[arch-commits] Commit in linux/trunk (2 files)

[Thomas Bächler]

    Date: Thursday, February 20, 2014 @ 23:43:41
  Author: thomas
Revision: 206177

Update to 3.13.4-1 and add another critical NFS bugfix.

Added:
  linux/trunk/0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch
Modified:
  linux/trunk/PKGBUILD

-----------------------------------------------------------------+
 0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch |   82 ++++++++++
 PKGBUILD                                                        |   10 -
 2 files changed, 90 insertions(+), 2 deletions(-)

Added: 0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch
===================================================================
--- 0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch	                        (rev 0)
+++ 0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch	2014-02-20 22:43:41 UTC (rev 206177)
@@ -0,0 +1,82 @@
+From 2bd7c7b5f011b3d57e4f5625b561a6f3f2f34a81 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust at primarydata.com>
+Date: Sun, 16 Feb 2014 12:14:13 -0500
+Subject: [PATCH] SUNRPC: Ensure that gss_auth isn't freed before its upcall
+ messages
+
+Fix a race in which the RPC client is shutting down while the
+gss daemon is processing a downcall. If the RPC client manages to
+shut down before the gss daemon is done, then the struct gss_auth
+used in gss_release_msg() may have already been freed.
+
+Link: http://lkml.kernel.org/r/1392494917.71728.YahooMailNeo@web140002.mail.bf1.yahoo.com
+Reported-by: John <da_audiophile at yahoo.com>
+Reported-by: Borislav Petkov <bp at alien8.de>
+Cc: stable at vger.kernel.org # 3.12+
+Signed-off-by: Trond Myklebust <trond.myklebust at primarydata.com>
+---
+ net/sunrpc/auth_gss/auth_gss.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 42fdfc6..a642fd616 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -108,6 +108,7 @@ struct gss_auth {
+ static DEFINE_SPINLOCK(pipe_version_lock);
+ static struct rpc_wait_queue pipe_version_rpc_waitqueue;
+ static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
++static void gss_put_auth(struct gss_auth *gss_auth);
+ 
+ static void gss_free_ctx(struct gss_cl_ctx *);
+ static const struct rpc_pipe_ops gss_upcall_ops_v0;
+@@ -320,6 +321,7 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
+ 	if (gss_msg->ctx != NULL)
+ 		gss_put_ctx(gss_msg->ctx);
+ 	rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
++	gss_put_auth(gss_msg->auth);
+ 	kfree(gss_msg);
+ }
+ 
+@@ -500,6 +502,7 @@ gss_alloc_msg(struct gss_auth *gss_auth,
+ 		if (err)
+ 			goto err_free_msg;
+ 	};
++	kref_get(&gss_auth->kref);
+ 	return gss_msg;
+ err_free_msg:
+ 	kfree(gss_msg);
+@@ -1071,6 +1074,12 @@ gss_free_callback(struct kref *kref)
+ }
+ 
+ static void
++gss_put_auth(struct gss_auth *gss_auth)
++{
++	kref_put(&gss_auth->kref, gss_free_callback);
++}
++
++static void
+ gss_destroy(struct rpc_auth *auth)
+ {
+ 	struct gss_auth *gss_auth = container_of(auth,
+@@ -1091,7 +1100,7 @@ gss_destroy(struct rpc_auth *auth)
+ 	gss_auth->gss_pipe[1] = NULL;
+ 	rpcauth_destroy_credcache(auth);
+ 
+-	kref_put(&gss_auth->kref, gss_free_callback);
++	gss_put_auth(gss_auth);
+ }
+ 
+ /*
+@@ -1262,7 +1271,7 @@ gss_destroy_nullcred(struct rpc_cred *cred)
+ 	call_rcu(&cred->cr_rcu, gss_free_cred_callback);
+ 	if (ctx)
+ 		gss_put_ctx(ctx);
+-	kref_put(&gss_auth->kref, gss_free_callback);
++	gss_put_auth(gss_auth);
+ }
+ 
+ static void
+-- 
+1.9.0
+

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2014-02-20 22:00:46 UTC (rev 206176)
+++ PKGBUILD	2014-02-20 22:43:41 UTC (rev 206177)
@@ -5,7 +5,7 @@
 pkgbase=linux               # Build stock -ARCH kernel
 #pkgbase=linux-custom       # Build kernel with a different name
 _srcname=linux-3.13
-pkgver=3.13.3
+pkgver=3.13.4
 pkgrel=1
 arch=('i686' 'x86_64')
 url="http://www.kernel.org/"
@@ -26,12 +26,13 @@
         '0004-rpc_pipe-remove-the-clntXX-dir-if-creating-the-pipe-.patch'
         '0005-sunrpc-add-an-info-file-for-the-dummy-gssd-pipe.patch'
         '0006-rpc_pipe-fix-cleanup-of-dummy-gssd-directory-when-no.patch'
+        '0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch'
         '0001-syscalls.h-use-gcc-alias-instead-of-assembler-aliase.patch'
         '0001-quirk-asm_volatile_goto.patch'
         'i8042-fix-aliases.patch'
         )
 md5sums=('0ecbaf65c00374eb4a826c2f9f37606f'
-         '2d3d298f2b430122f4baf2af88277231'
+         '77ca721ea0e8373f58f596fe0d9b1b47'
          'ba4468d313adfaf22368add7f58204aa'
          '035bb27dac306f5c028d96cad14bb249'
          'eb14dcfd80c00852ef81ded6e826826a'
@@ -43,6 +44,7 @@
          '10dbaf863e22b2437e68f9190d65c861'
          'd5907a721b97299f0685c583499f7820'
          'a724515b350b29c53f20e631c6cf9a14'
+         '1ae4ec847f41fa1b6d488f956e94c893'
          'e6fa278c092ad83780e2dd0568e24ca6'
          '6baa312bc166681f48e972824f3f6649'
          '93dbf73af819b77f03453a9c6de2bb47')
@@ -82,6 +84,10 @@
   # http://git.linux-nfs.org/?p=trondmy/linux-nfs.git;a=commitdiff;h=23e66ba97127ff3b064d4c6c5138aa34eafc492f
   patch -p1 -i "${srcdir}/0006-rpc_pipe-fix-cleanup-of-dummy-gssd-directory-when-no.patch"
 
+  # Fix FS#38921
+  # http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9eb2ddb48ce3a7bd745c14a933112994647fa3cd
+  patch -p1 -i "${srcdir}/0001-SUNRPC-Ensure-that-gss_auth-isn-t-freed-before-its-u.patch"
+
   # Fix symbols: Revert http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=83460ec8dcac14142e7860a01fa59c267ac4657c
   patch -Rp1 -i "${srcdir}/0001-syscalls.h-use-gcc-alias-instead-of-assembler-aliase.patch"