This is the start of the stable review cycle for the 4.9.91 release.
There are 67 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Mar 29 16:27:08 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.91-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.91-rc1
Daniel Borkmann <daniel(a)iogearbox.net>
bpf, x64: increase number of passes
Chenbo Feng <fengc(a)google.com>
bpf: skip unnecessary capability check
Daniel Borkmann <daniel(a)iogearbox.net>
kbuild: disable clang's default use of -fmerge-all-constants
Shuah Khan <shuah(a)kernel.org>
selftests: x86: sysret_ss_attrs doesn't build on a PIE build
Dave Hansen <dave.hansen(a)linux.intel.com>
x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
Eric W. Biederman <ebiederm(a)xmission.com>
signal/testing: Don't look for __SI_FAULT in userspace
Andy Lutomirski <luto(a)kernel.org>
selftests/x86/protection_keys: Fix syscall NR redefinition warnings
Dave Hansen <dave.hansen(a)linux.intel.com>
selftests, x86, protection_keys: fix wrong offset in siginfo
Nadav Amit <namit(a)vmware.com>
staging: lustre: ptlrpc: kfree used instead of kvfree
Linus Walleij <linus.walleij(a)linaro.org>
iio: ABI: Fix name of timestamp sysfs file
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
Dan Carpenter <dan.carpenter(a)oracle.com>
perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
Ilya Pronin <ipronin(a)twitter.com>
perf stat: Fix CVS output format for non-supported counters
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel/uncore: Fix Skylake UPI event format
Andy Lutomirski <luto(a)kernel.org>
x86/entry/64: Don't use IST entry for #BP stack
H.J. Lu <hjl.tools(a)gmail.com>
x86/boot/64: Verify alignment of the LOAD segment
H.J. Lu <hjl.tools(a)gmail.com>
x86/build/64: Force the linker to use 2MB page size
Linus Torvalds <torvalds(a)linux-foundation.org>
kvm/x86: fix icebp instruction handling
Andy Lutomirski <luto(a)kernel.org>
selftests/x86/ptrace_syscall: Fix for yet more glibc interference
Linus Torvalds <torvalds(a)linux-foundation.org>
tty: vt: fix up tabstops properly
Andri Yngvason <andri.yngvason(a)marel.com>
can: cc770: Fix use after free in cc770_tx_interrupt()
Andri Yngvason <andri.yngvason(a)marel.com>
can: cc770: Fix queue stall & dropped RTR reply
Andri Yngvason <andri.yngvason(a)marel.com>
can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
Marek Vasut <marex(a)denx.de>
can: ifi: Check core revision upon probe
Marek Vasut <marex(a)denx.de>
can: ifi: Repair the error handling
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: ncpfs: memory corruption in ncp_read_kernel()
Jagdish Gediya <jagdish.gediya(a)nxp.com>
mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
Jagdish Gediya <jagdish.gediya(a)nxp.com>
mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
Jagdish Gediya <jagdish.gediya(a)nxp.com>
mtd: nand: fsl_ifc: Fix nand waitfunc return value
OuYang ZhiZhong <ouyzz(a)yealink.com>
mtdchar: fix usage of mtd_ooblayout_ecc()
Masami Hiramatsu <mhiramat(a)kernel.org>
tracing: probeevent: Fix to support minus offset from symbol
Larry Finger <Larry.Finger(a)lwfinger.net>
rtlwifi: rtl8723be: Fix loss of signal
Arend Van Spriel <arend.vanspriel(a)broadcom.com>
brcmfmac: fix P2P_DEVICE ethernet address generation
Vishal Verma <vishal.l.verma(a)intel.com>
libnvdimm, {btt, blk}: do integrity setup before add_disk()
Takashi Iwai <tiwai(a)suse.de>
ACPI / watchdog: Fix off-by-one error at resource assignment
Dan Williams <dan.j.williams(a)intel.com>
acpi, numa: fix pxm to online numa node associations
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
drm: udl: Properly check framebuffer mmap offsets
Michel Dänzer <michel.daenzer(a)amd.com>
drm/radeon: Don't turn off DP sink when disconnected
Thomas Hellstrom <thellstrom(a)vmware.com>
drm/vmwgfx: Fix a destoy-while-held mutex problem.
