diff options
| -rw-r--r-- | 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch | 75 | ||||
| -rw-r--r-- | KVM-x86-work-around-infinite-loop-in-microcode-when-.patch | 92 | ||||
| -rw-r--r-- | kernel.spec | 13 | ||||
| -rw-r--r-- | net_43.mbox | 1330 | ||||
| -rw-r--r-- | sources | 1 |
5 files changed, 5 insertions, 1506 deletions
diff --git a/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch b/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch deleted file mode 100644 index 4bb863192..000000000 --- a/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 35069d255591dad72c2197ccc8c536fc5a9f294f Mon Sep 17 00:00:00 2001 -From: Oren Givon <oren.givon@intel.com> -Date: Wed, 28 Oct 2015 12:32:20 +0200 -Subject: [PATCH] iwlwifi: Add new PCI IDs for the 8260 series - -Add some new PCI IDs for the 8260 series which were missing. -The following sub-system IDs were added: -0x0130, 0x1130, 0x0132, 0x1132, 0x1150, 0x8110, 0x9110, 0x8130, -0x9130, 0x8132, 0x9132, 0x8150, 0x9150, 0x0044, 0x0930 - -Signed-off-by: Oren Givon <oren.givon@intel.com> -Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> ---- - drivers/net/wireless/iwlwifi/pcie/drv.c | 19 ++++++++++++++++++- - 1 file changed, 18 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c -index 644b58b..639761f 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c -@@ -423,14 +423,21 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - /* 8000 Series */ - {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1132, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0110, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x01F0, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0012, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1012, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0250, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0150, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1150, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)}, -- {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)}, -@@ -438,18 +445,28 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x8030, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x9030, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8132, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9132, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x8050, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8150, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x9050, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9150, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0044, iwl8260_2n_cfg)}, - {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0810, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0910, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0850, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0950, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0930, iwl8260_2ac_cfg)}, - #endif /* CONFIG_IWLMVM */ - - {0} --- -2.4.3 - diff --git a/KVM-x86-work-around-infinite-loop-in-microcode-when-.patch b/KVM-x86-work-around-infinite-loop-in-microcode-when-.patch deleted file mode 100644 index 013af11e1..000000000 --- a/KVM-x86-work-around-infinite-loop-in-microcode-when-.patch +++ /dev/null @@ -1,92 +0,0 @@ -From adceca1789584fe567828afb7246bd35a8549e94 Mon Sep 17 00:00:00 2001 -From: Eric Northup <digitaleric@google.com> -Date: Tue, 10 Nov 2015 13:22:52 +0100 -Subject: [PATCH 1/2] KVM: x86: work around infinite loop in microcode when #AC - is delivered - -It was found that a guest can DoS a host by triggering an infinite -stream of "alignment check" (#AC) exceptions. This causes the -microcode to enter an infinite loop where the core never receives -another interrupt. The host kernel panics pretty quickly due to the -effects (CVE-2015-5307). - -Signed-off-by: Eric Northup <digitaleric@google.com> -Cc: stable@vger.kernel.org -Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> ---- - arch/x86/include/uapi/asm/svm.h | 1 + - arch/x86/kvm/svm.c | 8 ++++++++ - arch/x86/kvm/vmx.c | 5 ++++- - 3 files changed, 13 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h -index b5d7640abc5d..8a4add8e4639 100644 ---- a/arch/x86/include/uapi/asm/svm.h -+++ b/arch/x86/include/uapi/asm/svm.h -@@ -100,6 +100,7 @@ - { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \ - { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \ - { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \ -+ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \ - { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \ - { SVM_EXIT_INTR, "interrupt" }, \ - { SVM_EXIT_NMI, "nmi" }, \ -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index f2c8e4917688..7203b3cc71b5 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -1110,6 +1110,7 @@ static void init_vmcb(struct vcpu_svm *svm) - set_exception_intercept(svm, PF_VECTOR); - set_exception_intercept(svm, UD_VECTOR); - set_exception_intercept(svm, MC_VECTOR); -+ set_exception_intercept(svm, AC_VECTOR); - - set_intercept(svm, INTERCEPT_INTR); - set_intercept(svm, INTERCEPT_NMI); -@@ -1798,6 +1799,12 @@ static int ud_interception(struct vcpu_svm *svm) - return 1; - } - -+static int ac_interception(struct vcpu_svm *svm) -+{ -+ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0); -+ return 1; -+} -+ - static void svm_fpu_activate(struct kvm_vcpu *vcpu) - { - struct vcpu_svm *svm = to_svm(vcpu); -@@ -3362,6 +3369,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = { - [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception, - [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception, - [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception, -+ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception, - [SVM_EXIT_INTR] = intr_interception, - [SVM_EXIT_NMI] = nmi_interception, - [SVM_EXIT_SMI] = nop_on_interception, -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 5eb56ed77c1f..106aa940d3c0 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -1631,7 +1631,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu) - u32 eb; - - eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) | -- (1u << NM_VECTOR) | (1u << DB_VECTOR); -+ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR); - if ((vcpu->guest_debug & - (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) == - (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) -@@ -5266,6 +5266,9 @@ static int handle_exception(struct kvm_vcpu *vcpu) - return handle_rmode_exception(vcpu, ex_no, error_code); - - switch (ex_no) { -+ case AC_VECTOR: -+ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code); -+ return 1; - case DB_VECTOR: - dr6 = vmcs_readl(EXIT_QUALIFICATION); - if (!