rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Linux v4.1.12

This commit is contained in:
Josh Boyer 2015-10-27 09:46:45 -04:00
parent 5de68c70f1
commit 50776ace1e
3 changed files with 5 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
inet-fix-race-in-reqsk_queue_unlink.patch
View File

@ -1,63 +0,0 @@
From 8f6a05588928ef61e751ca3cb008b9847fb6b83d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 1 Oct 2015 05:39:26 -0700
Subject: [PATCH] inet: fix race in reqsk_queue_unlink()
reqsk_timer_handler() tests if icsk_accept_queue.listen_opt
is NULL at its beginning.
By the time it calls inet_csk_reqsk_queue_drop() and
reqsk_queue_unlink(), listener might have been closed and
inet_csk_listen_stop() had called reqsk_queue_yank_acceptq()
which sets icsk_accept_queue.listen_opt to NULL
We therefore need to correctly check listen_opt being NULL
after holding syn_wait_lock for proper synchronization.
Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer")
Fixes: b357a364c57c ("inet: fix possible panic in reqsk_queue_unlink()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
---
net/ipv4/inet_connection_sock.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index e664706b350c..37c8b45af44b 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -568,21 +568,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack);
static bool reqsk_queue_unlink(struct request_sock_queue *queue,
struct request_sock *req)
{
- struct listen_sock *lopt = queue->listen_opt;
struct request_sock **prev;
+ struct listen_sock *lopt;
bool found = false;
spin_lock(&queue->syn_wait_lock);
-
- for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
- prev = &(*prev)->dl_next) {
- if (*prev == req) {
- *prev = req->dl_next;
- found = true;
- break;
+ lopt = queue->listen_opt;
+ if (lopt) {
+ for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
+ prev = &(*prev)->dl_next) {
+ if (*prev == req) {
+ *prev = req->dl_next;
+ found = true;
+ break;
+ }
}
}
-
spin_unlock(&queue->syn_wait_lock);
if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
reqsk_put(req);
--
2.4.3

11
kernel.spec
View File

@ -54,7 +54,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 11
%define stable_update 12
# Set rpm version accordingly
%if 0%{?stable_update}
%define stablerev %{stable_update}
@ -650,9 +650,6 @@ Patch518: drm-vmwgfx-Allow-dropped-masters-render-node-like-ac.patch
#CVE-2015-6937 rhbz 1263139 1263140
Patch523: RDS-verify-the-underlying-transport-exists-before-cr.patch
#rhbz 1266691
Patch535: inet-fix-race-in-reqsk_queue_unlink.patch
#rhbz 1265978
Patch536: si2168-Bounds-check-firmware.patch
Patch537: si2157-Bounds-check-firmware.patch
@ -1420,9 +1417,6 @@ ApplyPatch drm-vmwgfx-Allow-dropped-masters-render-node-like-ac.patch
#CVE-2015-6937 rhbz 1263139 1263140
ApplyPatch RDS-verify-the-underlying-transport-exists-before-cr.patch
#rhbz 1266691
ApplyPatch inet-fix-race-in-reqsk_queue_unlink.patch
#rhbz 1265978
ApplyPatch si2168-Bounds-check-firmware.patch
ApplyPatch si2157-Bounds-check-firmware.patch
@ -2293,6 +2287,9 @@ fi
# ||----w |
# || ||
%changelog
* Tue Oct 27 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.1.12
- Linux v4.1.12
* Fri Oct 23 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.1.11
- Linux v4.1.11

2
sources
View File

@ -1,3 +1,3 @@
fe9dc0f6729f36400ea81aa41d614c37 linux-4.1.tar.xz
5b4d0e18c713a479a7b4c1aa53a7432b perf-man-4.1.tar.gz
46a403b167416719901565190298e680 patch-4.1.11.xz
e790ae84e0109a3d95cc617be448171b patch-4.1.12.xz