On Sat, Nov 10, 2018 at 11:16:15AM -0800, gregkh(a)linuxfoundation.org wrote:
It shouldn't be added to 4.19
>
>This is a note to let you know that I've just added the patch titled
>
> net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode
>
>to the 4.19-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
>The filename of the patch is:
> net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch
>and it can be found in the queue-4.19 subdirectory.
>
>If you, or anyone else, feels it should not be added to the stable tree,
>please let <stable(a)vger.kernel.org> know about it.
>
>
>From foo@baz Sat Nov 10 10:51:03 PST 2018
>From: Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
>Date: Mon, 22 Oct 2018 21:51:36 +0300
>Subject: net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode
>
>From: Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
>
>[ Upstream commit 9737cc99dd14b5b8b9d267618a6061feade8ea68 ]
>
>After flushing all mcast entries from the table, the ones contained in
>mc list of ndev are not restored when promisc mode is toggled off,
>because they are considered as synched with ALE, thus, in order to
>restore them after promisc mode - reset syncing info. This fix
>touches only switch mode devices, including single port boards
>like Beagle Bone.
>
>Fixes: commit 5da1948969bc
>("net: ethernet: ti: cpsw: fix lost of mcast packets while rx_mode update")
>
>Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk(a)linaro.org>
>Reviewed-by: Grygorii Strashko <grygorii.strashko(a)ti.com>
>Signed-off-by: David S. Miller <davem(a)davemloft.net>
>Signed-off-by: Sasha Levin <sashal(a)kernel.org>
>Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
>---
> drivers/net/ethernet/ti/cpsw.c | 1 +
> 1 file changed, 1 insertion(+)
>
>--- a/drivers/net/ethernet/ti/cpsw.c
>+++ b/drivers/net/ethernet/ti/cpsw.c
>@@ -642,6 +642,7 @@ static void cpsw_set_promiscious(struct
>
> /* Clear all mcast from ALE */
> cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS, -1);
>+ __dev_mc_unsync(ndev, NULL);
>
> /* Flood All Unicast Packets to Host port */
> cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
>
>
>Patches currently in stable-queue which might be from ivan.khoronzhuk(a)linaro.org are
>
>queue-4.19/net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch
--
Regards,
Ivan Khoronzhuk
Hi,
all stable kernels carrying
> From 8b4c3cdd9dd8290343ce959a132d3b334062c5b9 Mon Sep 17 00:00:00 2001
> From: David Ahern <dsahern(a)gmail.com>
> Date: Wed, 3 Oct 2018 15:05:36 -0700
> Subject: [PATCH] net: sched: Add policy validation for tc attributes
>
> A number of TC attributes are processed without proper validation
> (e.g., length checks). Add a tca policy for all input attributes and use
> when invoking nlmsg_parse.
>
> The 2 Fixes tags below cover the latest additions. The other attributes
> are a string (KIND), nested attribute (OPTIONS which does seem to have
> validation in most cases), for dumps only or a flag.
>
> Fixes: 5bc1701881e39 ("net: sched: introduce multichain support for filters")
> Fixes: d47a6b0e7c492 ("net: sched: introduce ingress/egress block index attributes for qdisc")
> Signed-off-by: David Ahern <dsahern(a)gmail.com>
> Signed-off-by: David S. Miller <davem(a)davemloft.net>
should backport
> From e72bde6b66299602087c8c2350d36a525e75d06e Mon Sep 17 00:00:00 2001
> From: David Ahern <dsahern(a)gmail.com>
> Date: Wed, 24 Oct 2018 08:32:49 -0700
> Subject: [PATCH] net: sched: Remove TCA_OPTIONS from policy
>
> Marco reported an error with hfsc:
> root@Calimero:~# tc qdisc add dev eth0 root handle 1:0 hfsc default 1
> Error: Attribute failed policy validation.
>
> Apparently a few implementations pass TCA_OPTIONS as a binary instead
> of nested attribute, so drop TCA_OPTIONS from the policy.
>
> Fixes: 8b4c3cdd9dd8 ("net: sched: Add policy validation for tc attributes")
> Reported-by: Marco Berizzi <pupilla(a)libero.it>
> Signed-off-by: David Ahern <dsahern(a)gmail.com>
> Signed-off-by: David S. Miller <davem(a)davemloft.net>
See https://lkml.org/lkml/2018/10/26/80.
--
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 421f0922a2cfb0c75acd9746454aaa576c711a65 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Fri, 12 Oct 2018 13:02:48 +0100
Subject: [PATCH] Btrfs: fix use-after-free during inode eviction
At inode.c:evict_inode_truncate_pages(), when we iterate over the
inode's extent states, we access an extent state record's "state" field
after we unlocked the inode's io tree lock. This can lead to a
use-after-free issue because after we unlock the io tree that extent
state record might have been freed due to being merged into another
adjacent extent state record (a previous inflight bio for a read
operation finished in the meanwhile which unlocked a range in the io
tree and cause a merge of extent state records, as explained in the
comment before the while loop added in commit 6ca0709756710 ("Btrfs: fix
hang during inode eviction due to concurrent readahead")).