(vcpu->guest_debug & --- -2.4.3 - diff --git a/kernel.spec b/kernel.spec index e25be2e85..bd867b316 100644 --- a/kernel.spec +++ b/kernel.spec @@ -52,7 +52,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 0 +%define stable_update 1 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -588,9 +588,6 @@ Patch503: drm-i915-turn-off-wc-mmaps.patch Patch508: kexec-uefi-copy-secure_boot-flag-in-boot-params.patch -#rhbz 1275490 -Patch510: 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch - #CVE-2015-7990 rhbz 1276437 1276438 Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch @@ -598,9 +595,6 @@ Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch Patch512: isdn_ppp-Add-checks-for-allocation-failure-in-isdn_p.patch Patch513: ppp-slip-Validate-VJ-compression-slot-parameters-com.patch -#CVE-2015-5307 rhbz 1277172 1279688 -Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch - #CVE-2015-8104 rhbz 1278496 1279691 Patch551: KVM-svm-unconditionally-intercept-DB.patch @@ -613,8 +607,6 @@ Patch553: ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch #CVE-2015-5327 Patch554: X.509-Fix-the-time-validation-ver-3.patch -Patch555: net_43.mbox - #rhbz 1279189 Patch556: netfilter-ipset-Fix-extension-alignment.patch Patch557: netfilter-ipset-Fix-hash-type-expiration.patch @@ -2078,6 +2070,9 @@ fi # # %changelog +* Wed Dec 09 2015 Josh Boyer <jwboyer@fedoraproject.org> +- Linux v4.3.1 + * Thu Dec 03 2015 Josh Boyer <jwboyer@fedoraproject.org> - Add patch to fix palm rejection on certain touchpads (rhbz 1287819) diff --git a/net_43.mbox b/net_43.mbox deleted file mode 100644 index 7e4c7a253..000000000 --- a/net_43.mbox +++ /dev/null @@ -1,1330 +0,0 @@ -From 212f263930ebc1020ad12dd0fa52a058592709e8 Mon Sep 17 00:00:00 2001 -From: Jon Paul Maloy <jon.maloy@ericsson.com> -Date: Wed, 28 Oct 2015 13:09:53 -0400 -Subject: [PATCH 01/17] tipc: linearize arriving NAME_DISTR and LINK_PROTO - buffers - -[ Upstream commit 5cbb28a4bf65c7e4daa6c25b651fed8eb888c620 ] - -Testing of the new UDP bearer has revealed that reception of -NAME_DISTRIBUTOR, LINK_PROTOCOL/RESET and LINK_PROTOCOL/ACTIVATE -message buffers is not prepared for the case that those may be -non-linear. - -We now linearize all such buffers before they are delivered up to the -generic reception layer. - -In order for the commit to apply cleanly to 'net' and 'stable', we do -the change in the function tipc_udp_recv() for now. Later, we will post -a commit to 'net-next' moving the linearization to generic code, in -tipc_named_rcv() and tipc_link_proto_rcv(). - -Fixes: commit d0f91938bede ("tipc: add ip/udp media type") -Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/tipc/udp_media.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c -index 6e648d9..cd7c5f1 100644 ---- a/net/tipc/udp_media.c -+++ b/net/tipc/udp_media.c -@@ -48,6 +48,7 @@ - #include <linux/tipc_netlink.h> - #include "core.h" - #include "bearer.h" -+#include "msg.h" - - /* IANA assigned UDP port */ - #define UDP_PORT_DEFAULT 6118 -@@ -222,6 +223,10 @@ static int tipc_udp_recv(struct sock *sk, struct sk_buff *skb) - { - struct udp_bearer *ub; - struct tipc_bearer *b; -+ int usr = msg_user(buf_msg(skb)); -+ -+ if ((usr == LINK_PROTOCOL) || (usr == NAME_DISTRIBUTOR)) -+ skb_linearize(skb); - - ub = rcu_dereference_sk_user_data(sk); - if (!ub) { --- -2.4.1 - - -From a04db8659b41413b9ef6751b1487c96f4fe5c8c1 Mon Sep 17 00:00:00 2001 -From: Florian Fainelli <f.fainelli@gmail.com> -Date: Thu, 29 Oct 2015 18:11:35 -0700 -Subject: [PATCH 02/17] net: bcmgenet: Software reset EPHY after power on - -[ Upstream commit 5dbebbb44a6ad94aab2cd1a46f7676f255403f64 ] - -The EPHY on GENET v1->v3 is extremely finicky, and will show occasional -failures based on the timing and reset sequence, ranging from duplicate -packets, to extremely high latencies. - -Perform an additional software reset, and re-configuration to make sure it is -in a consistent and working state. - -Fixes: 6ac3ce8295e6 ("net: bcmgenet: Remove excessive PHY reset") -Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++- - drivers/net/ethernet/broadcom/genet/bcmgenet.h | 1 + - drivers/net/ethernet/broadcom/genet/bcmmii.c | 18 ++++++++++++++++++ - 3 files changed, 22 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index 1805541..5e3cd76 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -907,8 +907,10 @@ static void bcmgenet_power_up(struct bcmgenet_priv *priv, - } - - bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT); -- if (mode == GENET_POWER_PASSIVE) -+ if (mode == GENET_POWER_PASSIVE) { - bcmgenet_phy_power_set(priv->dev, true); -+ bcmgenet_mii_reset(priv->dev); -+ } - } - - /* ioctl handle special commands that are not present in ethtool. */ -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -index 7299d10..c739f7e 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -@@ -674,6 +674,7 @@ int bcmgenet_mii_init(struct net_device *dev); - int bcmgenet_mii_config(struct net_device *dev); - int bcmgenet_mii_probe(struct net_device *dev); - void bcmgenet_mii_exit(struct net_device *dev); -+void bcmgenet_mii_reset(struct net_device *dev); - void bcmgenet_phy_power_set(struct net_device *dev, bool enable); - void bcmgenet_mii_setup(struct net_device *dev); - -diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c -index c8affad..8bdfe53 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmmii.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c -@@ -163,6 +163,7 @@ void bcmgenet_mii_setup(struct net_device *dev) - phy_print_status(phydev); - } - -+ - static int bcmgenet_fixed_phy_link_update(struct net_device *dev, - struct fixed_phy_status *status) - { -@@ -172,6 +173,22 @@ static int bcmgenet_fixed_phy_link_update(struct net_device *dev, - return 0; - } - -+/* Perform a voluntary PHY software reset, since the EPHY is very finicky about -+ * not doing it and will start corrupting packets -+ */ -+void bcmgenet_mii_reset(struct net_device *dev) -+{ -+ struct bcmgenet_priv *priv = netdev_priv(dev); -+ -+ if (GENET_IS_V4(priv)) -+ return; -+ -+ if (priv->phydev) { -+ phy_init_hw(priv->phydev); -+ phy_start_aneg(priv->phydev); -+ } -+} -+ - void bcmgenet_phy_power_set(struct net_device *dev, bool enable) - { - struct bcmgenet_priv *priv = netdev_priv(dev); -@@ -214,6 +231,7 @@ static void bcmgenet_internal_phy_setup(struct net_device *dev) - reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT); - reg |= EXT_PWR_DN_EN_LD; - bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT); -+ bcmgenet_mii_reset(dev); - } - - static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv) --- -2.4.1 - - -From 667672b33d13d71b92244bbd410f0a4122afa428 Mon Sep 17 00:00:00 2001 -From: Julian Anastasov <ja@ssi.bg> -Date: Fri, 30 Oct 2015 10:23:33 +0200 -Subject: [PATCH 03/17] ipv4: fix to not remove local route on link down - -[ Upstream commit 4f823defdd5b106a5e89745ee8b163c71855de1e ] - -When fib_netdev_event calls fib_disable_ip on NETDEV_DOWN event -we should not delete the local routes if the local address -is still present. The confusion comes from the fact that both -fib_netdev_event and fib_inetaddr_event use the NETDEV_DOWN -constant. Fix it by returning back the variable 'force'. - -Steps to reproduce: -modprobe dummy -ifconfig dummy0 192.168.168.1 up -ifconfig dummy0 down -ip route list table local | grep dummy | grep host -local 192.168.168.1 dev dummy0 proto kernel scope host src 192.168.168.1 - -Fixes: 8a3d03166f19 ("net: track link-status of ipv4 nexthops") -Signed-off-by: Julian Anastasov <ja@ssi.bg> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - include/net/ip_fib.h | 2 +- - net/ipv4/fib_frontend.c | 13 +++++++------ - net/ipv4/fib_semantics.c | 11 ++++++++--- - 3 files changed, 16 insertions(+), 10 deletions(-) - -diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h -index 727d6e9..965fa5b 100644 ---- a/include/net/ip_fib.h -+++ b/include/net/ip_fib.h -@@ -317,7 +317,7 @@ void fib_flush_external(struct net *net); - - /* Exported by fib_semantics.c */ - int ip_fib_check_default(__be32 gw, struct net_device *dev); --int fib_sync_down_dev(struct net_device *dev, unsigned long event); -+int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force); - int fib_sync_down_addr(struct net *net, __be32 local); - int fib_sync_up(struct net_device *dev, unsigned int nh_flags); - void fib_select_multipath(struct fib_result *res); -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 690bcbc..457b2cd 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -1110,9 +1110,10 @@ static void nl_fib_lookup_exit(struct net *net) - net->ipv4.fibnl = NULL; - } - --static void fib_disable_ip(struct net_device *dev, unsigned long event) -+static void fib_disable_ip(struct net_device *dev, unsigned long event, -+ bool force) - { -- if (fib_sync_down_dev(dev, event)) -+ if (fib_sync_down_dev(dev, event, force)) - fib_flush(dev_net(dev)); - rt_cache_flush(dev_net(dev)); - arp_ifdown(dev); -@@ -1140,7 +1141,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, - /* Last address was deleted from this interface. - * Disable IP. - */ -- fib_disable_ip(dev, event); -+ fib_disable_ip(dev, event, true); - } else { - rt_cache_flush(dev_net(dev)); - } -@@ -1157,7 +1158,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo - unsigned int flags; - - if (event == NETDEV_UNREGISTER) { -- fib_disable_ip(dev, event); -+ fib_disable_ip(dev, event, true); - rt_flush_dev(dev); - return NOTIFY_DONE; - } -@@ -1178,14 +1179,14 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo - rt_cache_flush(net); - break; - case NETDEV_DOWN: -- fib_disable_ip(dev, event); -+ fib_disable_ip(dev, event, false); - break; - case NETDEV_CHANGE: - flags = dev_get_flags(dev); - if (flags & (IFF_RUNNING | IFF_LOWER_UP)) - fib_sync_up(dev, RTNH_F_LINKDOWN); - else -- fib_sync_down_dev(dev, event); -+ fib_sync_down_dev(dev, event, false); - /* fall through */ - case NETDEV_CHANGEMTU: - rt_cache_flush(net); -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 064bd3c..2aa5b5e 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -1281,7 +1281,13 @@ int fib_sync_down_addr(struct net *net, __be32 local) - return ret; - } - --int fib_sync_down_dev(struct net_device *dev, unsigned long event) -+/* Event force Flags Description -+ * NETDEV_CHANGE 0 LINKDOWN Carrier OFF, not for scope host -+ * NETDEV_DOWN 0 LINKDOWN|DEAD Link down, not for scope host -+ * NETDEV_DOWN 1 LINKDOWN|DEAD Last address removed -+ * NETDEV_UNREGISTER 1 LINKDOWN|DEAD Device removed -+ */ -+int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force) - { - int ret = 0; - int scope = RT_SCOPE_NOWHERE; -@@ -1290,8 +1296,7 @@ int fib_sync_down_dev(struct net_device *dev, unsigned long event) - struct hlist_head *head = &fib_info_devhash[hash]; - struct fib_nh *nh; - -- if (event == NETDEV_UNREGISTER || -- event == NETDEV_DOWN) -+ if (force) - scope = -1; - - hlist_for_each_entry(nh, head, nh_hash) { --- -2.4.1 - - -From 79c1b779621a34487aaf8a7fa1e499c04fff5c79 Mon Sep 17 00:00:00 2001 -From: Julian Anastasov <ja@ssi.bg> -Date: Fri, 30 Oct 2015 10:23:34 +0200 -Subject: [PATCH 04/17] ipv4: update RTNH_F_LINKDOWN flag on UP event - -[ Upstream commit c9b3292eeb52c6834e972eb5b8fe38914771ed12 ] - -When nexthop is part of multipath route we should clear the -LINKDOWN flag when link goes UP or when first address is added. -This is needed because we always set LINKDOWN flag when DEAD flag -was set but now on UP the nexthop is not dead anymore. Examples when -LINKDOWN bit can be forgotten when no NETDEV_CHANGE is delivered: - -- link goes down (LINKDOWN is set), then link goes UP and device -shows carrier OK but LINKDOWN remains set - -- last address is deleted (LINKDOWN is set), then address is -added and device shows carrier OK but LINKDOWN remains set - -Steps to reproduce: -modprobe dummy -ifconfig dummy0 192.168.168.1 up - -here add a multipath route where one nexthop is for dummy0: - -ip route add 1.2.3.4 nexthop dummy0 nexthop SOME_OTHER_DEVICE -ifconfig dummy0 down -ifconfig dummy0 up - -now ip route shows nexthop that is not dead. Now set the sysctl var: - -echo 1 > /proc/sys/net/ipv4/conf/dummy0/ignore_routes_with_linkdown - -now ip route will show a dead nexthop because the forgotten -RTNH_F_LINKDOWN is propagated as RTNH_F_DEAD. - -Fixes: 8a3d03166f19 ("net: track link-status of ipv4 nexthops") -Signed-off-by: Julian Anastasov <ja@ssi.bg> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/ipv4/fib_semantics.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 2aa5b5e..e966f85 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -1445,6 +1445,13 @@ int fib_sync_up(struct net_device *dev, unsigned int nh_flags) - if (!