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/thp: do not wait for lock_page() in deferred_split_scan()
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
Toshi Kani <toshi.kani(a)hpe.com>
x86/mm: implement free pmd/pte page interfaces
Toshi Kani <toshi.kani(a)hpe.com>
mm/vmalloc: add interfaces to free unmapped page table
Jeff Layton <jlayton(a)redhat.com>
nfsd: remove blocked locks on client teardown
Hans de Goede <hdegoede(a)redhat.com>
libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
Hans de Goede <hdegoede(a)redhat.com>
libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
Hans de Goede <hdegoede(a)redhat.com>
libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
Ju Hyung Park <qkrwngud825(a)gmail.com>
libata: Enable queued TRIM for Samsung SSD 860
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
libata: disable LPM for Crucial BX100 SSD 500GB drive
Hans de Goede <hdegoede(a)redhat.com>
libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
Eric Biggers <ebiggers(a)google.com>
libata: don't try to pass through NCQ commands to non-NCQ devices
Eric Biggers <ebiggers(a)google.com>
libata: remove WARN() for DMA or PIO command without data
Eric Biggers <ebiggers(a)google.com>
libata: fix length validation of ATAPI-relayed SCSI commands
Takashi Iwai <tiwai(a)suse.de>
Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
Chen-Yu Tsai <wens(a)csie.org>
clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
Boris Brezillon <boris.brezillon(a)bootlin.com>
clk: bcm2835: Protect sections updating shared registers
Boris Brezillon <boris.brezillon(a)bootlin.com>
clk: bcm2835: Fix ana->maskX definitions
Hans de Goede <hdegoede(a)redhat.com>
ahci: Add PCI-id for the Highpoint Rocketraid 644L card
Hans de Goede <hdegoede(a)redhat.com>
PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
Evgeniy Didin <Evgeniy.Didin(a)synopsys.com>
mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/realtek - Always immediately update mute LED with pin VREF
Takashi Iwai <tiwai(a)suse.de>
ALSA: aloop: Fix access to not-yet-ready substream via cable
Takashi Iwai <tiwai(a)suse.de>
ALSA: aloop: Sync stale timer before release
Kirill Marinushkin <k.marinushkin(a)gmail.com>
ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
Michael Nosthoff <committed(a)heine.so>
iio: st_pressure: st_accel: pass correct platform data to init
NeilBrown <neil(a)brown.name>
MIPS: ralink: Remove ralink_halt()
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-iio | 2 +-
Makefile | 13 ++-
arch/arm64/mm/mmu.c | 10 +++
arch/mips/ralink/reset.c | 7 --
arch/x86/Makefile | 9 ++
arch/x86/boot/compressed/misc.c | 4 +
arch/x86/entry/entry_64.S | 2 +-
arch/x86/events/intel/core.c | 2 +-
arch/x86/events/intel/uncore_snbep.c | 33 +++----
arch/x86/include/asm/vmx.h | 1 +
arch/x86/kernel/traps.c | 24 +++--
arch/x86/kvm/vmx.c | 9 +-
arch/x86/mm/pgtable.c | 48 ++++++++++
arch/x86/net/bpf_jit_comp.c | 3 +-
drivers/acpi/acpi_watchdog.c | 4 +-
drivers/acpi/numa.c | 10 ++-
drivers/ata/ahci.c | 4 +-
drivers/ata/libata-core.c | 26 +++++-
drivers/ata/libata-scsi.c | 10 ++-
drivers/bluetooth/btusb.c | 2 +-
drivers/clk/bcm/clk-bcm2835.c | 12 ++-
drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 6 +-
drivers/gpu/drm/radeon/radeon_connectors.c | 31 +++----
drivers/gpu/drm/udl/udl_fb.c | 9 +-
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 28 ++++--
drivers/gpu/drm/vmwgfx/vmwgfx_kms.h | 12 ++-
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 5 +-
drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 5 +-
drivers/iio/accel/st_accel_core.c | 2 +-
drivers/iio/pressure/st_pressure_core.c | 2 +-
drivers/mmc/host/dw_mmc.c | 6 +-
drivers/mtd/mtdchar.c | 4 +-
drivers/mtd/nand/fsl_ifc_nand.c | 32 +++----
drivers/net/can/cc770/cc770.c | 100 +++++++++++++--------
drivers/net/can/cc770/cc770.h | 2 +
drivers/net/can/ifi_canfd/ifi_canfd.c | 75 ++++++++++------
.../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 24 +++--
.../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 3 +-
drivers/nvdimm/blk.c | 3 +-
drivers/nvdimm/btt.c | 3 +-
drivers/pci/quirks.c | 2 +
drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +-
drivers/tty/vt/vt.c | 8 +-
drivers/watchdog/wdat_wdt.c | 2 +-
fs/ncpfs/ncplib_kernel.c | 4 +
fs/nfsd/nfs4state.c | 62 +++++++++----
include/asm-generic/pgtable.h | 10 +++
include/linux/fsl_ifc.h | 6 +-
include/uapi/linux/usb/audio.h | 4 +-
kernel/bpf/syscall.c | 2 +-
kernel/trace/trace_kprobe.c | 4 +-
kernel/trace/trace_probe.c | 8 +-
kernel/trace/trace_probe.h | 2 +-
lib/ioremap.c | 6 +-
mm/huge_memory.c | 4 +-
mm/khugepaged.c | 7 +-
mm/shmem.c | 31 ++++---
sound/drivers/aloop.c | 17 +++-
sound/pci/hda/patch_realtek.c | 6 +-
tools/perf/builtin-stat.c | 2 +-
tools/testing/selftests/x86/Makefile | 2 +-
tools/testing/selftests/x86/mpx-mini-test.c | 3 +-
tools/testing/selftests/x86/protection_keys.c | 49 ++++++----
tools/testing/selftests/x86/ptrace_syscall.c | 8 +-
64 files changed, 546 insertions(+), 292 deletions(-)
This is a note to let you know that I've just added the patch titled
team: Fix double free in error path
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
team-fix-double-free-in-error-path.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:37:51 CEST 2018
From: Arkadi Sharshevsky <arkadis(a)mellanox.com>
Date: Thu, 8 Mar 2018 12:42:10 +0200
Subject: team: Fix double free in error path
From: Arkadi Sharshevsky <arkadis(a)mellanox.com>
[ Upstream commit cbcc607e18422555db569b593608aec26111cb0b ]
The __send_and_alloc_skb() receives a skb ptr as a parameter but in
case it fails the skb is not valid:
- Send failed and released the skb internally.
- Allocation failed.
The current code tries to release the skb in case of failure which
causes redundant freeing.
Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
Signed-off-by: Arkadi Sharshevsky <arkadis(a)mellanox.com>
Acked-by: Jiri Pirko <jiri(a)mellanox.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/net/team/team.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2395,7 +2395,7 @@ send_done:
if (!nlh) {
err = __send_and_alloc_skb(&skb, team, portid, send_func);
if (err)
- goto errout;
+ return err;
goto send_done;
}
@@ -2681,7 +2681,7 @@ send_done:
if (!nlh) {
err = __send_and_alloc_skb(&skb, team, portid, send_func);
if (err)
- goto errout;
+ return err;
goto send_done;
}
Patches currently in stable-queue which might be from arkadis(a)mellanox.com are
queue-4.15/devlink-remove-redundant-free-on-error-path.patch
queue-4.15/team-fix-double-free-in-error-path.patch
This is a note to let you know that I've just added the patch titled
tcp: purge write queue upon aborting the connection
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
tcp-purge-write-queue-upon-aborting-the-connection.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:37:51 CEST 2018
From: Soheil Hassas Yeganeh <soheil(a)google.com>
Date: Tue, 6 Mar 2018 17:15:12 -0500
Subject: tcp: purge write queue upon aborting the connection
From: Soheil Hassas Yeganeh <soheil(a)google.com>
[ Upstream commit e05836ac07c77dd90377f8c8140bce2a44af5fe7 ]
When the connection is aborted, there is no point in
keeping the packets on the write queue until the connection
is closed.
