This is a note to let you know that I've just added the patch titled ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipv6-do-not-abuse-gfp_atomic-in-inet6_netconf_notify_devconf.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 927265bc6cd6374c9bafc43408ece4e92311b149 Mon Sep 17 00:00:00 2001 From: Eric Dumazet <edumazet@xxxxxxxxxx> Date: Fri, 8 Jul 2016 05:46:04 +0200 Subject: ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() From: Eric Dumazet <edumazet@xxxxxxxxxx> commit 927265bc6cd6374c9bafc43408ece4e92311b149 upstream. All inet6_netconf_notify_devconf() callers are in process context, so we can use GFP_KERNEL allocations if we take care of not holding a rwlock while not needed in ip6mr (we hold RTNL there) Fixes: d67b8c616b48 ("netconf: advertise mc_forwarding status") Fixes: f3a1bfb11ccb ("rtnl/ipv6: use netconf msg to advertise forwarding status") Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Cc: Nicolas Dichtel <nicolas.dichtel@xxxxxxxxx> Acked-by: Nicolas Dichtel <nicolas.dichtel@xxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ipv6/addrconf.c | 4 ++-- net/ipv6/ip6mr.c | 13 +++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -540,7 +540,7 @@ void inet6_netconf_notify_devconf(struct struct sk_buff *skb; int err = -ENOBUFS; - skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_ATOMIC); + skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_KERNEL); if (!skb) goto errout; @@ -552,7 +552,7 @@ void inet6_netconf_notify_devconf(struct kfree_skb(skb); goto errout; } - rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_ATOMIC); + rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_KERNEL); return; errout: rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err); --- a/net/ipv6/ip6mr.c +++ b/net/ipv6/ip6mr.c @@ -1594,14 +1594,15 @@ static int ip6mr_sk_init(struct mr6_tabl if (likely(mrt->mroute6_sk == NULL)) { mrt->mroute6_sk = sk; net->ipv6.devconf_all->mc_forwarding++; - inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING, - NETCONFA_IFINDEX_ALL, - net->ipv6.devconf_all); - } - else + } else { err = -EADDRINUSE; + } write_unlock_bh(&mrt_lock); + if (!err) + inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING, + NETCONFA_IFINDEX_ALL, + net->ipv6.devconf_all); rtnl_unlock(); return err; @@ -1619,11 +1620,11 @@ int ip6mr_sk_done(struct sock *sk) write_lock_bh(&mrt_lock); mrt->mroute6_sk = NULL; net->ipv6.devconf_all->mc_forwarding--; + write_unlock_bh(&mrt_lock); inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING, NETCONFA_IFINDEX_ALL, net->ipv6.devconf_all); - write_unlock_bh(&mrt_lock); mroute_clean_tables(mrt, false); err = 0; Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are queue-4.4/bonding-prevent-out-of-bound-accesses.patch queue-4.4/ipv4-do-not-abuse-gfp_atomic-in-inet_netconf_notify_devconf.patch queue-4.4/net-get-rid-of-an-signed-integer-overflow-in-ip_idents_reserve.patch queue-4.4/ipv4-accept-u8-in-ip_tos-ancillary-data.patch queue-4.4/ipv6-do-not-abuse-gfp_atomic-in-inet6_netconf_notify_devconf.patch queue-4.4/udp-restore-udplite-many-cast-delivery.patch queue-4.4/ipv4-fix-memory-leak-in-exception-case-for-splitting-tries.patch queue-4.4/tcp-do-not-set-rtt_min-to-1.patch