(dev->flags & IFF_UP)) - return 0; - -+ if (nh_flags & RTNH_F_DEAD) { -+ unsigned int flags = dev_get_flags(dev); -+ -+ if (flags & (IFF_RUNNING | IFF_LOWER_UP)) -+ nh_flags |= RTNH_F_LINKDOWN; -+ } -+ - prev_fi = NULL; - hash = fib_devindex_hashfn(dev->ifindex); - head = &fib_info_devhash[hash]; --- -2.4.1 - - -From 22c6a0b8732f4b426f64f18ca9097288cd996a64 Mon Sep 17 00:00:00 2001 -From: Phil Reid <preid@electromag.com.au> -Date: Fri, 30 Oct 2015 16:43:55 +0800 -Subject: [PATCH 05/17] stmmac: Correctly report PTP capabilities. - -[ Upstream commit e6dbe1eb2db0d7a14991c06278dd3030c45fb825 ] - -priv->hwts_*_en indicate if timestamping is enabled/disabled at run -time. But priv->dma_cap.time_stamp and priv->dma_cap.atime_stamp -indicates HW is support for PTPv1/PTPv2. - -Signed-off-by: Phil Reid <preid@electromag.com.au> -Acked-by: Richard Cochran <richardcochran@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index 771cda2..2e51b81 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -721,10 +721,13 @@ static int stmmac_get_ts_info(struct net_device *dev, - { - struct stmmac_priv *priv = netdev_priv(dev); - -- if ((priv->hwts_tx_en) && (priv->hwts_rx_en)) { -+ if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) { - -- info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | -+ info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | -+ SOF_TIMESTAMPING_TX_HARDWARE | -+ SOF_TIMESTAMPING_RX_SOFTWARE | - SOF_TIMESTAMPING_RX_HARDWARE | -+ SOF_TIMESTAMPING_SOFTWARE | - SOF_TIMESTAMPING_RAW_HARDWARE; - - if (priv->ptp_clock) --- -2.4.1 - - -From 27cc4a97a3cdcb3b3daa126667d4e86c9b014909 Mon Sep 17 00:00:00 2001 -From: Ani Sinha <ani@arista.com> -Date: Fri, 30 Oct 2015 16:54:31 -0700 -Subject: [PATCH 06/17] ipmr: fix possible race resulting from improper usage - of IP_INC_STATS_BH() in preemptible context. - -[ Upstream commit 44f49dd8b5a606870a1f21101522a0f9c4414784 ] - -Fixes the following kernel BUG : - -BUG: using __this_cpu_add() in preemptible [00000000] code: bash/2758 -caller is __this_cpu_preempt_check+0x13/0x15 -CPU: 0 PID: 2758 Comm: bash Tainted: P O 3.18.19 #2 - ffffffff8170eaca ffff880110d1b788 ffffffff81482b2a 0000000000000000 - 0000000000000000 ffff880110d1b7b8 ffffffff812010ae ffff880007cab800 - ffff88001a060800 ffff88013a899108 ffff880108b84240 ffff880110d1b7c8 -Call Trace: -[<ffffffff81482b2a>] dump_stack+0x52/0x80 -[<ffffffff812010ae>] check_preemption_disabled+0xce/0xe1 -[<ffffffff812010d4>] __this_cpu_preempt_check+0x13/0x15 -[<ffffffff81419d60>] ipmr_queue_xmit+0x647/0x70c -[<ffffffff8141a154>] ip_mr_forward+0x32f/0x34e -[<ffffffff8141af76>] ip_mroute_setsockopt+0xe03/0x108c -[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42 -[<ffffffff810e6974>] ? pollwake+0x4d/0x51 -[<ffffffff81058ac0>] ? default_wake_function+0x0/0xf -[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42 -[<ffffffff810613d9>] ? __wake_up_common+0x45/0x77 -[<ffffffff81486ea9>] ? _raw_spin_unlock_irqrestore+0x1d/0x32 -[<ffffffff810618bc>] ? __wake_up_sync_key+0x4a/0x53 -[<ffffffff8139a519>] ? sock_def_readable+0x71/0x75 -[<ffffffff813dd226>] do_ip_setsockopt+0x9d/0xb55 -[<ffffffff81429818>] ? unix_seqpacket_sendmsg+0x3f/0x41 -[<ffffffff813963fe>] ? sock_sendmsg+0x6d/0x86 -[<ffffffff813959d4>] ? sockfd_lookup_light+0x12/0x5d -[<ffffffff8139650a>] ? SyS_sendto+0xf3/0x11b -[<ffffffff810d5738>] ? new_sync_read+0x82/0xaa -[<ffffffff813ddd19>] compat_ip_setsockopt+0x3b/0x99 -[<ffffffff813fb24a>] compat_raw_setsockopt+0x11/0x32 -[<ffffffff81399052>] compat_sock_common_setsockopt+0x18/0x1f -[<ffffffff813c4d05>] compat_SyS_setsockopt+0x1a9/0x1cf -[<ffffffff813c4149>] compat_SyS_socketcall+0x180/0x1e3 -[<ffffffff81488ea1>] cstar_dispatch+0x7/0x1e - -Signed-off-by: Ani Sinha <ani@arista.com> -Acked-by: Eric Dumazet <edumazet@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/ipv4/ipmr.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index 866ee89..8e8203d 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -1682,8 +1682,8 @@ static inline int ipmr_forward_finish(struct sock *sk, struct sk_buff *skb) - { - struct ip_options *opt = &(IPCB(skb)->opt); - -- IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); -- IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); -+ IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); -+ IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); - - if (unlikely(opt->optlen)) - ip_forward_options(skb); -@@ -1745,7 +1745,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt, - * to blackhole. - */ - -- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS); -+ IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); - ip_rt_put(rt); - goto out_free; - } --- -2.4.1 - - -From 217a7af11532c12fc19168231216160cbf92adc8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no> -Date: Sun, 1 Nov 2015 01:34:50 +0100 -Subject: [PATCH 07/17] qmi_wwan: fix entry for HP lt4112 LTE/HSPA+ Gobi 4G - Module -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit 70910791731b5956171e1bfcad707766b8e18fee ] - -The lt4112 is a HP branded Huawei me906e modem. Like other Huawei -modems, it does not have a fixed interface to function mapping. -Instead it uses a Huawei specific scheme: functions are mapped by -subclass and protocol. - -However, the HP vendor ID is used for modems from many different -manufacturers using different schemes, so we cannot apply a generic -vendor rule like we do for the Huawei vendor ID. - -Replace the previous lt4112 entry pointing to an arbitrary interface -number with a device specific subclass + protocol match. - -Reported-and-tested-by: Muri Nicanor <muri+libqmi@immerda.ch> -Tested-by: Martin Hauke <mardnh@gmx.de> -Fixes: bb2bdeb83fb1 ("qmi_wwan: Add support for HP lt4112 LTE/HSPA+ Gobi 4G Modem") -Signed-off-by: Bjørn Mork <bjorn@mork.no> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/usb/qmi_wwan.