linux-stable.git/net/ipv4, branch v4.4.4

rtnl: RTM_GETNETCONF: fix wrong return value

2016-03-03T23:07:07+00:00

[ Upstream commit a97eb33ff225f34a8124774b3373fd244f0e83ce ]

An error response from a RTM_GETNETCONF request can return the positive
error value EINVAL in the struct nlmsgerr that can mislead userspace.

Signed-off-by: Anton Protopopov 
Acked-by: Cong Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp/dccp: fix another race at listener dismantle

2016-03-03T23:07:07+00:00

[ Upstream commit 7716682cc58e305e22207d5bb315f26af6b1e243 ]

Ilya reported following lockdep splat:

kernel: =========================
kernel: [ BUG: held lock freed! ]
kernel: 4.5.0-rc1-ceph-00026-g5e0a311 #1 Not tainted
kernel: -------------------------
kernel: swapper/5/0 is freeing memory
ffff880035c9d200-ffff880035c9dbff, with a lock still held there!
kernel: (&(&queue->rskq_lock)->rlock){+.-...}, at:
[] inet_csk_reqsk_queue_add+0x28/0xa0
kernel: 4 locks held by swapper/5/0:
kernel: #0:  (rcu_read_lock){......}, at: []
netif_receive_skb_internal+0x4b/0x1f0
kernel: #1:  (rcu_read_lock){......}, at: []
ip_local_deliver_finish+0x3f/0x380
kernel: #2:  (slock-AF_INET){+.-...}, at: []
sk_clone_lock+0x19b/0x440
kernel: #3:  (&(&queue->rskq_lock)->rlock){+.-...}, at:
[] inet_csk_reqsk_queue_add+0x28/0xa0

To properly fix this issue, inet_csk_reqsk_queue_add() needs
to return to its callers if the child as been queued
into accept queue.

We also need to make sure listener is still there before
calling sk->sk_data_ready(), by holding a reference on it,
since the reference carried by the child can disappear as
soon as the child is put on accept queue.

Reported-by: Ilya Dryomov 
Fixes: ebb516af60e1 ("tcp/dccp: fix race at listener dismantle phase")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

route: check and remove route cache when we get route

2016-03-03T23:07:07+00:00

[ Upstream commit deed49df7390d5239024199e249190328f1651e7 ]

Since the gc of ipv4 route was removed, the route cached would has
no chance to be removed, and even it has been timeout, it still could
be used, cause no code to check it's expires.

Fix this issue by checking  and removing route cache when we get route.

Signed-off-by: Xin Long 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: md5: release request socket instead of listener

2016-03-03T23:07:06+00:00

[ Upstream commit 729235554d805c63e5e274fcc6a98e71015dd847 ]

If tcp_v4_inbound_md5_hash() returns an error, we must release
the refcount on the request socket, not on the listener.

The bug was added for IPv4 only.

Fixes: 079096f103fac ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ipv4: fix memory leaks in ip_cmsg_send() callers

2016-03-03T23:07:06+00:00

[ Upstream commit 919483096bfe75dda338e98d56da91a263746a0a ]

Dmitry reported memory leaks of IP options allocated in
ip_cmsg_send() when/if this function returns an error.

Callers are responsible for the freeing.

Many thanks to Dmitry for the report and diagnostic.

Reported-by: Dmitry Vyukov 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net:Add sysctl_max_skb_frags

2016-03-03T23:07:05+00:00

[ Upstream commit 5f74f82ea34c0da80ea0b49192bb5ea06e063593 ]

Devices may have limits on the number of fragments in an skb they support.
Current codebase uses a constant as maximum for number of fragments one
skb can hold and use.
When enabling scatter/gather and running traffic with many small messages
the codebase uses the maximum number of fragments and may thereby violate
the max for certain devices.
The patch introduces a global variable as max number of fragments.

Signed-off-by: Hans Westgaard Ry 
Reviewed-by: Håkon Bugge 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: do not drop syn_recv on all icmp reports

2016-03-03T23:07:05+00:00

[ Upstream commit 9cf7490360bf2c46a16b7525f899e4970c5fc144 ]

Petr Novopashenniy reported that ICMP redirects on SYN_RECV sockets
were leading to RST.

This is of course incorrect.

A specific list of ICMP messages should be able to drop a SYN_RECV.

For instance, a REDIRECT on SYN_RECV shall be ignored, as we do
not hold a dst per SYN_RECV pseudo request.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111751
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Reported-by: Petr Novopashenniy 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: beware of alignments in tcp_get_info()

2016-03-03T23:07:05+00:00

[ Upstream commit ff5d749772018602c47509bdc0093ff72acd82ec ]

With some combinations of user provided flags in netlink command,
it is possible to call tcp_get_info() with a buffer that is not 8-bytes
aligned.

It does matter on some arches, so we need to use put_unaligned() to
store the u64 fields.

Current iproute2 package does not trigger this particular issue.

Fixes: 0df48c26d841 ("tcp: add tcpi_bytes_acked to tcp_info")
Fixes: 977cb0ecf82e ("tcp: add pacing_rate information into tcp_info")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

inet: frag: Always orphan skbs inside ip_defrag()

2016-03-03T23:07:04+00:00

[ Upstream commit 8282f27449bf15548cb82c77b6e04ee0ab827bdc ]

Later parts of the stack (including fragmentation) expect that there is
never a socket attached to frag in a frag_list, however this invariant
was not enforced on all defrag paths. This could lead to the
BUG_ON(skb->sk) during ip_do_fragment(), as per the call stack at the
end of this commit message.

While the call could be added to openvswitch to fix this particular
error, the head and tail of the frags list are already orphaned
indirectly inside ip_defrag(), so it seems like the remaining fragments
should all be orphaned in all circumstances.

kernel BUG at net/ipv4/ip_output.c:586!
[...]
Call Trace:
 
 [] ? do_output.isra.29+0x1b0/0x1b0 [openvswitch]
 [] ovs_fragment+0xcc/0x214 [openvswitch]
 [] ? dst_discard_out+0x20/0x20
 [] ? dst_ifdown+0x80/0x80
 [] ? find_bucket.isra.2+0x62/0x70 [openvswitch]
 [] ? mod_timer_pending+0x65/0x210
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? nf_conntrack_in+0x252/0x500 [nf_conntrack]
 [] ? __lock_is_held+0x54/0x70
 [] do_output.isra.29+0xe3/0x1b0 [openvswitch]
 [] do_execute_actions+0xe11/0x11f0 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0x32/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0xb2/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? ovs_ct_get_labels+0x49/0x80 [openvswitch]
 [] ovs_vport_receive+0x5d/0xa0 [openvswitch]
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] internal_dev_xmit+0x6c/0x140 [openvswitch]
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] dev_hard_start_xmit+0x2b9/0x5e0
 [] ? netif_skb_features+0xd1/0x1f0
 [] __dev_queue_xmit+0x800/0x930
 [] ? __dev_queue_xmit+0x50/0x930
 [] ? mark_held_locks+0x71/0x90
 [] ? neigh_resolve_output+0x106/0x220
 [] dev_queue_xmit+0x10/0x20
 [] neigh_resolve_output+0x178/0x220
 [] ? ip_finish_output2+0x1ff/0x590
 [] ip_finish_output2+0x1ff/0x590
 [] ? ip_finish_output2+0x7e/0x590
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] icmp_push_reply+0xea/0x120
 [] icmp_reply.constprop.23+0x1ed/0x230
 [] icmp_echo.part.21+0x4e/0x50
 [] ? __lock_is_held+0x54/0x70
 [] ? rcu_read_lock_held+0x5e/0x70
 [] icmp_echo+0x36/0x70
 [] icmp_rcv+0x271/0x450
 [] ip_local_deliver_finish+0x127/0x3a0
 [] ? ip_local_deliver_finish+0x41/0x3a0
 [] ip_local_deliver+0x60/0xd0
 [] ? ip_rcv_finish+0x560/0x560
 [] ip_rcv_finish+0xdd/0x560
 [] ip_rcv+0x283/0x3e0
 [] ? match_held_lock+0x192/0x200
 [] ? inet_del_offload+0x40/0x40
 [] __netif_receive_skb_core+0x392/0xae0
 [] ? process_backlog+0x8e/0x230
 [] ? mark_held_locks+0x71/0x90
 [] __netif_receive_skb+0x18/0x60
 [] process_backlog+0x78/0x230
 [] ? process_backlog+0xdd/0x230
 [] net_rx_action+0x155/0x400
 [] __do_softirq+0xcc/0x420
 [] ? ip_finish_output2+0x217/0x590
 [] do_softirq_own_stack+0x1c/0x30
 
