4.14-stable patches

added patches:
	xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch

diff --git a/queue-4.14/series b/queue-4.14/series
index 5236fb3b371661549a7f14b367969dc1a1ea7348..71d042b067dfbc7a3311c60f37383e8a725829e0 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -3,3 +3,4 @@ orangefs-initialize-op-on-loop-restart-in-orangefs_devreq_read.patch
 mm-page_alloc-fix-potential-false-positive-in-__zone_watermark_ok.patch
 netfilter-nfnetlink_cthelper-add-missing-permission-checks.patch
 netfilter-xt_osf-add-missing-permission-checks.patch
+xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch

diff --git a/queue-4.14/xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch b/queue-4.14/xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch
new file mode 100644 (file)
index 0000000..153115a
--- /dev/null
+++ b/queue-4.14/xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch
@@ -0,0 +1,52 @@
+From 76a4201191814a0061cb5c861fafb9ecaa764846 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Wed, 10 Jan 2018 12:14:28 +0100
+Subject: xfrm: Fix a race in the xdst pcpu cache.
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+commit 76a4201191814a0061cb5c861fafb9ecaa764846 upstream.
+
+We need to run xfrm_resolve_and_create_bundle() with
+bottom halves off. Otherwise we may reuse an already
+released dst_enty when the xfrm lookup functions are
+called from process context.
+
+Fixes: c30d78c14a813db39a647b6a348b428 ("xfrm: add xdst pcpu cache")
+Reported-by: Darius Ski <darius.ski@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Acked-by: David Miller <davem@davemloft.net>,
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/xfrm/xfrm_policy.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2056,8 +2056,11 @@ xfrm_bundle_lookup(struct net *net, cons
+       if (num_xfrms <= 0)
+               goto make_dummy_bundle;
+ 
++      local_bh_disable();
+       xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family,
+-                                                xflo->dst_orig);
++                                            xflo->dst_orig);
++      local_bh_enable();
++
+       if (IS_ERR(xdst)) {
+               err = PTR_ERR(xdst);
+               if (err != -EAGAIN)
+@@ -2144,9 +2147,12 @@ struct dst_entry *xfrm_lookup(struct net
+                               goto no_transform;
+                       }
+ 
++                      local_bh_disable();
+                       xdst = xfrm_resolve_and_create_bundle(
+                                       pols, num_pols, fl,
+                                       family, dst_orig);
++                      local_bh_enable();
++
+                       if (IS_ERR(xdst)) {
+                               xfrm_pols_put(pols, num_pols);
+                               err = PTR_ERR(xdst);