Fix this by keeping a copy of the extent state's flags in a local
variable and using it after unlocking the io tree.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201189
Fixes: b9d0b38928e2 ("btrfs: Add handler for invalidate page")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 28625f344952..f4d31fd62eed 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5268,11 +5268,13 @@ static void evict_inode_truncate_pages(struct inode *inode)
struct extent_state *cached_state = NULL;
u64 start;
u64 end;
+ unsigned state_flags;
node = rb_first(&io_tree->state);
state = rb_entry(node, struct extent_state, rb_node);
start = state->start;
end = state->end;
+ state_flags = state->state;
spin_unlock(&io_tree->lock);
lock_extent_bits(io_tree, start, end, &cached_state);
@@ -5285,7 +5287,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
*
* Note, end is the bytenr of last byte, so we need + 1 here.
*/
- if (state->state & EXTENT_DELALLOC)
+ if (state_flags & EXTENT_DELALLOC)
btrfs_qgroup_free_data(inode, NULL, start, end - start + 1);
clear_extent_bit(io_tree, start, end,
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 421f0922a2cfb0c75acd9746454aaa576c711a65 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Fri, 12 Oct 2018 13:02:48 +0100
Subject: [PATCH] Btrfs: fix use-after-free during inode eviction
At inode.c:evict_inode_truncate_pages(), when we iterate over the
inode's extent states, we access an extent state record's "state" field
after we unlocked the inode's io tree lock. This can lead to a
use-after-free issue because after we unlock the io tree that extent
state record might have been freed due to being merged into another
adjacent extent state record (a previous inflight bio for a read
operation finished in the meanwhile which unlocked a range in the io
tree and cause a merge of extent state records, as explained in the
comment before the while loop added in commit 6ca0709756710 ("Btrfs: fix
hang during inode eviction due to concurrent readahead")).
Fix this by keeping a copy of the extent state's flags in a local
variable and using it after unlocking the io tree.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201189
Fixes: b9d0b38928e2 ("btrfs: Add handler for invalidate page")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 28625f344952..f4d31fd62eed 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5268,11 +5268,13 @@ static void evict_inode_truncate_pages(struct inode *inode)
struct extent_state *cached_state = NULL;
u64 start;
u64 end;
+ unsigned state_flags;
node = rb_first(&io_tree->state);
state = rb_entry(node, struct extent_state, rb_node);
start = state->start;
end = state->end;
+ state_flags = state->state;
spin_unlock(&io_tree->lock);
lock_extent_bits(io_tree, start, end, &cached_state);
@@ -5285,7 +5287,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
*
* Note, end is the bytenr of last byte, so we need + 1 here.
*/
- if (state->state & EXTENT_DELALLOC)
+ if (state_flags & EXTENT_DELALLOC)
btrfs_qgroup_free_data(inode, NULL, start, end - start + 1);
clear_extent_bit(io_tree, start, end,
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 421f0922a2cfb0c75acd9746454aaa576c711a65 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana(a)suse.com>
Date: Fri, 12 Oct 2018 13:02:48 +0100
Subject: [PATCH] Btrfs: fix use-after-free during inode eviction
At inode.c:evict_inode_truncate_pages(), when we iterate over the
inode's extent states, we access an extent state record's "state" field
after we unlocked the inode's io tree lock. This can lead to a
use-after-free issue because after we unlock the io tree that extent
state record might have been freed due to being merged into another
adjacent extent state record (a previous inflight bio for a read
operation finished in the meanwhile which unlocked a range in the io
tree and cause a merge of extent state records, as explained in the
comment before the while loop added in commit 6ca0709756710 ("Btrfs: fix
hang during inode eviction due to concurrent readahead")).
Fix this by keeping a copy of the extent state's flags in a local
variable and using it after unlocking the io tree.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201189
Fixes: b9d0b38928e2 ("btrfs: Add handler for invalidate page")
CC: stable(a)vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu(a)suse.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 28625f344952..f4d31fd62eed 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5268,11 +5268,13 @@ static void evict_inode_truncate_pages(struct inode *inode)
struct extent_state *cached_state = NULL;
u64 start;
u64 end;
+ unsigned state_flags;
node = rb_first(&io_tree->state);
state = rb_entry(node, struct extent_state, rb_node);
start = state->start;
end = state->end;
+ state_flags = state->state;
spin_unlock(&io_tree->lock);
lock_extent_bits(io_tree, start, end, &cached_state);
@@ -5285,7 +5287,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
*
* Note, end is the bytenr of last byte, so we need + 1 here.
*/
- if (state->state & EXTENT_DELALLOC)
+ if (state_flags & EXTENT_DELALLOC)
btrfs_qgroup_free_data(inode, NULL, start, end - start + 1);
clear_extent_bit(io_tree, start, end,