 [] do_softirq+0x4e/0x60
 [] __local_bh_enable_ip+0xa8/0xb0
 [] ip_finish_output2+0x240/0x590
 [] ? ip_do_fragment+0x831/0x8a0
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] raw_sendmsg+0x7d3/0xc30
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? inet_sendmsg+0xc7/0x1d0
 [] ? __lock_is_held+0x54/0x70
 [] inet_sendmsg+0x10a/0x1d0
 [] ? inet_sendmsg+0x5/0x1d0
 [] sock_sendmsg+0x38/0x50
 [] ___sys_sendmsg+0x25f/0x270
 [] ? handle_mm_fault+0x8dd/0x1320
 [] ? _raw_spin_unlock+0x27/0x40
 [] ? __do_page_fault+0x1e2/0x460
 [] ? __fget_light+0x66/0x90
 [] __sys_sendmsg+0x42/0x80
 [] SyS_sendmsg+0x12/0x20
 [] entry_SYSCALL_64_fastpath+0x12/0x6f
Code: 00 00 44 89 e0 e9 7c fb ff ff 4c 89 ff e8 e7 e7 ff ff 41 8b 9d 80 00 00 00 2b 5d d4 89 d8 c1 f8 03 0f b7 c0 e9 33 ff ff f
 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48
RIP  [] ip_do_fragment+0x892/0x8a0
 RSP 

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Signed-off-by: Joe Stringer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: fix NULL deref in tcp_v4_send_ack()

2016-03-03T23:07:04+00:00

[ Upstream commit e62a123b8ef7c5dc4db2c16383d506860ad21b47 ]

Neal reported crashes with this stack trace :

 RIP: 0010:[] tcp_v4_send_ack+0x41/0x20f
...
 CR2: 0000000000000018 CR3: 000000044005c000 CR4: 00000000001427e0
...
  [] tcp_v4_reqsk_send_ack+0xa5/0xb4
  [] tcp_check_req+0x2ea/0x3e0
  [] tcp_rcv_state_process+0x850/0x2500
  [] tcp_v4_do_rcv+0x141/0x330
  [] sk_backlog_rcv+0x21/0x30
  [] tcp_recvmsg+0x75d/0xf90
  [] inet_recvmsg+0x80/0xa0
  [] sock_aio_read+0xee/0x110
  [] do_sync_read+0x6f/0xa0
  [] SyS_read+0x1e1/0x290
  [] system_call_fastpath+0x16/0x1b

The problem here is the skb we provide to tcp_v4_send_ack() had to
be parked in the backlog of a new TCP fastopen child because this child
was owned by the user at the time an out of window packet arrived.

Before queuing a packet, TCP has to set skb->dev to NULL as the device
could disappear before packet is removed from the queue.

Fix this issue by using the net pointer provided by the socket (being a
timewait or a request socket).

IPv6 is immune to the bug : tcp_v6_send_response() already gets the net
pointer from the socket if provided.

Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
Reported-by: Neal Cardwell 
Signed-off-by: Eric Dumazet 
Cc: Jerry Chu 
Cc: Yuchung Cheng 
Acked-by: Neal Cardwell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman