-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
patches/openwrt: Kernel 5.10: update to version 5.10.176
- Loading branch information
Showing
2 changed files
with
2 additions
and
106 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -41803,110 +41803,6 @@ index 0000000000..429b24f0f3 | |
+ {}, | ||
+ }; | ||
+ | ||
diff --git a/target/linux/generic/backport-5.10/804-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch b/target/linux/generic/backport-5.10/804-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch | ||
new file mode 100644 | ||
index 0000000000..74c01ec5a5 | ||
--- /dev/null | ||
+++ b/target/linux/generic/backport-5.10/804-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch | ||
@@ -0,0 +1,98 @@ | ||
+From 35cd2598c910ad6a1cc8bd3f731429b1901abc63 Mon Sep 17 00:00:00 2001 | ||
+From: Kuniyuki Iwashima <[email protected]> | ||
+Date: Mon, 27 Feb 2023 13:15:48 -0800 | ||
+Subject: [PATCH] net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from | ||
+ sk_stream_kill_queues(). | ||
+ | ||
+commit 62ec33b44e0f7168ff2886520fec6fb62d03b5a3 upstream. | ||
+ | ||
+Christoph Paasch reported that commit b5fc29233d28 ("inet6: Remove | ||
+inet6_destroy_sock() in sk->sk_prot->destroy().") started triggering | ||
+WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues(). [0 - 2] | ||
+Also, we can reproduce it by a program in [3]. | ||
+ | ||
+In the commit, we delay freeing ipv6_pinfo.pktoptions from sk->destroy() | ||
+to sk->sk_destruct(), so sk->sk_forward_alloc is no longer zero in | ||
+inet_csk_destroy_sock(). | ||
+ | ||
+The same check has been in inet_sock_destruct() from at least v2.6, | ||
+we can just remove the WARN_ON_ONCE(). However, among the users of | ||
+sk_stream_kill_queues(), only CAIF is not calling inet_sock_destruct(). | ||
+Thus, we add the same WARN_ON_ONCE() to caif_sock_destructor(). | ||
+ | ||
+[0]: https://lore.kernel.org/netdev/[email protected]/ | ||
+[1]: https://github.com/multipath-tcp/mptcp_net-next/issues/341 | ||
+[2]: | ||
+WARNING: CPU: 0 PID: 3232 at net/core/stream.c:212 sk_stream_kill_queues+0x2f9/0x3e0 | ||
+Modules linked in: | ||
+CPU: 0 PID: 3232 Comm: syz-executor.0 Not tainted 6.2.0-rc5ab24eb4698afbe147b424149c529e2a43ec24eb5 #2 | ||
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 | ||
+RIP: 0010:sk_stream_kill_queues+0x2f9/0x3e0 | ||
+Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 08 01 00 00 e9 60 ff ff ff e8 d0 5f b6 fe 0f 0b eb 97 e8 c7 5f b6 fe <0f> 0b eb a0 e8 be 5f b6 fe 0f 0b e9 6a fe ff ff e8 02 07 e3 fe e9 | ||
+RSP: 0018:ffff88810570fc68 EFLAGS: 00010293 | ||
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 | ||
+RDX: ffff888101f38f40 RSI: ffffffff8285e529 RDI: 0000000000000005 | ||
+RBP: 0000000000000ce0 R08: 0000000000000005 R09: 0000000000000000 | ||
+R10: 0000000000000ce0 R11: 0000000000000001 R12: ffff8881009e9488 | ||
+R13: ffffffff84af2cc0 R14: 0000000000000000 R15: ffff8881009e9458 | ||
+FS: 00007f7fdfbd5800(0000) GS:ffff88811b600000(0000) knlGS:0000000000000000 | ||
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | ||
+CR2: 0000001b32923000 CR3: 00000001062fc006 CR4: 0000000000170ef0 | ||
+Call Trace: | ||
+ <TASK> | ||
+ inet_csk_destroy_sock+0x1a1/0x320 | ||
+ __tcp_close+0xab6/0xe90 | ||
+ tcp_close+0x30/0xc0 | ||
+ inet_release+0xe9/0x1f0 | ||
+ inet6_release+0x4c/0x70 | ||
+ __sock_release+0xd2/0x280 | ||
+ sock_close+0x15/0x20 | ||
+ __fput+0x252/0xa20 | ||
+ task_work_run+0x169/0x250 | ||
+ exit_to_user_mode_prepare+0x113/0x120 | ||
+ syscall_exit_to_user_mode+0x1d/0x40 | ||
+ do_syscall_64+0x48/0x90 | ||
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc | ||
+RIP: 0033:0x7f7fdf7ae28d | ||
+Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 | ||
+RSP: 002b:00000000007dfbb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 | ||
+RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7fdf7ae28d | ||
+RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 | ||
+RBP: 0000000000000000 R08: 000000007f338e0f R09: 0000000000000e0f | ||
+R10: 000000007f338e13 R11: 0000000000000293 R12: 00007f7fdefff000 | ||
+R13: 00007f7fdefffcd8 R14: 00007f7fdefffce0 R15: 00007f7fdefffcd8 | ||
+ </TASK> | ||
+ | ||
+[3]: https://lore.kernel.org/netdev/[email protected]/ | ||
+ | ||
+Fixes: b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().") | ||
+Reported-by: syzbot <[email protected]> | ||
+Reported-by: Christoph Paasch <[email protected]> | ||
+Signed-off-by: Kuniyuki Iwashima <[email protected]> | ||
+Reviewed-by: Eric Dumazet <[email protected]> | ||
+Signed-off-by: Jakub Kicinski <[email protected]> | ||
+--- | ||
+ net/caif/caif_socket.c | 1 + | ||
+ net/core/stream.c | 1 - | ||
+ 2 files changed, 1 insertion(+), 1 deletion(-) | ||
+ | ||
+--- a/net/caif/caif_socket.c | ||
++++ b/net/caif/caif_socket.c | ||
+@@ -1020,6 +1020,7 @@ static void caif_sock_destructor(struct | ||
+ return; | ||
+ } | ||
+ sk_stream_kill_queues(&cf_sk->sk); | ||
++ WARN_ON(sk->sk_forward_alloc); | ||
+ caif_free_client(&cf_sk->layer); | ||
+ } | ||
+ | ||
+--- a/net/core/stream.c | ||
++++ b/net/core/stream.c | ||
+@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock * | ||
+ sk_mem_reclaim(sk); | ||
+ | ||
+ WARN_ON(sk->sk_wmem_queued); | ||
+- WARN_ON(sk->sk_forward_alloc); | ||
+ | ||
+ /* It is _impossible_ for the backlog to contain anything | ||
+ * when we get here. All user references to this socket | ||
diff --git a/target/linux/generic/backport-5.10/810-v5.13-usb-ehci-add-spurious-flag-to-disable-overcurrent-ch.patch b/target/linux/generic/backport-5.10/810-v5.13-usb-ehci-add-spurious-flag-to-disable-overcurrent-ch.patch | ||
new file mode 100644 | ||
index 0000000000..6b75b08717 | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters