From: Greg Kroah-Hartman Date: Sat, 4 Jul 2015 03:03:48 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v4.0.8~17 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f7599cd0fa7f6b861fa30b863e3aeb4377ee3c9b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: bridge-fix-br_stp_set_bridge_priority-race-conditions.patch bridge-fix-multicast-router-rlist-endless-loop.patch packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch packet-read-num_members-once-in-packet_rcv_fanout.patch sctp-fix-race-between-ootb-responce-and-route-removal.patch sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch --- diff --git a/queue-3.10/bridge-fix-br_stp_set_bridge_priority-race-conditions.patch b/queue-3.10/bridge-fix-br_stp_set_bridge_priority-race-conditions.patch new file mode 100644 index 00000000000..ba88f17db42 --- /dev/null +++ b/queue-3.10/bridge-fix-br_stp_set_bridge_priority-race-conditions.patch @@ -0,0 +1,68 @@ +From foo@baz Fri Jul 3 20:01:12 PDT 2015 +From: Nikolay Aleksandrov +Date: Mon, 15 Jun 2015 20:28:51 +0300 +Subject: bridge: fix br_stp_set_bridge_priority race conditions + +From: Nikolay Aleksandrov + +[ Upstream commit 2dab80a8b486f02222a69daca6859519e05781d9 ] + +After the ->set() spinlocks were removed br_stp_set_bridge_priority +was left running without any protection when used via sysfs. It can +race with port add/del and could result in use-after-free cases and +corrupted lists. Tested by running port add/del in a loop with stp +enabled while setting priority in a loop, crashes are easily +reproducible. +The spinlocks around sysfs ->set() were removed in commit: +14f98f258f19 ("bridge: range check STP parameters") +There's also a race condition in the netlink priority support that is +fixed by this change, but it was introduced recently and the fixes tag +covers it, just in case it's needed the commit is: +af615762e972 ("bridge: add ageing_time, stp_state, priority over netlink") + +Signed-off-by: Nikolay Aleksandrov +Fixes: 14f98f258f19 ("bridge: range check STP parameters") +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_ioctl.c | 2 -- + net/bridge/br_stp_if.c | 4 +++- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/net/bridge/br_ioctl.c ++++ b/net/bridge/br_ioctl.c +@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_devi + if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN)) + return -EPERM; + +- spin_lock_bh(&br->lock); + br_stp_set_bridge_priority(br, args[1]); +- spin_unlock_bh(&br->lock); + return 0; + + case BRCTL_SET_PORT_PRIORITY: +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -241,12 +241,13 @@ bool br_stp_recalculate_bridge_id(struct + return true; + } + +-/* called under bridge lock */ ++/* Acquires and releases bridge lock */ + void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + { + struct net_bridge_port *p; + int wasroot; + ++ spin_lock_bh(&br->lock); + wasroot = br_is_root_bridge(br); + + list_for_each_entry(p, &br->port_list, list) { +@@ -264,6 +265,7 @@ void br_stp_set_bridge_priority(struct n + br_port_state_selection(br); + if (br_is_root_bridge(br) && !wasroot) + br_become_root_bridge(br); ++ spin_unlock_bh(&br->lock); + } + + /* called under bridge lock */ diff --git a/queue-3.10/bridge-fix-multicast-router-rlist-endless-loop.patch b/queue-3.10/bridge-fix-multicast-router-rlist-endless-loop.patch new file mode 100644 index 00000000000..16aa053aeb8 --- /dev/null +++ b/queue-3.10/bridge-fix-multicast-router-rlist-endless-loop.patch @@ -0,0 +1,57 @@ +From foo@baz Fri Jul 3 20:01:12 PDT 2015 +From: Nikolay Aleksandrov +Date: Tue, 9 Jun 2015 10:23:57 -0700 +Subject: bridge: fix multicast router rlist endless loop + +From: Nikolay Aleksandrov + +[ Upstream commit 1a040eaca1a22f8da8285ceda6b5e4a2cb704867 ] + +Since the addition of sysfs multicast router support if one set +multicast_router to "2" more than once, then the port would be added to +the hlist every time and could end up linking to itself and thus causing an +endless loop for rlist walkers. +So to reproduce just do: +echo 2 > multicast_router; echo 2 > multicast_router; +in a bridge port and let some igmp traffic flow, for me it hangs up +in br_multicast_flood(). +Fix this by adding a check in br_multicast_add_router() if the port is +already linked. +The reason this didn't happen before the addition of multicast_router +sysfs entries is because there's a !hlist_unhashed check that prevents +it. + +Signed-off-by: Nikolay Aleksandrov +Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries") +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1026,6 +1026,9 @@ static void br_multicast_add_router(stru + struct net_bridge_port *p; + struct hlist_node *slot = NULL; + ++ if (!hlist_unhashed(&port->rlist)) ++ return; ++ + hlist_for_each_entry(p, &br->router_list, rlist) { + if ((unsigned long) port >= (unsigned long) p) + break; +@@ -1053,12 +1056,8 @@ static void br_multicast_mark_router(str + if (port->multicast_router != 1) + return; + +- if (!hlist_unhashed(&port->rlist)) +- goto timer; +- + br_multicast_add_router(br, port); + +-timer: + mod_timer(&port->multicast_router_timer, + now + br->multicast_querier_interval); + } diff --git a/queue-3.10/packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch b/queue-3.10/packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch new file mode 100644 index 00000000000..9656ef825ad --- /dev/null +++ b/queue-3.10/packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch @@ -0,0 +1,62 @@ +From foo@baz Fri Jul 3 20:01:12 PDT 2015 +From: Willem de Bruijn +Date: Wed, 17 Jun 2015 15:59:34 -0400 +Subject: packet: avoid out of bounds read in round robin fanout + +From: Willem de Bruijn + +[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ] + +PACKET_FANOUT_LB computes f->rr_cur such that it is modulo +f->num_members. It returns the old value unconditionally, but +f->num_members may have changed since the last store. Ensure +that the return value is always < num. + +When modifying the logic, simplify it further by replacing the loop +with an unconditional atomic increment. + +Fixes: dc99f600698d ("packet: Add fanout support.") +Suggested-by: Eric Dumazet +Signed-off-by: Willem de Bruijn +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 18 ++---------------- + 1 file changed, 2 insertions(+), 16 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1150,16 +1150,6 @@ static void packet_sock_destruct(struct + sk_refcnt_debug_dec(sk); + } + +-static int fanout_rr_next(struct packet_fanout *f, unsigned int num) +-{ +- int x = atomic_read(&f->rr_cur) + 1; +- +- if (x >= num) +- x = 0; +- +- return x; +-} +- + static unsigned int fanout_demux_hash(struct packet_fanout *f, + struct sk_buff *skb, + unsigned int num) +@@ -1171,13 +1161,9 @@ static unsigned int fanout_demux_lb(stru + struct sk_buff *skb, + unsigned int num) + { +- int cur, old; ++ unsigned int val = atomic_inc_return(&f->rr_cur); + +- cur = atomic_read(&f->rr_cur); +- while ((old = atomic_cmpxchg(&f->rr_cur, cur, +- fanout_rr_next(f, num))) != cur) +- cur = old; +- return cur; ++ return val % num; + } + + static unsigned int fanout_demux_cpu(struct packet_fanout *f, diff --git a/queue-3.10/packet-read-num_members-once-in-packet_rcv_fanout.patch b/queue-3.10/packet-read-num_members-once-in-packet_rcv_fanout.patch new file mode 100644 index 00000000000..50db6fa8f9d --- /dev/null +++ b/queue-3.10/packet-read-num_members-once-in-packet_rcv_fanout.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Jul 3 20:01:12 PDT 2015 +From: Eric Dumazet +Date: Tue, 16 Jun 2015 07:59:11 -0700 +Subject: packet: read num_members once in packet_rcv_fanout() + +From: Eric Dumazet + +[ Upstream commit f98f4514d07871da7a113dd9e3e330743fd70ae4 ] + +We need to tell compiler it must not read f->num_members multiple +times. Otherwise testing if num is not zero is flaky, and we could +attempt an invalid divide by 0 in fanout_demux_cpu() + +Note bug was present in packet_rcv_fanout_hash() and +packet_rcv_fanout_lb() but final 3.1 had a simple location +after commit 95ec3eb417115fb ("packet: Add 'cpu' fanout policy.") + +Fixes: dc99f600698dc ("packet: Add fanout support.") +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1217,7 +1217,7 @@ static int packet_rcv_fanout(struct sk_b + struct packet_type *pt, struct net_device *orig_dev) + { + struct packet_fanout *f = pt->af_packet_priv; +- unsigned int num = f->num_members; ++ unsigned int num = ACCESS_ONCE(f->num_members); + struct packet_sock *po; + unsigned int idx; + diff --git a/queue-3.10/sctp-fix-race-between-ootb-responce-and-route-removal.patch b/queue-3.10/sctp-fix-race-between-ootb-responce-and-route-removal.patch new file mode 100644 index 00000000000..228d87dee5c --- /dev/null +++ b/queue-3.10/sctp-fix-race-between-ootb-responce-and-route-removal.patch @@ -0,0 +1,135 @@ +From foo@baz Fri Jul 3 20:01:12 PDT 2015 +From: Alexander Sverdlin +Date: Mon, 29 Jun 2015 10:41:03 +0200 +Subject: sctp: Fix race between OOTB responce and route removal + +From: Alexander Sverdlin + +[ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ] + +There is NULL pointer dereference possible during statistics update if the route +used for OOTB responce is removed at unfortunate time. If the route exists when +we receive OOTB packet and we finally jump into sctp_packet_transmit() to send +ABORT, but in the meantime route is removed under our feet, we take "no_route" +path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...). + +But sctp_ootb_pkt_new() used to prepare responce packet doesn't call +sctp_transport_set_owner() and therefore there is no asoc associated with this +packet. Probably temporary asoc just for OOTB responces is overkill, so just +introduce a check like in all other places in sctp_packet_transmit(), where +"asoc" is dereferenced. + +To reproduce this, one needs to +0. ensure that sctp module is loaded (otherwise ABORT is not generated) +1. remove default route on the machine +2. while true; do + ip route del [interface-specific route] + ip route add [interface-specific route] + done +3. send enough OOTB packets (i.e. HB REQs) from another host to trigger ABORT + responce + +On x86_64 the crash looks like this: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 +IP: [] sctp_packet_transmit+0x63c/0x730 [sctp] +PGD 0 +Oops: 0000 [#1] PREEMPT SMP +Modules linked in: ... +CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.0.5-1-ARCH #1 +Hardware name: ... +task: ffffffff818124c0 ti: ffffffff81800000 task.ti: ffffffff81800000 +RIP: 0010:[] [] sctp_packet_transmit+0x63c/0x730 [sctp] +RSP: 0018:ffff880127c037b8 EFLAGS: 00010296 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000015ff66b480 +RDX: 00000015ff66b400 RSI: ffff880127c17200 RDI: ffff880123403700 +RBP: ffff880127c03888 R08: 0000000000017200 R09: ffffffff814625af +R10: ffffea00047e4680 R11: 00000000ffffff80 R12: ffff8800b0d38a28 +R13: ffff8800b0d38a28 R14: ffff8800b3e88000 R15: ffffffffa05f24e0 +FS: 0000000000000000(0000) GS:ffff880127c00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b +CR2: 0000000000000020 CR3: 00000000c855b000 CR4: 00000000000007f0 +Stack: + ffff880127c03910 ffff8800b0d38a28 ffffffff8189d240 ffff88011f91b400 + ffff880127c03828 ffffffffa05c94c5 0000000000000000 ffff8800baa1c520 + 0000000000000000 0000000000000001 0000000000000000 0000000000000000 +Call Trace: + + [] ? sctp_sf_tabort_8_4_8.isra.20+0x85/0x140 [sctp] + [] ? sctp_transport_put+0x52/0x80 [sctp] + [] sctp_do_sm+0xb8c/0x19a0 [sctp] + [] ? trigger_load_balance+0x90/0x210 + [] ? update_process_times+0x59/0x60 + [] ? timerqueue_add+0x60/0xb0 + [] ? enqueue_hrtimer+0x29/0xa0 + [] ? read_tsc+0x9/0x10 + [] ? put_page+0x55/0x60 + [] ? clockevents_program_event+0x6d/0x100 + [] ? skb_free_head+0x58/0x80 + [] ? chksum_update+0x1b/0x27 [crc32c_generic] + [] ? crypto_shash_update+0xce/0xf0 + [] sctp_endpoint_bh_rcv+0x113/0x280 [sctp] + [] sctp_inq_push+0x46/0x60 [sctp] + [] sctp_rcv+0x880/0x910 [sctp] + [] ? sctp_packet_transmit_chunk+0xb0/0xb0 [sctp] + [] ? sctp_csum_update+0x20/0x20 [sctp] + [] ? ip_route_input_noref+0x235/0xd30 + [] ? ack_ioapic_level+0x7b/0x150 + [] ip_local_deliver_finish+0xae/0x210 + [] ip_local_deliver+0x35/0x90 + [] ip_rcv_finish+0xf5/0x370 + [] ip_rcv+0x2b8/0x3a0 + [] __netif_receive_skb_core+0x763/0xa50 + [] __netif_receive_skb+0x18/0x60 + [] netif_receive_skb_internal+0x40/0xd0 + [] napi_gro_receive+0xe8/0x120 + [] rtl8169_poll+0x2da/0x660 [r8169] + [] net_rx_action+0x21a/0x360 + [] __do_softirq+0xe1/0x2d0 + [] irq_exit+0xad/0xb0 + [] do_IRQ+0x58/0xf0 + [] common_interrupt+0x6d/0x6d + + [] ? hrtimer_start+0x18/0x20 + [] ? sctp_transport_destroy_rcu+0x29/0x30 [sctp] + [] ? mwait_idle+0x60/0xa0 + [] arch_cpu_idle+0xf/0x20 + [] cpu_startup_entry+0x3ec/0x480 + [] rest_init+0x85/0x90 + [] start_kernel+0x48b/0x4ac + [] ? early_idt_handlers+0x120/0x120 + [] x86_64_start_reservations+0x2a/0x2c + [] x86_64_start_kernel+0x161/0x184 +Code: 90 48 8b 80 b8 00 00 00 48 89 85 70 ff ff ff 48 83 bd 70 ff ff ff 00 0f 85 cd fa ff ff 48 89 df 31 db e8 18 63 e7 e0 48 8b 45 80 <48> 8b 40 20 48 8b 40 30 48 8b 80 68 01 00 00 65 48 ff 40 78 e9 +RIP [] sctp_packet_transmit+0x63c/0x730 [sctp] + RSP +CR2: 0000000000000020 +---[ end trace 5aec7fd2dc983574 ]--- +Kernel panic - not syncing: Fatal exception in interrupt +Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff) +drm_kms_helper: panic occurred, switching back to text console +---[ end Kernel panic - not syncing: Fatal exception in interrupt + +Signed-off-by: Alexander Sverdlin +Acked-by: Neil Horman +Acked-by: Marcelo Ricardo Leitner +Acked-by: Vlad Yasevich +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/output.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -618,7 +618,9 @@ out: + return err; + no_route: + kfree_skb(nskb); +- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); ++ ++ if (asoc) ++ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); + + /* FIXME: Returning the 'err' will effect all the associations + * associated with a socket, although only one of the paths of the diff --git a/queue-3.10/series b/queue-3.10/series new file mode 100644 index 00000000000..815f03f6a2d --- /dev/null +++ b/queue-3.10/series @@ -0,0 +1,6 @@ +sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch +bridge-fix-multicast-router-rlist-endless-loop.patch +bridge-fix-br_stp_set_bridge_priority-race-conditions.patch +packet-read-num_members-once-in-packet_rcv_fanout.patch +packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch +sctp-fix-race-between-ootb-responce-and-route-removal.patch diff --git a/queue-3.10/sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch b/queue-3.10/sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch new file mode 100644 index 00000000000..493a9d3e4d8 --- /dev/null +++ b/queue-3.10/sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch @@ -0,0 +1,40 @@ +From patchwork Tue Apr 21 14:30:41 2015 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in + softirq context +From: Sowmini Varadhan +X-Patchwork-Id: 463148 +Message-Id: <1429626641-199974-1-git-send-email-sowmini.varadhan@oracle.com> +To: sowmini.varadhan@oracle.com, sparclinux@vger.kernel.org +Cc: david.stevens@oracle.com, davem@davemloft.net +Date: Tue, 21 Apr 2015 10:30:41 -0400 + +From: Sowmini Varadhan + +Upstream commit 671d773297969bebb1732e1cdc1ec03aa53c6be2 + +Since it is possible for vnet_event_napi to end up doing +vnet_control_pkt_engine -> ... -> vnet_send_attr -> +vnet_port_alloc_tx_ring -> ldc_alloc_exp_dring -> kzalloc() +(i.e., in softirq context), kzalloc() should be called with +GFP_ATOMIC from ldc_alloc_exp_dring. + +Signed-off-by: Sowmini Varadhan +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/ldc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -2306,7 +2306,7 @@ void *ldc_alloc_exp_dring(struct ldc_cha + if (len & (8UL - 1)) + return ERR_PTR(-EINVAL); + +- buf = kzalloc(len, GFP_KERNEL); ++ buf = kzalloc(len, GFP_ATOMIC); + if (!buf) + return ERR_PTR(-ENOMEM); + diff --git a/queue-3.14/series b/queue-3.14/series new file mode 100644 index 00000000000..de8140215f5 --- /dev/null +++ b/queue-3.14/series @@ -0,0 +1,11 @@ +sparc-Use-GFP_ATOMIC-in-ldc_alloc_exp_dring-as-it-can-be-called-in-softirq-context.patch +bridge-fix-multicast-router-rlist-endless-loop.patch +net-don-t-wait-for-order-3-page-allocation.patch +sctp-fix-asconf-list-handling.patch +bridge-fix-br_stp_set_bridge_priority-race-conditions.patch +packet-read-num_members-once-in-packet_rcv_fanout.patch +packet-avoid-out-of-bounds-read-in-round-robin-fanout.patch +neigh-do-not-modify-unlinked-entries.patch +tcp-do-not-call-tcp_fastopen_reset_cipher-from-interrupt-context.patch +net-phy-fix-phy-link-up-when-limiting-speed-via-device-tree.patch +sctp-fix-race-between-ootb-responce-and-route-removal.patch