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 2a7c1be..1ba1fdc 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -539,6 +539,10 @@ static const struct usb_device_id products[] = { - USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&qmi_wwan_info, - }, -+ { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */ -+ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), -+ .driver_info = (unsigned long)&qmi_wwan_info, -+ }, - - /* 3. Combined interface devices matching on interface number */ - {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */ -@@ -791,7 +795,6 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ - {QMI_FIXED_INTF(0x413c, 0x81b1, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ - {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ -- {QMI_FIXED_INTF(0x03f0, 0x581d, 4)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */ - - /* 4. Gobi 1000 devices */ - {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ --- -2.4.1 - - -From 8d81dd753b8725645da63cf78c8d280c27e414a3 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Mon, 2 Nov 2015 17:08:19 -0800 -Subject: [PATCH 08/17] sit: fix sit0 percpu double allocations - -[ Upstream commit 4ece9009774596ee3df0acba65a324b7ea79387c ] - -sit0 device allocates its percpu storage twice : -- One time in ipip6_tunnel_init() -- One time in ipip6_fb_tunnel_init() - -Thus we leak 48 bytes per possible cpu per network namespace dismantle. - -ipip6_fb_tunnel_init() can be much simpler and does not -return an error, and should be called after register_netdev() - -Note that ipip6_tunnel_clone_6rd() also needs to be called -after register_netdev() (calling ipip6_tunnel_init()) - -Fixes: ebe084aafb7e ("sit: Use ipip6_tunnel_init as the ndo_init function.") -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reported-by: Dmitry Vyukov <dvyukov@google.com> -Cc: Steffen Klassert <steffen.klassert@secunet.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/ipv6/sit.c | 26 ++++---------------------- - 1 file changed, 4 insertions(+), 22 deletions(-) - -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 94428fd..dcccae8 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -1394,34 +1394,20 @@ static int ipip6_tunnel_init(struct net_device *dev) - return 0; - } - --static int __net_init ipip6_fb_tunnel_init(struct net_device *dev) -+static void __net_init ipip6_fb_tunnel_init(struct net_device *dev) - { - struct ip_tunnel *tunnel = netdev_priv(dev); - struct iphdr *iph = &tunnel->parms.iph; - struct net *net = dev_net(dev); - struct sit_net *sitn = net_generic(net, sit_net_id); - -- tunnel->dev = dev; -- tunnel->net = dev_net(dev); -- - iph->version = 4; - iph->protocol = IPPROTO_IPV6; - iph->ihl = 5; - iph->ttl = 64; - -- dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); -- if (!dev->tstats) -- return -ENOMEM; -- -- tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst); -- if (!tunnel->dst_cache) { -- free_percpu(dev->tstats); -- return -ENOMEM; -- } -- - dev_hold(dev); - rcu_assign_pointer(sitn->tunnels_wc[0], tunnel); -- return 0; - } - - static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[]) -@@ -1831,23 +1817,19 @@ static int __net_init sit_init_net(struct net *net) - */ - sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL; - -- err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev); -- if (err) -- goto err_dev_free; -- -- ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn); - err = register_netdev(sitn->fb_tunnel_dev); - if (err) - goto err_reg_dev; - -+ ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn); -+ ipip6_fb_tunnel_init(sitn->fb_tunnel_dev); -+ - t = netdev_priv(sitn->fb_tunnel_dev); - - strcpy(t->parms.name, sitn->fb_tunnel_dev->name); - return 0; - - err_reg_dev: -- dev_put(sitn->fb_tunnel_dev); --err_dev_free: - ipip6_dev_free(sitn->fb_tunnel_dev); - err_alloc_dev: - return err; --- -2.4.1 - - -From 03ebc93ed50c5d98c9f86b5831f537a408935d83 Mon Sep 17 00:00:00 2001 -From: Martin Habets <mhabets@solarflare.com> -Date: Mon, 2 Nov 2015 12:51:31 +0000 -Subject: [PATCH 09/17] sfc: push partner queue for skb->xmit_more - -[ Upstream commit b2663a4f30e85ec606b806f5135413e6d5c78d1e ] - -When the IP stack passes SKBs the sfc driver puts them in 2 different TX -queues (called partners), one for checksummed and one for not checksummed. -If the SKB has xmit_more set the driver will delay pushing the work to the -NIC. - -When later it does decide to push the buffers this patch ensures it also -pushes the partner queue, if that also has any delayed work. Before this -fix the work in the partner queue would be left for a long time and cause -a netdev watchdog. - -Fixes: 70b33fb ("sfc: add support for skb->xmit_more") -Reported-by: Jianlin Shi <jishi@redhat.com> -Signed-off-by: Martin Habets <mhabets@solarflare.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/ethernet/sfc/ef10.c | 4 +++- - drivers/net/ethernet/sfc/farch.c | 4 +++- - drivers/net/ethernet/sfc/net_driver.h | 2 ++ - drivers/net/ethernet/sfc/tx.c | 30 ++++++++++++++++++++++++++++-- - 4 files changed, 36 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c -index ff649eb..286cc6b 100644 ---- a/drivers/net/ethernet/sfc/ef10.c -+++ b/drivers/net/ethernet/sfc/ef10.c -@@ -1849,7 +1849,9 @@ static void efx_ef10_tx_write(struct efx_tx_queue *tx_queue) - unsigned int write_ptr; - efx_qword_t *txd; - -- BUG_ON(tx_queue->write_count == tx_queue->insert_count); -+ tx_queue->xmit_more_available = false; -+ if (unlikely(tx_queue->write_count == tx_queue->insert_count)) -+ return; - - do { - write_ptr = tx_queue->write_count & tx_queue->ptr_mask; -diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c -index f08266f..5a1c5a8 100644 ---- a/drivers/net/ethernet/sfc/farch.c -+++ b/drivers/net/ethernet/sfc/farch.c -@@ -321,7 +321,9 @@ void efx_farch_tx_write(struct efx_tx_queue *tx_queue) - unsigned write_ptr; - unsigned old_write_count = tx_queue->write_count; - -- BUG_ON(tx_queue->write_count == tx_queue->insert_count); -+ tx_queue->xmit_more_available = false; -+ if (unlikely(tx_queue->write_count == tx_queue->insert_count)) -+ return; - - do { - write_ptr = tx_queue->write_count & tx_queue->ptr_mask; -diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h -index c530e1c..24038ef 100644 ---- a/drivers/net/ethernet/sfc/net_driver.h -+++ b/drivers/net/ethernet/sfc/net_driver.h -@@ -219,6 +219,7 @@ struct efx_tx_buffer { - * @tso_packets: Number of packets via the TSO xmit path - * @pushes: Number of times the TX push feature has been used - * @pio_packets: Number of times the TX PIO feature has been used -+ * @xmit_more_available: Are any packets waiting to be pushed to the NIC - * @empty_read_count: If the completion path has seen the queue as empty - * and the transmission path has not yet checked this, the value of - * @read_count bitwise-added to %EFX_EMPTY_COUNT_VALID; otherwise 0. -@@ -253,6 +254,7 @@ struct efx_tx_queue { - unsigned int tso_packets; - unsigned int pushes; - unsigned int pio_packets; -+ bool xmit_more_available; - /* Statistics to supplement MAC stats */ - unsigned long tx_packets; - -diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c -index 1833a01..67f6afa 100644 ---- a/drivers/net/ethernet/sfc/tx.c -+++ b/drivers/net/ethernet/sfc/tx.c -@@ -431,8 +431,20 @@ finish_packet: - efx_tx_maybe_stop_queue(tx_queue); - - /* Pass off to hardware */ -- if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) -+ if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) { -+ struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue); -+ -+ /* There could be packets left on the partner queue if those -+ * SKBs had skb->xmit_more set. If we do not push those they -+ * could be left for a long time and cause a netdev watchdog. -+ */ -+ if (txq2->xmit_more_available) -+ efx_nic_push_buffers(txq2); -+ - efx_nic_push_buffers(tx_queue); -+ } else { -+ tx_queue->xmit_more_available = skb->xmit_more; -+ } - - tx_queue->tx_packets++; - -@@ -722,6 +734,7 @@ void efx_init_tx_queue(struct efx_tx_queue *tx_queue) - tx_queue->read_count = 0; - tx_queue->old_read_count = 0; - tx_queue->empty_read_count = 0 | EFX_EMPTY_COUNT_VALID; -+ tx_queue->xmit_more_available = false; - - /* Set up TX descriptor ring */ - efx_nic_init_tx(tx_queue); -@@ -747,6 +760,7 @@ void efx_fini_tx_queue(struct efx_tx_queue *tx_queue) - - ++tx_queue->read_count; - } -+ tx_queue->xmit_more_available = false; - netdev_tx_reset_queue(tx_queue->core_txq); - } - -@@ -1302,8 +1316,20 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue, - efx_tx_maybe_stop_queue(tx_queue); - - /* Pass off to hardware */ -- if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) -+ if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) { -+ struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue); -+ -+ /* There could be packets left on the partner queue if those -+ * SKBs had skb->xmit_more set. If we do not push those they -+ * could be left for a long time and cause a netdev watchdog. -+ */ -+ if (txq2->xmit_more_available) -+ efx_nic_push_buffers(txq2); -+ - efx_nic_push_buffers(tx_queue); -+ } else { -+ tx_queue->xmit_more_available = skb->xmit_more; -+ } - - tx_queue->tso_bursts++; - return NETDEV_TX_OK; --- -2.4.1 - - -From 80a7f5cf508c8054c3196e1110efecf5e842f698 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Mon, 2 Nov 2015 07:50:07 -0800 -Subject: [PATCH 10/17] net: avoid NULL deref in inet_ctl_sock_destroy() - -[ Upstream commit 8fa677d2706d325d71dab91bf6e6512c05214e37 ] - -Under low memory conditions, tcp_sk_init() and icmp_sk_init() -can both iterate on all possible cpus and call inet_ctl_sock_destroy(), -with eventual NULL pointer. - -Signed-off-by: Eric Dumazet <edumazet@google.com> -Reported-by: Dmitry Vyukov <dvyukov@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - include/net/inet_common.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/include/net/inet_common.h b/include/net/inet_common.h -index 279f835..109e3ee 100644 ---- a/include/net/inet_common.h -+++ b/include/net/inet_common.h -@@ -41,7 +41,8 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, - - static inline void inet_ctl_sock_destroy(struct sock *sk) - { -- sock_release(sk->sk_socket); -+ if (sk) -+ sock_release(sk->sk_socket); - } - - #endif --- -2.4.1 - - -From 4cc1b5dbe087a8b3ab518164fa90c9ab4d63e923 Mon Sep 17 00:00:00 2001 -From: Sabrina Dubroca <sd@queasysnail.net> -Date: Wed, 4 Nov 2015 14:47:53 +0100 -Subject: [PATCH 11/17] ipv6: clean up dev_snmp6 proc entry when we fail to - initialize inet6_dev - -[ Upstream commit 2a189f9e57650e9f310ddf4aad75d66c1233a064 ] - -In ipv6_add_dev, when addrconf_sysctl_register fails, we do not clean up -the dev_snmp6 entry that we have already registered for this device. -Call snmp6_unregister_dev in this case. - -Fixes: a317a2f19da7d ("ipv6: fail early when creating netdev named all or default") -Reported-by: Dmitry Vyukov <dvyukov@google.com> -Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/ipv6/addrconf.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 36b85bd..dd00828 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -417,6 +417,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev) - if (err) { - ipv6_mc_destroy_dev(ndev); - del_timer(&ndev->regen_timer); -+ snmp6_unregister_dev(ndev); - goto err_release; - } - /* protected by rtnl_lock */ --- -2.4.1 - - -From 31aa0cfdfddba6e487aec78ff1f8fffb8bc3015d Mon Sep 17 00:00:00 2001 -From: WANG Cong <xiyou.wangcong@gmail.com> -Date: Tue, 3 Nov 2015 14:32:57 -0800 -Subject: [PATCH 12/17] ipv4: disable BH when changing ip local port range - -[ Upstream commit 4ee3bd4a8c7463cdef0b82ebc33fc94a9170a7e0 ] - -This fixes the following lockdep warning: - - [ INFO: inconsistent lock state ] - 4.3.0-rc7+ #1197 Not tainted - --------------------------------- - inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage. - sysctl/1019 [HC0[0]:SC0[0]:HE1:SE1] takes: - (&(&net->ipv4.ip_local_ports.lock)->seqcount){+.+-..}, at: [<ffffffff81921de7>] ipv4_local_port_range+0xb4/0x12a - {IN-SOFTIRQ-R} state was registered at: - [<ffffffff810bd682>] __lock_acquire+0x2f6/0xdf0 - [<ffffffff810be6d5>] lock_acquire+0x11c/0x1a4 - [<ffffffff818e599c>] inet_get_local_port_range+0x4e/0xae - [<ffffffff8166e8e3>] udp_flow_src_port.constprop.40+0x23/0x116 - [<ffffffff81671cb9>] vxlan_xmit_one+0x219/0xa6a - [<ffffffff81672f75>] vxlan_xmit+0xa6b/0xaa5 - [<ffffffff817f2deb>] dev_hard_start_xmit+0x2ae/0x465 - [<ffffffff817f35ed>] __dev_queue_xmit+0x531/0x633 - [<ffffffff817f3702>] dev_queue_xmit_sk+0x13/0x15 - [<ffffffff818004a5>] neigh_resolve_output+0x12f/0x14d - [<ffffffff81959cfa>] ip6_finish_output2+0x344/0x39f - [<ffffffff8195bf58>] ip6_finish_output+0x88/0x8e - [<ffffffff8195bfef>] ip6_output+0x91/0xe5 - [<ffffffff819792ae>] dst_output_sk+0x47/0x4c - [<ffffffff81979392>] NF_HOOK_THRESH.constprop.30+0x38/0x82 - [<ffffffff8197981e>] mld_sendpack+0x189/0x266 - [<ffffffff8197b28b>] mld_ifc_timer_expire+0x1ef/0x223 - [<ffffffff810de581>] call_timer_fn+0xfb/0x28c - [<ffffffff810ded1e>] run_timer_softirq+0x1c7/0x1f1 - -Fixes: b8f1a55639e6 ("udp: Add function to make source port for UDP tunnels") -Cc: Tom Herbert <tom@herbertland.com> -Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/ipv4/sysctl_net_ipv4.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c -index 894da3a..ade7737 100644 ---- a/net/ipv4/sysctl_net_ipv4.c -+++ b/net/ipv4/sysctl_net_ipv4.c -@@ -48,14 +48,14 @@ static void set_local_port_range(struct net *net, int range[2]) - { - bool same_parity = !