[arch-commits] Commit in linux-lts/trunk (2 files)
Andreas Radke
andyrtr at archlinux.org
Thu Oct 12 21:17:39 UTC 2017
Date: Thursday, October 12, 2017 @ 21:17:38
Author: andyrtr
Revision: 307803
upgpkg: linux-lts 4.9.56-1
upstream update 4.9.56
Modified:
linux-lts/trunk/PKGBUILD
Deleted:
linux-lts/trunk/socket_bpf_fix_possible_use_after_free.diff
---------------------------------------------+
PKGBUILD | 14 +---
socket_bpf_fix_possible_use_after_free.diff | 91 --------------------------
2 files changed, 4 insertions(+), 101 deletions(-)
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2017-10-12 21:10:32 UTC (rev 307802)
+++ PKGBUILD 2017-10-12 21:17:38 UTC (rev 307803)
@@ -4,7 +4,7 @@
pkgbase=linux-lts
#pkgbase=linux-lts-custom
_srcname=linux-4.9
-pkgver=4.9.55
+pkgver=4.9.56
pkgrel=1
arch=('i686' 'x86_64')
url="https://www.kernel.org/"
@@ -19,19 +19,17 @@
'90-linux.hook'
# standard config files for mkinitcpio ramdisk
linux-lts.preset
- change-default-console-loglevel.patch
- socket_bpf_fix_possible_use_after_free.diff)
+ change-default-console-loglevel.patch)
# https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
sha256sums=('029098dcffab74875e086ae970e3828456838da6e0ba22ce3f64ef764f3d7f1a'
'SKIP'
- '358191624dd7004bfc7a8658b6354d9da4d49eb8ef84af41d2dc63dd1a8c4d1a'
+ 'a63aacf1f75a2f02a1313658b7f86be922b7a0e4bab41dc377449dfc0b7c529f'
'SKIP'
'6ee48ebd5cf5a6f1a8ab3bb8b00956345b2b2bab3b1238a90d0de09745c502ec'
'1bec2ba1cd21b26234caf33cca737259797430d4fe5fade16e60480a9442a6e0'
'834bd254b56ab71d73f59b3221f056c72f559553c04718e350ab2a3e2991afe0'
'1f036f7464da54ae510630f0edb69faa115287f86d9f17641197ffda8cfd49e0'
- '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99'
- 'f6a5db4ef1580922ffd0e2d080a8a6ba9b97e270f8373f09c4675241447d6af6')
+ '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99')
validpgpkeys=('ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds <torvalds at linux-foundation.org>
'647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman (Linux kernel stable release signing key) <greg at kroah.com>
)
@@ -47,10 +45,6 @@
# add latest fixes from stable queue, if needed
# http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
- # fix broken network reverting upstream commit
- # https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.9.y&id=02f7e4101092b88e57c73171174976c8a72a3eba
- patch -Rp1 -i ../socket_bpf_fix_possible_use_after_free.diff
-
# set DEFAULT_CONSOLE_LOGLEVEL to 4 (same value as the 'quiet' kernel param)
# remove this when a Kconfig knob is made available by upstream
# (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
Deleted: socket_bpf_fix_possible_use_after_free.diff
===================================================================
--- socket_bpf_fix_possible_use_after_free.diff 2017-10-12 21:10:32 UTC (rev 307802)
+++ socket_bpf_fix_possible_use_after_free.diff 2017-10-12 21:17:38 UTC (rev 307803)
@@ -1,91 +0,0 @@
-From 02f7e4101092b88e57c73171174976c8a72a3eba Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet at google.com>
-Date: Mon, 2 Oct 2017 12:20:51 -0700
-Subject: socket, bpf: fix possible use after free
-
-[ Upstream commit eefca20eb20c66b06cf5ed09b49b1a7caaa27b7b ]
-
-Starting from linux-4.4, 3WHS no longer takes the listener lock.
-
-Since this time, we might hit a use-after-free in sk_filter_charge(),
-if the filter we got in the memcpy() of the listener content
-just happened to be replaced by a thread changing listener BPF filter.
-
-To fix this, we need to make sure the filter refcount is not already
-zero before incrementing it again.
-
-Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
-Signed-off-by: Eric Dumazet <edumazet at google.com>
-Acked-by: Alexei Starovoitov <ast at kernel.org>
-Acked-by: Daniel Borkmann <daniel at iogearbox.net>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
----
- net/core/filter.c | 15 +++++++++++++--
- net/core/sock.c | 5 ++++-
- 2 files changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/net/core/filter.c b/net/core/filter.c
-index 4eb4ce0..bfeedbb 100644
---- a/net/core/filter.c
-+++ b/net/core/filter.c
-@@ -937,20 +937,31 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
- /* try to charge the socket memory if there is space available
- * return true on success
- */
--bool sk_filter_charge(struct sock *sk, struct sk_filter *fp)
-+static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp)
- {
- u32 filter_size = bpf_prog_size(fp->prog->len);
-
- /* same check as in sock_kmalloc() */
- if (filter_size <= sysctl_optmem_max &&
- atomic_read(&sk->sk_omem_alloc) + filter_size < sysctl_optmem_max) {
-- atomic_inc(&fp->refcnt);
- atomic_add(filter_size, &sk->sk_omem_alloc);
- return true;
- }
- return false;
- }
-
-+bool sk_filter_charge(struct sock *sk, struct sk_filter *fp)
-+{
-+ if (!atomic_inc_not_zero(&fp->refcnt))
-+ return false;
-+
-+ if (!__sk_filter_charge(sk, fp)) {
-+ sk_filter_release(fp);
-+ return false;
-+ }
-+ return true;
-+}
-+
- static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
- {
- struct sock_filter *old_prog;
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 231c38d..2a77cc5 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1528,13 +1528,16 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
- sock_reset_flag(newsk, SOCK_DONE);
- skb_queue_head_init(&newsk->sk_error_queue);
-
-- filter = rcu_dereference_protected(newsk->sk_filter, 1);
-+ rcu_read_lock();
-+ filter = rcu_dereference(sk->sk_filter);
- if (filter != NULL)
- /* though it's an empty new sock, the charging may fail
- * if sysctl_optmem_max was changed between creation of
- * original socket and cloning
- */
- is_charged = sk_filter_charge(newsk, filter);
-+ RCU_INIT_POINTER(newsk->sk_filter, filter);
-+ rcu_read_unlock();
-
- if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
- /* We need to make sure that we don't uncharge the new
---
-cgit v1.1
-
-
More information about the arch-commits
mailing list