urel, added patch to fix dccp bug

3 files changed, 55 insertions, 4 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 8a7ac8d01358..0f2e544a8b7b 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,9 +1,9 @@
 # Generated by mksrcinfo v8
-# Wed Feb 22 18:44:58 UTC 2017
+# Wed Feb 22 18:56:40 UTC 2017
 pkgbase = linux-pf
 	pkgdesc = Linux kernel and modules with the pf-kernel patch [-ck patchset (BFS included), TuxOnIce, BFQ], uksm and aufs3
 	pkgver = 4.10.1
-	pkgrel = 1
+	pkgrel = 2
 	url = http://pf.natalenko.name/
 	arch = i686
 	arch = x86_64
@@ -25,6 +25,7 @@ pkgbase = linux-pf
 	source = uksm-4.9.patch::http://kerneldedup.org/download/uksm/0.1.2.5/uksm-0.1.2.5-for-4.9.1+.patch
 	source = 99-linux-pf.hook
 	source = 0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch
+	source = fix_dccp_freeing_skb_too_early.patch
 	sha256sums = 3c95d9f049bd085e5c346d2c77f063b8425f191460fcd3ae9fe7e94e0477dc4b
 	sha256sums = c5f788e83efcef4f0eb26e8aa3eceac1c2db9ca047e34cc37251fc4f0be63784
 	sha256sums = e15ef66afbe1448539aa9df56cca906c45abe514521ab80da06bffa45b2d365d
@@ -34,6 +35,7 @@ pkgbase = linux-pf
 	sha256sums = 91ae8ac0cd2086067e0ccac28d360d9ed0b3e845f584ff9af8e21e098db7bd72
 	sha256sums = df07e00e8581fe282a5b92be9ee9bb37910eae3d2cc43eeb41df736b9f531f02
 	sha256sums = 3e955e0f1aae96bb6c1507236adc952640c9bd0a134b9995ab92106a33dc02d9
+	sha256sums = f307c35625c0543d351d4f56bed1ec6726fd90b92b9c74b5bfd40ee77fd1946e
 
 pkgname = linux-pf
 	pkgdesc = Linux kernel and modules with the pf-kernel patch [-ck patchset (BFS included), TuxOnIce, BFQ] and aufs3
diff --git a/PKGBUILD b/PKGBUILD
index 69c0657008cd..3eca743f3a88 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -72,7 +72,7 @@ _BATCH_MODE=n
 pkgname=('linux-pf')
 true && pkgname=('linux-pf' 'linux-pf-headers' 'linux-pf-preset-default')
 pkgver=${_basekernel}.${_pfrel}
-pkgrel=1
+pkgrel=2
 arch=('i686' 'x86_64')
 url="http://pf.natalenko.name/"
 license=('GPL2')
@@ -86,6 +86,7 @@ source=("ftp://www.kernel.org/pub/linux/kernel/v${_major}.x/linux-${_basekernel}
         "uksm-4.9.patch"::"http://kerneldedup.org/download/uksm/0.1.2.5/uksm-0.1.2.5-for-4.9.1+.patch"
         "99-linux-pf.hook"
         '0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch'
+        'fix_dccp_freeing_skb_too_early.patch'
        )
 # 	'cx23885_move_CI_AC_registration_to_a_separate_function.patch'     
 
@@ -132,6 +133,7 @@ prepare() {
   # https://bugzilla.kernel.org/show_bug.cgi?id=190061
   patch -Rp1 -i "${srcdir}/0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch"
 
+  patch -Rp1 -i "$srcdir"/'fix_dccp_freeing_skb_too_early.patch'
   # end linux-ARCH patches
 
 
@@ -716,4 +718,5 @@ sha256sums=('3c95d9f049bd085e5c346d2c77f063b8425f191460fcd3ae9fe7e94e0477dc4b'
             'SKIP'
             '91ae8ac0cd2086067e0ccac28d360d9ed0b3e845f584ff9af8e21e098db7bd72'
             'df07e00e8581fe282a5b92be9ee9bb37910eae3d2cc43eeb41df736b9f531f02'
-            '3e955e0f1aae96bb6c1507236adc952640c9bd0a134b9995ab92106a33dc02d9')
+            '3e955e0f1aae96bb6c1507236adc952640c9bd0a134b9995ab92106a33dc02d9'
+            'f307c35625c0543d351d4f56bed1ec6726fd90b92b9c74b5bfd40ee77fd1946e')
diff --git a/fix_dccp_freeing_skb_too_early.patch b/fix_dccp_freeing_skb_too_early.patch
new file mode 100644
index 000000000000..c0ef7237b43e
--- /dev/null
+++ b/fix_dccp_freeing_skb_too_early.patch
@@ -0,0 +1,46 @@
+From 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Thu, 16 Feb 2017 17:22:46 +0100
+Subject: dccp: fix freeing skb too early for IPV6_RECVPKTINFO
+
+In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
+is forcibly freed via __kfree_skb in dccp_rcv_state_process if
+dccp_v6_conn_request successfully returns.
+
+However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
+is saved to ireq->pktopts and the ref count for skb is incremented in
+dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
+in dccp_rcv_state_process.
+
+Fix by calling consume_skb instead of doing goto discard and therefore
+calling __kfree_skb.
+
+Similar fixes for TCP:
+
+fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
+0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
+simply consumed
+
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dccp/input.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/dccp/input.c b/net/dccp/input.c
+index ba34718..8fedc2d 100644
+--- a/net/dccp/input.c
++++ b/net/dccp/input.c
+@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
+ 								    skb) < 0)
+ 				return 1;
+-			goto discard;
++			consume_skb(skb);
++			return 0;
+ 		}
+ 		if (dh->dccph_type == DCCP_PKT_RESET)
+ 			goto discard;
+-- 
+cgit v0.12