Hi,
> On 22. Jan 2019, at 16:55, Sasha Levin <sashal(a)kernel.org> wrote:
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 35abb67de744 tracing: expose current->comm to [ku]probe events.
>
> The bot has tested the following trees: v4.20.3, v4.19.16, v4.14.94, v4.9.151.
>
> v4.20.3: Build OK!
> v4.19.16: Failed to apply! Possible dependencies:
> 40b53b771806 ("tracing: probeevent: Add array type support")
> 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
> 56de76305279 ("tracing: probeevent: Cleanup print argument functions")
> 60c2e0cebfd0 ("tracing: probeevent: Add symbol type")
> eeb07b061500 ("tracing: probeevent: Cleanup argument field definition")
> f451bc89d835 ("tracing: probeevent: Unify fetch type tables")
>
> v4.14.94: Failed to apply! Possible dependencies:
> 40b53b771806 ("tracing: probeevent: Add array type support")
> 45408c4f9250 ("tracing: kprobes: Prohibit probing on notrace function")
> 4bebdc7a85aa ("bpf: add helper bpf_perf_prog_read_value")
> 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
> 60c2e0cebfd0 ("tracing: probeevent: Add symbol type")
> 908432ca84fc ("bpf: add helper bpf_perf_event_read_value for perf event array map")
> 97562633bcba ("bpf: perf event change needed for subsequent bpf helpers")
> 9802d86585db ("bpf: add a bpf_override_function helper")
> b4da3340eae2 ("tracing/kprobe: bpf: Check error injectable event is on function entry")
> cd86d1fd2102 ("bpf: Adding helper function bpf_getsockops")
> dd0bb688eaa2 ("bpf: add a bpf_override_function helper")
> de8f3a83b0a0 ("bpf: add meta pointer for direct access")
> f3edacbd697f ("bpf: Revert bpf_overrid_function() helper changes.")
> f451bc89d835 ("tracing: probeevent: Unify fetch type tables")
>
> v4.9.151: Failed to apply! Possible dependencies:
> 17bedab27231 ("bpf: xdp: Allow head adjustment in XDP prog")
> 1d9995771fcb ("s390: update defconfigs")
> 23a4e389bdc7 ("nfp: create separate define for max number of vectors")
> 40b53b771806 ("tracing: probeevent: Add array type support")
> 45408c4f9250 ("tracing: kprobes: Prohibit probing on notrace function")
> 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
> 60c2e0cebfd0 ("tracing: probeevent: Add symbol type")
> 67f8b1dcb9ee ("net/mlx4_en: Refactor the XDP forwarding rings scheme")
> 68453c7a8973 ("nfp: centralize runtime reconfiguration logic")
> 6b0b7551428e ("perf/core: Rename CONFIG_[UK]PROBE_EVENT to CONFIG_[UK]PROBE_EVENTS")
> 7ff5c83a1deb ("nfp: simplify nfp_net_poll()")
> 9802d86585db ("bpf: add a bpf_override_function helper")
> a4b562bb8ebd ("nfp: use unsigned int for vector/ring counts")
> b4da3340eae2 ("tracing/kprobe: bpf: Check error injectable event is on function entry")
> cbeaf7aa733a ("nfp: bring back support for different ring counts")
> ccc109b8ed24 ("net/mlx4_en: Add TX_XDP for CQ types")
> dd0bb688eaa2 ("bpf: add a bpf_override_function helper")
> e390b55d5aef ("bpf: make bpf_xdp_adjust_head support mandatory")
> ecd63a0217d5 ("nfp: add XDP support in the driver")
> f18f97ac43d7 ("tracing/kprobes: Add a helper method to return number of probe hits")
> f3edacbd697f ("bpf: Revert bpf_overrid_function() helper changes.")
> f451bc89d835 ("tracing: probeevent: Unify fetch type tables")
>
>
> How should we proceed with this patch?
I think this should be a case of backporting, which probably
needs
- removal of the 'parg->count ||' part from the if statement
(and the ', and not an array.' part of the comment above it).
