This is a note to let you know that I've just added the patch titled
netpoll: Fix missing TXQ unlock and and OOPS.
to the 3.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netpoll-fix-missing-txq-unlock-and-and-oops.patch
and it can be found in the queue-3.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Mon Jan 13 09:44:41 PST 2014
From: "David S. Miller" <davem@xxxxxxxxxxxxx>
Date: Thu, 2 Jan 2014 19:50:52 -0500
Subject: netpoll: Fix missing TXQ unlock and and OOPS.
From: "David S. Miller" <davem@xxxxxxxxxxxxx>
[ Upstream commit aca5f58f9ba803ec8c2e6bcf890db17589e8dfcc ]
The VLAN tag handling code in netpoll_send_skb_on_dev() has two problems.
1) It exits without unlocking the TXQ.
2) It then tries to queue a NULL skb to npinfo->txq.
Reported-by: Ahmed Tamrawi <atamrawi@xxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/core/netpoll.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -386,8 +386,14 @@ void netpoll_send_skb_on_dev(struct netp
!vlan_hw_offload_capable(netif_skb_features(skb),
skb->vlan_proto)) {
skb = __vlan_put_tag(skb, skb->vlan_proto, vlan_tx_tag_get(skb));
- if (unlikely(!skb))
- break;
+ if (unlikely(!skb)) {
+ /* This is actually a packet drop, but we
+ * don't want the code at the end of this
+ * function to try and re-queue a NULL skb.
+ */
+ status = NETDEV_TX_OK;
+ goto unlock_txq;
+ }
skb->vlan_tci = 0;
}
@@ -395,6 +401,7 @@ void netpoll_send_skb_on_dev(struct netp
if (status == NETDEV_TX_OK)
txq_trans_update(txq);
}
+ unlock_txq:
__netif_tx_unlock(txq);
if (status == NETDEV_TX_OK)
Patches currently in stable-queue which might be from davem@xxxxxxxxxxxxx are
queue-3.12/ipv6-don-t-count-addrconf-generated-routes-against-gc-limit.patch
queue-3.12/drivers-net-hamradio-integer-overflow-in-hdlcdrv_ioctl.patch
queue-3.12/macvtap-update-file-current-position.patch
queue-3.12/sfc-refactor-efx_mcdi_poll-by-introducing-efx_mcdi_poll_once.patch
queue-3.12/sfc-poll-for-mcdi-completion-once-before-timeout-occurs.patch
queue-3.12/ipv4-fix-tunneled-vm-traffic-over-hw-vxlan-gre-gso-nic.patch
queue-3.12/net-unix-allow-set_peek_off-to-fail.patch
queue-3.12/vlan-fix-header-ops-passthru-when-doing-tx-vlan-offload.patch
queue-3.12/sfc-stop-re-start-ptp-when-stopping-starting-the-datapath.patch
queue-3.12/ipv6-always-set-the-new-created-dst-s-from-in-ip6_rt_copy.patch
queue-3.12/netvsc-don-t-flush-peers-notifying-work-during-setting-mtu.patch
queue-3.12/net-clear-local_df-when-passing-skb-between-namespaces.patch
queue-3.12/net-do-not-pretend-fraglist-support.patch
queue-3.12/sfc-rx-buffer-allocation-takes-prefix-size-into-account-in-ip-header-alignment.patch
queue-3.12/macvtap-signal-truncated-packets.patch
queue-3.12/net-rose-restore-old-recvmsg-behavior.patch
queue-3.12/sfc-add-length-checks-to-efx_xmit_with_hwtstamp-and-efx_ptp_is_ptp_tx.patch
queue-3.12/arc_emac-fix-potential-use-after-free.patch
queue-3.12/net-inet_diag-zero-out-uninitialized-idiag_-src-dst-fields.patch
queue-3.12/sfc-ptp-moderate-log-message-on-event-queue-overflow.patch
queue-3.12/virtio_net-fix-error-handling-for-mergeable-buffers.patch
queue-3.12/vxlan-release-rt-when-found-circular-route.patch
queue-3.12/sfc-rate-limit-log-message-for-ptp-packets-without-a-matching-timestamp-event.patch
queue-3.12/packet-fix-send-path-when-running-with-proto-0.patch
queue-3.12/tg3-initialize-reg_base_addr-at-pci-config-offset-120-to-0.patch
queue-3.12/net-drop_monitor-fix-the-value-of-maxattr.patch
queue-3.12/tun-unbreak-truncated-packet-signalling.patch
queue-3.12/virtio-net-make-all-rx-paths-handle-errors.patch
queue-3.12/net-unix-allow-bind-to-fail-on-mutex-lock.patch
queue-3.12/macvtap-do-not-double-count-received-packets.patch
queue-3.12/hamradio-yam-fix-info-leak-in-ioctl.patch
queue-3.12/br-fix-use-of-rx_handler_data-in-code-executed-on-non-rx_handler-path.patch
queue-3.12/netpoll-fix-missing-txq-unlock-and-and-oops.patch
queue-3.12/inet-fix-null-pointer-oops-in-fib-6-_rule_suppress.patch
queue-3.12/tun-update-file-current-position.patch
queue-3.12/ipv6-fix-illegal-mac_header-comparison-on-32bit.patch
queue-3.12/ip_gre-fix-msg_name-parsing-for-recvfrom-recvmsg.patch
queue-3.12/bridge-use-spin_lock_bh-in-br_multicast_set_hash_max.patch
queue-3.12/virtio-net-fix-refill-races-during-restore.patch
queue-3.12/virtio_net-don-t-leak-memory-or-block-when-too-many-frags.patch
queue-3.12/virtio-delete-napi-structures-from-netdev-before-releasing-memory.patch
queue-3.12/net-llc-fix-use-after-free-in-llc_ui_recvmsg.patch
queue-3.12/sfc-maintain-current-frequency-adjustment-when-applying-a-time-offset.patch
queue-3.12/net-fec-fix-potential-use-after-free.patch
queue-3.12/rds-prevent-dereference-of-a-null-device.patch
queue-3.12/rds-prevent-bug_on-triggered-on-congestion-update-to-loopback.patch
queue-3.12/ipv6-fixed-support-for-blackhole-and-prohibit-routes.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html