[3.8.y.z extended stable] Patch "af_packet: block BH in prb_shutdown_retire_blk_timer()" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    af_packet: block BH in prb_shutdown_retire_blk_timer()

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.15.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 3492089a2a7acafbd85e260b9c33092342b80c86 Mon Sep 17 00:00:00 2001
From: Veaceslav Falico <vfalico at redhat.com>
Date: Fri, 29 Nov 2013 09:53:23 +0100
Subject: af_packet: block BH in prb_shutdown_retire_blk_timer()

[ Upstream commit ec6f809ff6f19fafba3212f6aff0dda71dfac8e8 ]

Currently we're using plain spin_lock() in prb_shutdown_retire_blk_timer(),
however the timer might fire right in the middle and thus try to re-aquire
the same spinlock, leaving us in a endless loop.

To fix that, use the spin_lock_bh() to block it.

Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
CC: "David S. Miller" <davem at davemloft.net>
CC: Daniel Borkmann <dborkman at redhat.com>
CC: Willem de Bruijn <willemb at google.com>
CC: Phil Sutter <phil at nwl.cc>
CC: Eric Dumazet <edumazet at google.com>
Reported-by: Jan Stancek <jstancek at redhat.com>
Tested-by: Jan Stancek <jstancek at redhat.com>
Signed-off-by: Veaceslav Falico <vfalico at redhat.com>
Acked-by: Daniel Borkmann <dborkman at redhat.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 net/packet/af_packet.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2d5b24a..90c1a21 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -390,9 +390,9 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po,

 	pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc;

-	spin_lock(&rb_queue->lock);
+	spin_lock_bh(&rb_queue->lock);
 	pkc->delete_blk_timer = 1;
-	spin_unlock(&rb_queue->lock);
+	spin_unlock_bh(&rb_queue->lock);

 	prb_del_retire_blk_timer(pkc);
 }
--
1.8.3.2