((range[0] ^ range[1]) & 1); - -- write_seqlock(&net->ipv4.ip_local_ports.lock); -+ write_seqlock_bh(&net->ipv4.ip_local_ports.lock); - if (same_parity && !net->ipv4.ip_local_ports.warned) { - net->ipv4.ip_local_ports.warned = true; - pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); - } - net->ipv4.ip_local_ports.range[0] = range[0]; - net->ipv4.ip_local_ports.range[1] = range[1]; -- write_sequnlock(&net->ipv4.ip_local_ports.lock); -+ write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); - } - - /* Validate changes from /proc interface. */ --- -2.4.1 - - -From d04ea27f9dfc17ef6f031fd001b818b1ac70141d Mon Sep 17 00:00:00 2001 -From: David Ahern <dsa@cumulusnetworks.com> -Date: Tue, 3 Nov 2015 15:59:28 -0800 -Subject: [PATCH 13/17] net: Fix prefsrc lookups - -[ Upstream commit e1b8d903c6c3862160d2d5036806a94786c8fc4e ] - -A bug report (https://bugzilla.kernel.org/show_bug.cgi?id=107071) noted -that the follwoing ip command is failing with v4.3: - - $ ip route add 10.248.5.0/24 dev bond0.250 table vlan_250 src 10.248.5.154 - RTNETLINK answers: Invalid argument - -021dd3b8a142d changed the lookup of the given preferred source address to -use the table id passed in, but this assumes the local entries are in the -given table which is not necessarily true for non-VRF use cases. When -validating the preferred source fallback to the local table on failure. - -Fixes: 021dd3b8a142d ("net: Add routes to the table associated with the device") -Signed-off-by: David Ahern <dsa@cumulusnetworks.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/ipv4/fib_semantics.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index e966f85..ef5892f 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -864,14 +864,21 @@ static bool fib_valid_prefsrc(struct fib_config *cfg, __be32 fib_prefsrc) - if (cfg->fc_type != RTN_LOCAL || !cfg->fc_dst || - fib_prefsrc != cfg->fc_dst) { - u32 tb_id = cfg->fc_table; -+ int rc; - - if (tb_id == RT_TABLE_MAIN) - tb_id = RT_TABLE_LOCAL; - -- if (inet_addr_type_table(cfg->fc_nlinfo.nl_net, -- fib_prefsrc, tb_id) != RTN_LOCAL) { -- return false; -+ rc = inet_addr_type_table(cfg->fc_nlinfo.nl_net, -+ fib_prefsrc, tb_id); -+ -+ if (rc != RTN_LOCAL && tb_id != RT_TABLE_LOCAL) { -+ rc = inet_addr_type_table(cfg->fc_nlinfo.nl_net, -+ fib_prefsrc, RT_TABLE_LOCAL); - } -+ -+ if (rc != RTN_LOCAL) -+ return false; - } - return true; - } --- -2.4.1 - - -From 79f11d5fe0fd0547c8b1d03166e70f2f6ffae8a8 Mon Sep 17 00:00:00 2001 -From: Tobias Klauser <tklauser@distanz.ch> -Date: Wed, 4 Nov 2015 13:49:49 +0100 -Subject: [PATCH 14/17] tun_dst: Fix potential NULL dereference - -[ Upstream commit f63ce5b6fa5e9a0faf7a0e1ef2993a502878c78a ] - -In tun_dst_unclone() the return value of skb_metadata_dst() is checked -for being NULL after it is dereferenced. Fix this by moving the -dereference after the NULL check. - -Found by the Coverity scanner (CID 1338068). - -Fixes: fc4099f17240 ("openvswitch: Fix egress tunnel info.") -Cc: Pravin B Shelar <pshelar@nicira.com> -Signed-off-by: Tobias Klauser <tklauser@distanz.ch> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - include/net/dst_metadata.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h -index ce00971..6816f0f 100644 ---- a/include/net/dst_metadata.h -+++ b/include/net/dst_metadata.h -@@ -63,12 +63,13 @@ static inline struct metadata_dst *tun_rx_dst(int md_size) - static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) - { - struct metadata_dst *md_dst = skb_metadata_dst(skb); -- int md_size = md_dst->u.tun_info.options_len; -+ int md_size; - struct metadata_dst *new_md; - - if (!md_dst) - return ERR_PTR(-EINVAL); - -+ md_size = md_dst->u.tun_info.options_len; - new_md = metadata_dst_alloc(md_size, GFP_ATOMIC); - if (!new_md) - return ERR_PTR(-ENOMEM); --- -2.4.1 - - -From 4a75ef6f762c85d73a76a9466672cf66965d82e2 Mon Sep 17 00:00:00 2001 -From: Francesco Ruggeri <fruggeri@aristanetworks.com> -Date: Thu, 5 Nov 2015 08:16:14 -0800 -Subject: [PATCH 15/17] packet: race condition in packet_bind - -[ Upstream commit 30f7ea1c2b5f5fb7462c5ae44fe2e40cb2d6a474 ] - -There is a race conditions between packet_notifier and packet_bind{_spkt}. - -It happens if packet_notifier(NETDEV_UNREGISTER) executes between the -time packet_bind{_spkt} takes a reference on the new netdevice and the -time packet_do_bind sets po->ifindex. -In this case the notification can be missed. -If this happens during a dev_change_net_namespace this can result in the -netdevice to be moved to the new namespace while the packet_sock in the -old namespace still holds a reference on it. When the netdevice is later -deleted in the new namespace the deletion hangs since the packet_sock -is not found in the new namespace' &net->packet.sklist. -It can be reproduced with the script below. - -This patch makes packet_do_bind check again for the presence of the -netdevice in the packet_sock's namespace after the synchronize_net -in unregister_prot_hook. -More in general it also uses the rcu lock for the duration of the bind -to stop dev_change_net_namespace/rollback_registered_many from -going past the synchronize_net following unlist_netdevice, so that -no NETDEV_UNREGISTER notifications can happen on the new netdevice -while the bind is executing. In order to do this some code from -packet_bind{_spkt} is consolidated into packet_do_dev. - -import socket, os, time, sys -proto=7 -realDev='em1' -vlanId=400 -if len(sys.argv) > 1: - vlanId=int(sys.argv[1]) -dev='vlan%d' % vlanId - -os.system('taskset -p 0x10 %d' % os.getpid()) - -s = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, proto) -os.system('ip link add link %s name %s type vlan id %d' % - (realDev, dev, vlanId)) -os.system('ip netns add dummy') - -pid=os.fork() - -if pid == 0: - # dev should be moved while packet_do_bind is in synchronize net - os.system('taskset -p 0x20000 %d' % os.getpid()) - os.system('ip link set %s netns dummy' % dev) - os.system('ip netns exec dummy ip link del %s' % dev) - s.close() - sys.exit(0) - -time.sleep(.004) -try: - s.bind(('%s' % dev, proto+1)) -except: - print 'Could not bind socket' - s.close() - os.system('ip netns del dummy') - sys.exit(0) - -os.waitpid(pid, 0) -s.close() -os.system('ip netns del dummy') -sys.exit(0) - -Signed-off-by: Francesco Ruggeri <fruggeri@arista.