[packages/kernel/LINUX_4_1] - rel 3; fix 'cpu stuck' on iptables actions regression

[arekm]

commit 2854fab4497a090ad8e18fb5f1856212ec30416a
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Jul 20 12:22:12 2016 +0200

    - rel 3; fix 'cpu stuck' on iptables actions regression

 kernel-small_fixes.patch | 112 +++++++++++++++++++++++++++++++++++++++++++++++
 kernel.spec              |   2 +-
 2 files changed, 113 insertions(+), 1 deletion(-)
---
diff --git a/kernel.spec b/kernel.spec
index c259f59..4f834a6 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -68,7 +68,7 @@
 %define		have_pcmcia	0
 %endif
 
-%define		rel		2
+%define		rel		3
 %define		basever		4.1
 %define		postver		.28
 
diff --git a/kernel-small_fixes.patch b/kernel-small_fixes.patch
index dfb9bbd..b2dd245 100644
--- a/kernel-small_fixes.patch
+++ b/kernel-small_fixes.patch
@@ -127,3 +127,115 @@ cgit v0.11.2
  		__pagevec_lru_add(pvec);
  	put_cpu_var(lru_add_pvec);
  }
+From patchwork Tue Jul 19 11:07:16 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [stable-4.1,v2] netfilter: x_tables: fix stable backport
+From: =?utf-8?q?Michal_Kube=C4=8Dek?= <mkubecek at suse.cz>
+X-Patchwork-Id: 650120
+X-Patchwork-Delegate: davem at davemloft.net
+Message-Id: <20160719110716.C5910A0EB7 at unicorn.suse.cz>
+To: Sasha Levin <sasha.levin at oracle.com>
+Cc: stable at vger.kernel.org, netfilter-devel at vger.kernel.org,
+ netdev at vger.kernel.org, Florian Westphal <fw at strlen.de>,
+ Takashi Iwai <tiwai at suse.de>
+Date: Tue, 19 Jul 2016 13:07:16 +0200 (CEST)
+
+Stable-4.1 backport of mainline commit 364723410175 ("netfilter:
+x_tables: validate targets of jumps") doesn't handle correctly the fact
+that 4.1 kernel is missing commit 482cfc318559 ("netfilter: xtables:
+avoid percpu ruleset duplication") so that t->entries is still a per-cpu
+array in find_jump_target().
+
+Use the same fix as e.g. stable-3.14 backport.
+
+Fixes: 8163327a3a92 ("netfilter: x_tables: validate targets of jumps")
+Signed-off-by: Michal Kubecek <mkubecek at suse.cz>
+---
+ net/ipv4/netfilter/arp_tables.c | 5 +++--
+ net/ipv4/netfilter/ip_tables.c  | 5 +++--
+ net/ipv6/netfilter/ip6_tables.c | 5 +++--
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 2953ee9e5fa0..49e145640ee7 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -363,11 +363,12 @@ static inline bool unconditional(const struct arpt_entry *e)
+ }
+ 
+ static bool find_jump_target(const struct xt_table_info *t,
++			     const void *entry0,
+ 			     const struct arpt_entry *target)
+ {
+ 	struct arpt_entry *iter;
+ 
+-	xt_entry_foreach(iter, t->entries, t->size) {
++	xt_entry_foreach(iter, entry0, t->size) {
+ 		 if (iter == target)
+ 			return true;
+ 	}
+@@ -469,7 +470,7 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
+ 						 pos, newpos);
+ 					e = (struct arpt_entry *)
+ 						(entry0 + newpos);
+-					if (!find_jump_target(newinfo, e))
++					if (!find_jump_target(newinfo, entry0, e))
+ 						return 0;
+ 				} else {
+ 					/* ... this is a fallthru */
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 3bcf28bf1525..52a883645899 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -439,11 +439,12 @@ ipt_do_table(struct sk_buff *skb,
+ }
+ 
+ static bool find_jump_target(const struct xt_table_info *t,
++			     const void *entry0,
+ 			     const struct ipt_entry *target)
+ {
+ 	struct ipt_entry *iter;
+ 
+-	xt_entry_foreach(iter, t->entries, t->size) {
++	xt_entry_foreach(iter, entry0, t->size) {
+ 		 if (iter == target)
+ 			return true;
+ 	}
+@@ -549,7 +550,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ 						 pos, newpos);
+ 					e = (struct ipt_entry *)
+ 						(entry0 + newpos);
+-					if (!find_jump_target(newinfo, e))
++					if (!find_jump_target(newinfo, entry0, e))
+ 						return 0;
+ 				} else {
+ 					/* ... this is a fallthru */
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 5254d76dfce8..b77bf6dab70c 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -452,11 +452,12 @@ ip6t_do_table(struct sk_buff *skb,
+ }
+ 
+ static bool find_jump_target(const struct xt_table_info *t,
++			     const void *entry0,
+ 			     const struct ip6t_entry *target)
+ {
+ 	struct ip6t_entry *iter;
+ 
+-	xt_entry_foreach(iter, t->entries, t->size) {
++	xt_entry_foreach(iter, entry0, t->size) {
+ 		 if (iter == target)
+ 			return true;
+ 	}
+@@ -562,7 +563,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
+ 						 pos, newpos);
+ 					e = (struct ip6t_entry *)
+ 						(entry0 + newpos);
+-					if (!find_jump_target(newinfo, e))
++					if (!find_jump_target(newinfo, entry0, e))
+ 						return 0;
+ 				} else {
+ 					/* ... this is a fallthru */
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/kernel.git/commitdiff/2854fab4497a090ad8e18fb5f1856212ec30416a