Similar to a27fd7a8ed38 ('tcp: purge write queue upon RST'),
this is essential for a correct MSG_ZEROCOPY implementation,
because userspace cannot call close(fd) before receiving
zerocopy signals even when the connection is aborted.
Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY")
Signed-off-by: Soheil Hassas Yeganeh <soheil(a)google.com>
Signed-off-by: Neal Cardwell <ncardwell(a)google.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Signed-off-by: Yuchung Cheng <ycheng(a)google.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/ipv4/tcp.c | 1 +
net/ipv4/tcp_timer.c | 1 +
2 files changed, 2 insertions(+)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3542,6 +3542,7 @@ int tcp_abort(struct sock *sk, int err)
bh_unlock_sock(sk);
local_bh_enable();
+ tcp_write_queue_purge(sk);
release_sock(sk);
return 0;
}
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -34,6 +34,7 @@ static void tcp_write_err(struct sock *s
sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT;
sk->sk_error_report(sk);
+ tcp_write_queue_purge(sk);
tcp_done(sk);
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
}
Patches currently in stable-queue which might be from soheil(a)google.com are
queue-4.15/tcp-purge-write-queue-upon-aborting-the-connection.patch
This is a note to let you know that I've just added the patch titled
sysfs: symlink: export sysfs_create_link_nowarn()
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
sysfs-symlink-export-sysfs_create_link_nowarn.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:37:51 CEST 2018
From: Grygorii Strashko <grygorii.strashko(a)ti.com>
Date: Fri, 16 Mar 2018 17:08:34 -0500
Subject: sysfs: symlink: export sysfs_create_link_nowarn()
From: Grygorii Strashko <grygorii.strashko(a)ti.com>
[ Upstream commit 2399ac42e762ab25c58420e25359b2921afdc55f ]
The sysfs_create_link_nowarn() is going to be used in phylib framework in
subsequent patch which can be built as module. Hence, export
sysfs_create_link_nowarn() to avoid build errors.
Cc: Florian Fainelli <f.fainelli(a)gmail.com>
Cc: Andrew Lunn <andrew(a)lunn.ch>
Fixes: a3995460491d ("net: phy: Relax error checking on sysfs_create_link()")
Signed-off-by: Grygorii Strashko <grygorii.strashko(a)ti.com>
Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/sysfs/symlink.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -107,6 +107,7 @@ int sysfs_create_link_nowarn(struct kobj
{
return sysfs_do_create_link(kobj, target, name, 0);
}
+EXPORT_SYMBOL_GPL(sysfs_create_link_nowarn);
/**
* sysfs_delete_link - remove symlink in object's directory.
Patches currently in stable-queue which might be from grygorii.strashko(a)ti.com are
queue-4.15/sysfs-symlink-export-sysfs_create_link_nowarn.patch
queue-4.15/net-ethernet-ti-cpsw-add-check-for-in-band-mode-setting-with-rgmii-phy-interface.patch
queue-4.15/net-phy-relax-error-checking-when-creating-sysfs-link-netdev-phydev.patch
This is a note to let you know that I've just added the patch titled
soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
soc-fsl-qbman-fix-issue-in-qman_delete_cgr_safe.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:37:51 CEST 2018
From: Madalin Bucur <madalin.bucur(a)nxp.com>
Date: Wed, 14 Mar 2018 08:37:28 -0500
Subject: soc/fsl/qbman: fix issue in qman_delete_cgr_safe()
From: Madalin Bucur <madalin.bucur(a)nxp.com>
[ Upstream commit 96f413f47677366e0ae03797409bfcc4151dbf9e ]
The wait_for_completion() call in qman_delete_cgr_safe()
was triggering a scheduling while atomic bug, replacing the
kthread with a smp_call_function_single() call to fix it.