- addition of the old 'ftbl' parameter to find_fetch_type()
for all kernels up to v4.19.16.
While at it, 'deferred' in the newly added comment should
probably be 'dereferenced' to match the deleted comment.
Masami, do you want to fix this up and prepare backported
patches for the stable kernels?
Thanks,
Andreas
This is the start of the stable review cycle for the 4.19.17 release.
There are 99 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jan 23 13:48:56 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.17-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.17-rc1
Shuah Khan <shuah(a)kernel.org>
selftests: Fix test errors related to lib.mk khdr target
Ivan Mironov <mironov.ivan(a)gmail.com>
drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
Jaegeuk Kim <jaegeuk(a)kernel.org>
loop: drop caches if offset or block_size are changed
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()
Jan Kara <jack(a)suse.cz>
loop: Get rid of 'nested' acquisition of loop_ctl_mutex
Jan Kara <jack(a)suse.cz>
loop: Avoid circular locking dependency between loop_ctl_mutex and bd_mutex
Jan Kara <jack(a)suse.cz>
loop: Fix deadlock when calling blkdev_reread_part()
Jan Kara <jack(a)suse.cz>
loop: Move loop_reread_partitions() out of loop_ctl_mutex
Jan Kara <jack(a)suse.cz>
loop: Move special partition reread handling in loop_clr_fd()
Jan Kara <jack(a)suse.cz>
loop: Push loop_ctl_mutex down to loop_change_fd()
Jan Kara <jack(a)suse.cz>
loop: Push loop_ctl_mutex down to loop_set_fd()
Jan Kara <jack(a)suse.cz>
loop: Push loop_ctl_mutex down to loop_set_status()
Jan Kara <jack(a)suse.cz>
loop: Push loop_ctl_mutex down to loop_get_status()
Jan Kara <jack(a)suse.cz>
loop: Push loop_ctl_mutex down into loop_clr_fd()
Jan Kara <jack(a)suse.cz>
loop: Split setting of lo_state from loop_clr_fd
Jan Kara <jack(a)suse.cz>
loop: Push lo_ctl_mutex down into individual ioctls
Jan Kara <jack(a)suse.cz>
loop: Get rid of loop_index_mutex
Jan Kara <jack(a)suse.cz>
loop: Fold __loop_release into loop_release
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
block/loop: Use global lock for ioctl() operation.
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
block/loop: Don't grab "struct file" for vfs_getattr() operation.
Ying Xue <ying.xue(a)windriver.com>
tipc: fix uninit-value in tipc_nl_compat_doit
Ying Xue <ying.xue(a)windriver.com>
tipc: fix uninit-value in tipc_nl_compat_name_table_dump
Ying Xue <ying.xue(a)windriver.com>
tipc: fix uninit-value in tipc_nl_compat_link_set
Ying Xue <ying.xue(a)windriver.com>
tipc: fix uninit-value in tipc_nl_compat_bearer_enable
Ying Xue <ying.xue(a)windriver.com>
tipc: fix uninit-value in tipc_nl_compat_link_reset_stats
Ying Xue <ying.xue(a)windriver.com>
tipc: fix uninit-value in in tipc_conn_rcv_sub
Xin Long <lucien.xin(a)gmail.com>
sctp: allocate sctp_sockaddr_entry with kzalloc
Jan Kara <jack(a)suse.cz>
blockdev: Fix livelocks on loop device
Stephen Smalley <sds(a)tycho.nsa.gov>
selinux: fix GPF on invalid policy
Yufen Yu <yuyufen(a)huawei.com>
block: use rcu_work instead of call_rcu to avoid sleep in softirq
Shakeel Butt <shakeelb(a)google.com>
netfilter: ebtables: account ebt_table_info to kmemcg
J. Bruce Fields <bfields(a)redhat.com>
sunrpc: handle ENOMEM in rpcb_getport_async
Hans Verkuil <hverkuil(a)xs4all.nl>
media: vb2: vb2_mmap: move lock up
James Morris <james.morris(a)microsoft.com>
LSM: Check for NULL cred-security on free
Eric Dumazet <edumazet(a)google.com>
ipv6: make icmp6_send() robust against null skb->dev
Willem de Bruijn <willemb(a)google.com>
bpf: in __bpf_redirect_no_mac pull mac only if present
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: set min width/height to a value > 0
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: fix error handling of kthread_run
Vlad Tsyrklevich <vlad(a)tsyrklevich.net>
omap2fb: Fix stack memory disclosure
Florian La Roche <florian.laroche(a)googlemail.com>
fix int_sqrt64() for very large numbers
YunQiang Su <ysu(a)wavecomp.com>
Disable MSI also when pcie-octeon.pcie_disable on
Heinrich Schuchardt <xypron.glpk(a)gmx.de>
arm64: dts: marvell: armada-ap806: reserve PSCI area
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: kaslr: ensure randomized quantities are clean to the PoC
Kees Cook <keescook(a)chromium.org>
pstore/ram: Avoid allocation and leak of platform data
Johan Hovold <johan(a)kernel.org>
net: dsa: realtek-smi: fix OF child-node lookup
Paul Burton <paul.burton(a)mips.com>
kbuild: Disable LD_DEAD_CODE_DATA_ELIMINATION with ftrace & GCC <= 4.7
Adit Ranadive <aditr(a)vmware.com>
RDMA/vmw_pvrdma: Return the correct opcode when creating WR
Leon Romanovsky <leon(a)kernel.org>
RDMA/nldev: Don't expose unsafe global rkey to regular user
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: v4l: ioctl: Validate num_planes for debug messages
Jonathan Hunter <jonathanh(a)nvidia.com>
mfd: tps6586x: Handle interrupts on suspend
Julia Lawall <Julia.Lawall(a)lip6.fr>
OF: properties: add missing of_node_put
Zhenyu Wang <zhenyuw(a)linux.intel.com>
drm/i915/gvt: Fix mmap range check
Hauke Mehrtens <hauke(a)hauke-m.de>
MIPS: lantiq: Fix IPI interrupt handling
Rafał Miłecki <rafal(a)milecki.pl>
MIPS: BCM47XX: Setup struct device for the SoC
Arnd Bergmann <arnd(a)arndb.de>
mips: fix n32 compat_ipc_parse_version
Ivan Mironov <mironov.ivan(a)gmail.com>
scsi: sd: Fix cache_type_store()
Stanley Chu <stanley.chu(a)mediatek.com>
scsi: core: Synchronize request queue PM status only on successful resume
Kees Cook <keescook(a)chromium.org>
Yama: Check for pid death before checking ancestry
Josef Bacik <josef(a)toxicpanda.com>
btrfs: wait on ordered extents on abort cleanup
David Sterba <dsterba(a)suse.com>
Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io"
Juergen Gross <jgross(a)suse.com>
xen: Fix x86 sched_clock() interface for xen
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - reorder code in talitos_edesc_alloc()
Eric Biggers <ebiggers(a)google.com>
crypto: authenc - fix parsing key with misaligned rta_len
Eric Biggers <ebiggers(a)google.com>
crypto: bcm - convert to use crypto_authenc_extractkeys()
Eric Biggers <ebiggers(a)google.com>
crypto: ccree - convert to use crypto_authenc_extractkeys()
Harsh Jain <harsh(a)chelsio.com>
crypto: authencesn - Avoid twice completion call in decrypt path
Aymen Sghaier <aymen.sghaier(a)nxp.com>
crypto: caam - fix zero-length buffer DMA mapping
Eric Biggers <ebiggers(a)google.com>
crypto: sm3 - fix undefined shift by >= width of value
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: load Realtek PHY driver module before r8169
Willem de Bruijn <willemb(a)google.com>
ip: on queued skb use skb_header_pointer instead of pskb_may_pull
Willem de Bruijn <willemb(a)google.com>
bonding: update nest level on unlink
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: don't try to read counters if chip is in a PCI power-save state
Cong Wang <xiyou.wangcong(a)gmail.com>
smc: move unhash as early as possible in smc_release()
Bryan Whitehead <Bryan.Whitehead(a)microchip.com>
lan743x: Remove phy_read from link status change function
Stanislav Fomichev <sdf(a)google.com>
tun: publish tfile after it's fully initialized
Yuchung Cheng <ycheng(a)google.com>
tcp: change txhash on SYN-data timeout
Jason Gunthorpe <jgg(a)ziepe.ca>
packet: Do not leak dev refcounts on error exit
JianJhen Chen <kchen(a)synology.com>
net: bridge: fix a bug on using a neighbour cache entry without checking its state
Eric Dumazet <edumazet(a)google.com>
ipv6: fix kernel-infoleak in ipv6_local_error()
Mark Rutland <mark.rutland(a)arm.com>
arm64: Don't trap host pointer auth use to EL2
Mark Rutland <mark.rutland(a)arm.com>
arm64/kvm: consistently handle host HCR_EL2 flags
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: fix csk leak - 2
Varun Prakash <varun(a)chelsio.com>
scsi: target: iscsi: cxgbit: fix csk leak
Sasha Levin <sashal(a)kernel.org>
Revert "scsi: target: iscsi: cxgbit: fix csk leak"
Loic Poulain <loic.poulain(a)linaro.org>
mmc: sdhci-msm: Disable CDR function on TX
Florian Westphal <fw(a)strlen.de>
netfilter: nf_conncount: fix argument order to find_next_bit
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_conncount: speculative garbage collection on empty lists
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_conncount: move all list iterations under spinlock
Florian Westphal <fw(a)strlen.de>
netfilter: nf_conncount: merge lookup and add functions
Florian Westphal <fw(a)strlen.de>
netfilter: nf_conncount: restart search when nodes have been erased
Florian Westphal <fw(a)strlen.de>
netfilter: nf_conncount: split gc in two phases
Florian Westphal <fw(a)strlen.de>
netfilter: nf_conncount: don't skip eviction when age is negative
Shawn Bohrer <sbohrer(a)cloudflare.com>
netfilter: nf_conncount: replace CONNCOUNT_LOCK_SLOTS with CONNCOUNT_SLOTS
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: gw: ensure DLC boundaries after CAN frame modification
Dmitry Safonov <dima(a)arista.com>
tty: Don't hold ldisc lock in tty_reopen() if ldisc present
Dmitry Safonov <dima(a)arista.com>
tty: Simplify tty->count math in tty_reopen()
Dmitry Safonov <dima(a)arista.com>
tty: Hold tty_ldisc_lock() during tty_reopen()
Dmitry Safonov <dima(a)arista.com>
tty/ldsem: Wake up readers after timed out down_write()
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/boot/dts/marvell/armada-ap806.dtsi | 17 +
arch/arm64/include/asm/kvm_arm.h | 3 +
arch/arm64/kernel/head.S | 5 +-
arch/arm64/kernel/kaslr.c | 8 +-
arch/arm64/kvm/hyp/switch.c | 2 +-
arch/mips/Kconfig | 1 +
arch/mips/bcm47xx/setup.c | 31 ++
arch/mips/lantiq/irq.c | 68 +---
arch/mips/pci/msi-octeon.c | 4 +-
arch/x86/xen/time.c | 12 +-
