2184d52565da7ca4d4795b0b7996d49db 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -2,3 +2,5 @@ sunrpc-econnrefused-should-cause-a-rebind.patch
 scripts-setlocalversion-make-git-describe-output-more-reliable.patch
 powerpc-powernv-opal-dump-use-irq_handled-instead-of-numbers-in-interrupt-handler.patch
 efivarfs-replace-invalid-slashes-with-exclamation-marks-in-dentries.patch
+ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch
+tipc-fix-memory-leak-caused-by-tipc_buf_append.patch

diff --git a/queue-4.9/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch b/queue-4.9/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch
new file mode 100644 (file)
index 0000000..8576296
--- /dev/null
+++ b/queue-4.9/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch
@@ -0,0 +1,72 @@
+From foo@baz Sat Oct 31 10:48:31 AM CET 2020
+From: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Date: Tue, 27 Oct 2020 10:24:03 +0700
+Subject: tipc: fix memory leak caused by tipc_buf_append()
+
+From: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+
+[ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ]
+
+Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()")
+replaced skb_unshare() with skb_copy() to not reduce the data reference
+counter of the original skb intentionally. This is not the correct
+way to handle the cloned skb because it causes memory leak in 2
+following cases:
+ 1/ Sending multicast messages via broadcast link
+  The original skb list is cloned to the local skb list for local
+  destination. After that, the data reference counter of each skb
+  in the original list has the value of 2. This causes each skb not
+  to be freed after receiving ACK:
+  tipc_link_advance_transmq()
+  {
+   ...
+   /* release skb */
+   __skb_unlink(skb, &l->transmq);
+   kfree_skb(skb); <-- memory exists after being freed
+  }
+
+ 2/ Sending multicast messages via replicast link
+  Similar to the above case, each skb cannot be freed after purging
+  the skb list:
+  tipc_mcast_xmit()
+  {
+   ...
+   __skb_queue_purge(pkts); <-- memory exists after being freed
+  }
+
+This commit fixes this issue by using skb_unshare() instead. Besides,
+to avoid use-after-free error reported by KASAN, the pointer to the
+fragment is set to NULL before calling skb_unshare() to make sure that
+the original skb is not freed after freeing the fragment 2 times in
+case skb_unshare() returns NULL.
+
+Fixes: ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()")
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Reported-by: Thang Hoang Ngo <thang.h.ngo@dektech.com.au>
+Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
+Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@dektech.com.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/msg.c |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -140,12 +140,11 @@ int tipc_buf_append(struct sk_buff **hea
+       if (fragid == FIRST_FRAGMENT) {
+               if (unlikely(head))
+                       goto err;
+-              if (skb_cloned(frag))
+-                      frag = skb_copy(frag, GFP_ATOMIC);
++              *buf = NULL;
++              frag = skb_unshare(frag, GFP_ATOMIC);
+               if (unlikely(!frag))
+                       goto err;
+               head = *headbuf = frag;
+-              *buf = NULL;
+               TIPC_SKB_CB(head)->tail = NULL;
+               if (skb_is_nonlinear(head)) {
+                       skb_walk_frags(head, tail) {