Signed-off-by: Madalin Bucur <madalin.bucur(a)nxp.com>
Signed-off-by: Roy Pledge <roy.pledge(a)nxp.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/soc/fsl/qbman/qman.c | 28 +++++-----------------------
1 file changed, 5 insertions(+), 23 deletions(-)
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -2443,39 +2443,21 @@ struct cgr_comp {
struct completion completion;
};
-static int qman_delete_cgr_thread(void *p)
+static void qman_delete_cgr_smp_call(void *p)
{
- struct cgr_comp *cgr_comp = (struct cgr_comp *)p;
- int ret;
-
- ret = qman_delete_cgr(cgr_comp->cgr);
- complete(&cgr_comp->completion);
-
- return ret;
+ qman_delete_cgr((struct qman_cgr *)p);
}
void qman_delete_cgr_safe(struct qman_cgr *cgr)
{
- struct task_struct *thread;
- struct cgr_comp cgr_comp;
-
preempt_disable();
if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id()) {
- init_completion(&cgr_comp.completion);
- cgr_comp.cgr = cgr;
- thread = kthread_create(qman_delete_cgr_thread, &cgr_comp,
- "cgr_del");
-
- if (IS_ERR(thread))
- goto out;
-
- kthread_bind(thread, qman_cgr_cpus[cgr->cgrid]);
- wake_up_process(thread);
- wait_for_completion(&cgr_comp.completion);
+ smp_call_function_single(qman_cgr_cpus[cgr->cgrid],
+ qman_delete_cgr_smp_call, cgr, true);
preempt_enable();
return;
}
-out:
+
qman_delete_cgr(cgr);
preempt_enable();
}
Patches currently in stable-queue which might be from madalin.bucur(a)nxp.com are
queue-4.15/dpaa_eth-remove-duplicate-increment-of-the-tx_errors-counter.patch
queue-4.15/soc-fsl-qbman-fix-issue-in-qman_delete_cgr_safe.patch
queue-4.15/dpaa_eth-fix-error-in-dpaa_remove.patch
This is a note to let you know that I've just added the patch titled
skbuff: Fix not waking applications when errors are enqueued
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
skbuff-fix-not-waking-applications-when-errors-are-enqueued.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:37:51 CEST 2018
From: Vinicius Costa Gomes <vinicius.gomes(a)intel.com>
Date: Wed, 14 Mar 2018 13:32:09 -0700
Subject: skbuff: Fix not waking applications when errors are enqueued
From: Vinicius Costa Gomes <vinicius.gomes(a)intel.com>
[ Upstream commit 6e5d58fdc9bedd0255a8781b258f10bbdc63e975 ]
When errors are enqueued to the error queue via sock_queue_err_skb()
function, it is possible that the waiting application is not notified.
Calling 'sk->sk_data_ready()' would not notify applications that
selected only POLLERR events in poll() (for example).