block/partition-generic.c | 8 +-
crypto/authenc.c | 14 +-
crypto/authencesn.c | 2 +-
crypto/sm3_generic.c | 2 +-
drivers/block/loop.c | 443 +++++++++++++--------
drivers/block/loop.h | 1 -
drivers/crypto/Kconfig | 1 +
drivers/crypto/bcm/cipher.c | 44 +-
drivers/crypto/caam/caamhash.c | 15 +-
drivers/crypto/ccree/cc_aead.c | 40 +-
drivers/crypto/talitos.c | 26 +-
drivers/gpu/drm/drm_fb_helper.c | 7 +-
drivers/gpu/drm/i915/gvt/kvmgt.c | 14 +-
drivers/infiniband/core/nldev.c | 4 -
drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 35 +-
drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 6 +
drivers/media/common/videobuf2/videobuf2-core.c | 11 +-
drivers/media/platform/vivid/vivid-kthread-cap.c | 5 +-
drivers/media/platform/vivid/vivid-kthread-out.c | 5 +-
drivers/media/platform/vivid/vivid-vid-common.c | 2 +-
drivers/media/v4l2-core/v4l2-ioctl.c | 4 +-
drivers/mfd/tps6586x.c | 24 ++
drivers/mmc/host/sdhci-msm.c | 43 +-
drivers/net/bonding/bond_main.c | 3 +
drivers/net/dsa/realtek-smi.c | 18 +-
drivers/net/ethernet/microchip/lan743x_main.c | 11 +-
drivers/net/ethernet/realtek/r8169.c | 7 +-
drivers/net/tun.c | 11 +-
drivers/of/property.c | 1 +
drivers/scsi/scsi_pm.c | 26 +-
drivers/scsi/sd.c | 6 +
drivers/target/iscsi/cxgbit/cxgbit_cm.c | 23 +-
drivers/tty/tty_io.c | 22 +-
drivers/tty/tty_ldsem.c | 10 +
drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 2 +
drivers/xen/events/events_base.c | 2 +-
fs/block_dev.c | 28 +-
fs/btrfs/disk-io.c | 8 +
fs/btrfs/inode.c | 3 -
fs/pstore/ram.c | 9 +-
include/linux/bcma/bcma_soc.h | 1 +
include/linux/genhd.h | 2 +-
include/net/netfilter/nf_conntrack_count.h | 19 +-
include/uapi/rdma/vmw_pvrdma-abi.h | 1 +
init/Kconfig | 1 +
lib/int_sqrt.c | 2 +-
net/bridge/br_netfilter_hooks.c | 2 +-
net/bridge/netfilter/ebtables.c | 6 +-
net/can/gw.c | 30 +-
net/core/filter.c | 21 +-
net/core/lwt_bpf.c | 1 +
net/ipv4/ip_sockglue.c | 12 +-
net/ipv4/tcp_timer.c | 2 +-
net/ipv6/datagram.c | 11 +-
net/ipv6/icmp.c | 8 +-
net/netfilter/nf_conncount.c | 290 ++++++--------
net/netfilter/nft_connlimit.c | 14 +-
net/packet/af_packet.c | 4 +-
net/sctp/ipv6.c | 5 +-
net/sctp/protocol.c | 4 +-
net/smc/af_smc.c | 4 +-
net/sunrpc/rpcb_clnt.c | 8 +
net/tipc/netlink_compat.c | 50 ++-
net/tipc/topsrv.c | 2 +-
security/security.c | 7 +
security/selinux/ss/policydb.c | 3 +-
security/yama/yama_lsm.c | 4 +-
tools/testing/selftests/android/Makefile | 2 +-
tools/testing/selftests/futex/functional/Makefile | 1 +
tools/testing/selftests/gpio/Makefile | 1 +
tools/testing/selftests/kvm/Makefile | 2 +-
tools/testing/selftests/lib.mk | 8 +-
.../selftests/networking/timestamping/Makefile | 1 +
tools/testing/selftests/vm/Makefile | 1 +
85 files changed, 977 insertions(+), 654 deletions(-)
On 1/20/19 11:55 PM, Mogens Jensen wrote:
> The only minor annoyance I'm experiencing now, is a large amount of debug output from something in kernel log when audio is played on the system:
>
> writing to lpe: 00000000: 01 01 01 01 00 00 08 00 ff ff ff ff 55 00 00 00 ............U...
> writing to lpe: 00000000: 01 01 01 01 00 00 1a 00 ff ff ff ff 75 00 12 00 ............u...
> ...
That's enabled via dynamic debug so that's rather a configuration issue
than a kernel problem?
From: Peter Oskolkov <posk(a)google.com>
commit 0ff89efb524631ac9901b81446b453c29711c376 upstream
The current behavior of IP defragmentation is inconsistent:
- some overlapping/wrong length fragments are dropped without
affecting the queue;
- most overlapping fragments cause the whole frag queue to be dropped.
This patch brings consistency: if a bad fragment is detected,
the whole frag queue is dropped. Two major benefits:
- fail fast: corrupted frag queues are cleared immediately, instead of
by timeout;
- testing of overlapping fragments is now much easier: any kind of
random fragment length mutation now leads to the frag queue being
discarded (IP packet dropped); before this patch, some overlaps were
"corrected", with tests not seeing expected packet drops.
Note that in one case (see "if (end&7)" conditional) the current
behavior is preserved as there are concerns that this could be
legitimate padding.
Signed-off-by: Peter Oskolkov <posk(a)google.com>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Reviewed-by: Willem de Bruijn <willemb(a)google.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Zubin Mithra <zsm(a)chromium.org>
---
Backport Note:
- Syzkaller reported a UAF, as 0ff89efb5246 ("ip: fail fast on IP defrag
errors") was not applied prior to applying d5f9565c8d5a ("net: ipv4: do
not handle duplicate fragments as overlapping").
Conflicts occur when 0ff89efb5246 is now applied onto 4.14.y/4.19.y,
which this patch addresses.
- An alternative to this patch would be to do the following :-
- revert "net: ipv4: do not handle duplicate fragments as overlapping"
(d5f9565c8d5ad on 4.19.y, 95b4b711444a on 4.14.y)
- apply "ip: fail fast on IP defrag errors" (0ff89efb5246)
- apply "net: ipv4: do not handle duplicate fragments as overlapping"
(ade446403bfb)
net/ipv4/ip_fragment.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index f8bbd693c19c2..03576ff7557e0 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -382,7 +382,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
*/
if (end < qp->q.len ||
((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len))
- goto err;
+ goto discard_qp;
qp->q.flags |= INET_FRAG_LAST_IN;
qp->q.len = end;
} else {
@@ -394,20 +394,20 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
if (end > qp->q.len) {
/* Some bits beyond end -> corruption. */
if (qp->q.flags & INET_FRAG_LAST_IN)
- goto err;
+ goto discard_qp;
qp->q.len = end;
}
}
if (end == offset)
- goto err;
+ goto discard_qp;
err = -ENOMEM;
if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
- goto err;
+ goto discard_qp;
err = pskb_trim_rcsum(skb, end - offset);
if (err)
- goto err;
+ goto discard_qp;
/* Note : skb->rbnode and skb->dev share the same location. */
dev = skb->dev;
@@ -425,6 +425,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
* fragment.
*/
+ err = -EINVAL;
/* Find out where to put this fragment. */
prev_tail = qp->q.fragments_tail;
if (!prev_tail)
@@ -433,7 +434,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
/* This is the common case: skb goes to the end. */
/* Detect and discard overlaps. */
if (offset < prev_tail->ip_defrag_offset + prev_tail->len)
- goto discard_qp;
+ goto overlap;
if (offset == prev_tail->ip_defrag_offset + prev_tail->len)
ip4_frag_append_to_last_run(&qp->q, skb);
else
@@ -456,7 +457,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
end <= skb1_run_end)
goto err; /* No new data, potential duplicate */
else
- goto discard_qp; /* Found an overlap */
+ goto overlap; /* Found an overlap */
} while (*rbn);
/* Here we have parent properly set, and rbn pointing to
* one of its NULL left/right children. Insert skb.
@@ -493,16 +494,18 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
skb->_skb_refdst = 0UL;
err = ip_frag_reasm(qp, skb, prev_tail, dev);
skb->_skb_refdst = orefdst;
+ if (err)
+ inet_frag_kill(&qp->q);
return err;
}
skb_dst_drop(skb);
return -EINPROGRESS;
+overlap:
+ __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
discard_qp:
inet_frag_kill(&qp->q);
- err = -EINVAL;
- __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
err:
kfree_skb(skb);
return err;
--
2.20.1.97.g81188d93c3-goog