From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 31 May 2021 11:58:54 +0000 (+0200)
Subject: 5.4-stable patches
X-Git-Tag: v4.4.271~20
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f0bb14e0dbb8a3032b496f878ade51997fc04d2e;p=thirdparty%2Fkernel%2Fstable-queue.git

5.4-stable patches

added patches:
	neighbour-prevent-race-condition-in-neighbour-subsytem.patch
---

diff --git a/queue-5.4/neighbour-prevent-race-condition-in-neighbour-subsytem.patch b/queue-5.4/neighbour-prevent-race-condition-in-neighbour-subsytem.patch
new file mode 100644
index 00000000000..25af0c99627
--- /dev/null
+++ b/queue-5.4/neighbour-prevent-race-condition-in-neighbour-subsytem.patch
@@ -0,0 +1,62 @@
+From eefb45eef5c4c425e87667af8f5e904fbdd47abf Mon Sep 17 00:00:00 2001
+From: Chinmay Agarwal <chinagar@codeaurora.org>
+Date: Thu, 22 Apr 2021 01:12:22 +0530
+Subject: neighbour: Prevent Race condition in neighbour subsytem
+
+From: Chinmay Agarwal <chinagar@codeaurora.org>
+
+commit eefb45eef5c4c425e87667af8f5e904fbdd47abf upstream.
+
+Following Race Condition was detected:
+
+<CPU A, t0>: Executing: __netif_receive_skb() ->__netif_receive_skb_core()
+-> arp_rcv() -> arp_process().arp_process() calls __neigh_lookup() which
+takes a reference on neighbour entry 'n'.
+Moves further along, arp_process() and calls neigh_update()->
+__neigh_update(). Neighbour entry is unlocked just before a call to
+neigh_update_gc_list.
+
+This unlocking paves way for another thread that may take a reference on
+the same and mark it dead and remove it from gc_list.
+
+<CPU B, t1> - neigh_flush_dev() is under execution and calls
+neigh_mark_dead(n) marking the neighbour entry 'n' as dead. Also n will be
+removed from gc_list.
+Moves further along neigh_flush_dev() and calls
+neigh_cleanup_and_release(n), but since reference count increased in t1,
+'n' couldn't be destroyed.
+
+<CPU A, t3>- Code hits neigh_update_gc_list, with neighbour entry
+set as dead.
+
+<CPU A, t4> - arp_process() finally calls neigh_release(n), destroying
+the neighbour entry and we have a destroyed ntry still part of gc_list.
+
+Fixes: eb4e8fac00d1("neighbour: Prevent a dead entry from updating gc_list")
+Signed-off-by: Chinmay Agarwal <chinagar@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/neighbour.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -132,6 +132,9 @@ static void neigh_update_gc_list(struct
+ 	write_lock_bh(&n->tbl->lock);
+ 	write_lock(&n->lock);
+ 
++	if (n->dead)
++		goto out;
++
+ 	/* remove from the gc list if new state is permanent or if neighbor
+ 	 * is externally learned; otherwise entry should be on the gc list
+ 	 */
+@@ -148,6 +151,7 @@ static void neigh_update_gc_list(struct
+ 		atomic_inc(&n->tbl->gc_entries);
+ 	}
+ 
++out:
+ 	write_unlock(&n->lock);
+ 	write_unlock_bh(&n->tbl->lock);
+ }
diff --git a/queue-5.4/series b/queue-5.4/series
index cb070c7836d..eef8de3922d 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -173,3 +173,4 @@ drivers-net-ethernet-clean-up-unused-assignments.patch
 net-hns3-check-the-return-of-skb_checksum_help.patch
 revert-revert-alsa-usx2y-fix-potential-null-pointer-dereference.patch
 net-hso-bail-out-on-interrupt-urb-allocation-failure.patch
+neighbour-prevent-race-condition-in-neighbour-subsytem.patch