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/packet/af_packet.c | 80 +++++++++++++++++++++++++++++++------------------- - 1 file changed, 49 insertions(+), 31 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index aa4b15c..27b2898 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2903,22 +2903,40 @@ static int packet_release(struct socket *sock) - * Attach a packet hook. - */ - --static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) -+static int packet_do_bind(struct sock *sk, const char *name, int ifindex, -+ __be16 proto) - { - struct packet_sock *po = pkt_sk(sk); - struct net_device *dev_curr; - __be16 proto_curr; - bool need_rehook; -+ struct net_device *dev = NULL; -+ int ret = 0; -+ bool unlisted = false; - -- if (po->fanout) { -- if (dev) -- dev_put(dev); -- -+ if (po->fanout) - return -EINVAL; -- } - - lock_sock(sk); - spin_lock(&po->bind_lock); -+ rcu_read_lock(); -+ -+ if (name) { -+ dev = dev_get_by_name_rcu(sock_net(sk), name); -+ if (!dev) { -+ ret = -ENODEV; -+ goto out_unlock; -+ } -+ } else if (ifindex) { -+ dev = dev_get_by_index_rcu(sock_net(sk), ifindex); -+ if (!dev) { -+ ret = -ENODEV; -+ goto out_unlock; -+ } -+ } -+ -+ if (dev) -+ dev_hold(dev); - - proto_curr = po->prot_hook.type; - dev_curr = po->prot_hook.dev; -@@ -2926,14 +2944,29 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - need_rehook = proto_curr != proto || dev_curr != dev; - - if (need_rehook) { -- unregister_prot_hook(sk, true); -+ if (po->running) { -+ rcu_read_unlock(); -+ __unregister_prot_hook(sk, true); -+ rcu_read_lock(); -+ dev_curr = po->prot_hook.dev; -+ if (dev) -+ unlisted = !dev_get_by_index_rcu(sock_net(sk), -+ dev->ifindex); -+ } - - po->num = proto; - po->prot_hook.type = proto; -- po->prot_hook.dev = dev; - -- po->ifindex = dev ? dev->ifindex : 0; -- packet_cached_dev_assign(po, dev); -+ if (unlikely(unlisted)) { -+ dev_put(dev); -+ po->prot_hook.dev = NULL; -+ po->ifindex = -1; -+ packet_cached_dev_reset(po); -+ } else { -+ po->prot_hook.dev = dev; -+ po->ifindex = dev ? dev->ifindex : 0; -+ packet_cached_dev_assign(po, dev); -+ } - } - if (dev_curr) - dev_put(dev_curr); -@@ -2941,7 +2974,7 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - if (proto == 0 || !need_rehook) - goto out_unlock; - -- if (!dev || (dev->flags & IFF_UP)) { -+ if (!unlisted && (!dev || (dev->flags & IFF_UP))) { - register_prot_hook(sk); - } else { - sk->sk_err = ENETDOWN; -@@ -2950,9 +2983,10 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - } - - out_unlock: -+ rcu_read_unlock(); - spin_unlock(&po->bind_lock); - release_sock(sk); -- return 0; -+ return ret; - } - - /* -@@ -2964,8 +2998,6 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, - { - struct sock *sk = sock->sk; - char name[15]; -- struct net_device *dev; -- int err = -ENODEV; - - /* - * Check legality -@@ -2975,19 +3007,13 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, - return -EINVAL; - strlcpy(name, uaddr->sa_data, sizeof(name)); - -- dev = dev_get_by_name(sock_net(sk), name); -- if (dev) -- err = packet_do_bind(sk, dev, pkt_sk(sk)->num); -- return err; -+ return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); - } - - static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - { - struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr; - struct sock *sk = sock->sk; -- struct net_device *dev = NULL; -- int err; -- - - /* - * Check legality -@@ -2998,16 +3024,8 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len - if (sll->sll_family != AF_PACKET) - return -EINVAL; - -- if (sll->sll_ifindex) { -- err = -ENODEV; -- dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex); -- if (dev == NULL) -- goto out; -- } -- err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); -- --out: -- return err; -+ return packet_do_bind(sk, NULL, sll->sll_ifindex, -+ sll->sll_protocol ? : pkt_sk(sk)->num); - } - - static struct proto packet_proto = { --- -2.4.1 - - -From b84e1a71f9b380b8fe8843e5af4c72cad640a1dc Mon Sep 17 00:00:00 2001 -From: Jay Vosburgh <jay.vosburgh@canonical.com> -Date: Fri, 6 Nov 2015 17:23:23 -0800 -Subject: [PATCH 16/17] bonding: fix panic on non-ARPHRD_ETHER enslave failure - -[ Upstream commit 40baec225765c54eefa870530dd613bad9829bb7 ] - -Since commit 7d5cd2ce529b, when bond_enslave fails on devices that -are not ARPHRD_ETHER, if needed, it resets the bonding device back to -ARPHRD_ETHER by calling ether_setup. - - Unfortunately, ether_setup clobbers dev->flags, clearing IFF_UP -if the bond device is up, leaving it in a quasi-down state without -having actually gone through dev_close. For bonding, if any periodic -work queue items are active (miimon, arp_interval, etc), those will -remain running, as they are stopped by bond_close. At this point, if -the bonding module is unloaded or the bond is deleted, the system will -panic when the work function is called. - - This panic is resolved by calling dev_close on the bond itself -prior to calling ether_setup. - -Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> -Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com> -Fixes: 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure") -Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - drivers/net/bonding/bond_main.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 771a449..bcd7bdd 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1749,6 +1749,7 @@ err_undo_flags: - slave_dev->dev_addr)) - eth_hw_addr_random(bond_dev); - if (bond_dev->type != ARPHRD_ETHER) { -+ dev_close(bond_dev); - ether_setup(bond_dev); - bond_dev->flags |= IFF_MASTER; - bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING; --- -2.4.1 - - -From b019533c6926b5dd5a7b1d6f8cb8616b51e39297 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Mon, 9 Nov 2015 17:51:23 -0800 -Subject: [PATCH 17/17] net: fix a race in dst_release() - -[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ] - -Only cpu seeing dst refcount going to 0 can safely -dereference dst->flags. - -Otherwise an other cpu might already have freed the dst. - -Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst") -Reported-by: Greg Thelen <gthelen@google.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/core/dst.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/core/dst.c b/net/core/dst.c -index 0771c8c..d6a5a0b 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -306,7 +306,7 @@ void dst_release(struct dst_entry *dst) - if (unlikely(newrefcnt < 0)) - net_warn_ratelimited("%s: dst:%p refcnt:%d\n", - __func__, dst, newrefcnt); -- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) -+ if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) - call_rcu(&dst->rcu_head, dst_destroy_rcu); - } - } --- -2.4.1 - @@ -1,2 +1,3 @@ 58b35794eee3b6d52ce7be39357801e7 linux-4.3.tar.xz 7c516c9528b9f9aac0136944b0200b7e perf-man-4.3.tar.gz +6c2dcd8d314f687f317b44820151dd92 patch-4.3.1.xz |