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Randy E. Witt <randy.e.witt(a)intel.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes(a)intel.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/core/skbuff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4173,7 +4173,7 @@ int sock_queue_err_skb(struct sock *sk,
skb_queue_tail(&sk->sk_error_queue, skb);
if (!sock_flag(sk, SOCK_DEAD))
- sk->sk_data_ready(sk);
+ sk->sk_error_report(sk);
return 0;
}
EXPORT_SYMBOL(sock_queue_err_skb);
Patches currently in stable-queue which might be from vinicius.gomes(a)intel.com are
queue-4.15/skbuff-fix-not-waking-applications-when-errors-are-enqueued.patch
This is a note to let you know that I've just added the patch titled
sch_netem: fix skb leak in netem_enqueue()
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
sch_netem-fix-skb-leak-in-netem_enqueue.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From foo@baz Wed Mar 28 18:37:51 CEST 2018
From: Alexey Kodanev <alexey.kodanev(a)oracle.com>
Date: Mon, 5 Mar 2018 20:52:54 +0300
Subject: sch_netem: fix skb leak in netem_enqueue()
From: Alexey Kodanev <alexey.kodanev(a)oracle.com>
[ Upstream commit 35d889d10b649fda66121891ec05eca88150059d ]
When we exceed current packets limit and we have more than one
segment in the list returned by skb_gso_segment(), netem drops
only the first one, skipping the rest, hence kmemleak reports:
unreferenced object 0xffff880b5d23b600 (size 1024):
comm "softirq", pid 0, jiffies 4384527763 (age 2770.629s)
hex dump (first 32 bytes):
00 80 23 5d 0b 88 ff ff 00 00 00 00 00 00 00 00 ..#]............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d8a19b9d>] __alloc_skb+0xc9/0x520
[<000000001709b32f>] skb_segment+0x8c8/0x3710
[<00000000c7b9bb88>] tcp_gso_segment+0x331/0x1830
[<00000000c921cba1>] inet_gso_segment+0x476/0x1370
[<000000008b762dd4>] skb_mac_gso_segment+0x1f9/0x510
[<000000002182660a>] __skb_gso_segment+0x1dd/0x620
[<00000000412651b9>] netem_enqueue+0x1536/0x2590 [sch_netem]
[<0000000005d3b2a9>] __dev_queue_xmit+0x1167/0x2120
[<00000000fc5f7327>] ip_finish_output2+0x998/0xf00
[<00000000d309e9d3>] ip_output+0x1aa/0x2c0
[<000000007ecbd3a4>] tcp_transmit_skb+0x18db/0x3670
[<0000000042d2a45f>] tcp_write_xmit+0x4d4/0x58c0
[<0000000056a44199>] tcp_tasklet_func+0x3d9/0x540
[<0000000013d06d02>] tasklet_action+0x1ca/0x250
[<00000000fcde0b8b>] __do_softirq+0x1b4/0x5a3
[<00000000e7ed027c>] irq_exit+0x1e2/0x210
Fix it by adding the rest of the segments, if any, to skb 'to_free'
list. Add new __qdisc_drop_all() and qdisc_drop_all() functions
because they can be useful in the future if we need to drop segmented
GSO packets in other places.
Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Alexey Kodanev <alexey.kodanev(a)oracle.com>
Acked-by: Neil Horman <nhorman(a)tuxdriver.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
include/net/sch_generic.h | 19 +++++++++++++++++++
net/sched/sch_netem.c | 2 +-
2 files changed, 20 insertions(+), 1 deletion(-)
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -735,6 +735,16 @@ static inline void __qdisc_drop(struct s
*to_free = skb;
}
+static inline void __qdisc_drop_all(struct sk_buff *skb,
+ struct sk_buff **to_free)
+{
+ if (skb->prev)
+ skb->prev->next = *to_free;
+ else
+ skb->next = *to_free;
+ *to_free = skb;
+}
+
static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
struct qdisc_skb_head *qh,
struct sk_buff **to_free)
@@ -853,6 +863,15 @@ static inline int qdisc_drop(struct sk_b
qdisc_qstats_drop(sch);
return NET_XMIT_DROP;
+}
+
+static inline int qdisc_drop_all(struct sk_buff *skb, struct Qdisc *sch,
+ struct sk_buff **to_free)
+{
+ __qdisc_drop_all(skb, to_free);
+ qdisc_qstats_drop(sch);
+
+ return NET_XMIT_DROP;
}
/* Length to Time (L2T) lookup in a qdisc_rate_table, to determine how
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -509,7 +509,7 @@ static int netem_enqueue(struct sk_buff
}
if (unlikely(sch->q.qlen >= sch->limit))
- return qdisc_drop(skb, sch, to_free);
+ return qdisc_drop_all(skb, sch, to_free);
qdisc_qstats_backlog_inc(sch, skb);
Patches currently in stable-queue which might be from alexey.kodanev(a)oracle.com are
queue-4.15/sch_netem-fix-skb-leak-in-netem_enqueue.patch
queue-4.15/macvlan-filter-out-unsupported-feature-flags.patch
queue-4.15/dccp-check-sk-for-closed-state-in-dccp_sendmsg.patch