Patch "net: add pfmemalloc check in sk_add_backlog()" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

net: add pfmemalloc check in sk_add_backlog()

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-add-pfmemalloc-check-in-sk_add_backlog.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Tue, 29 Sep 2015 18:52:25 -0700
Subject: net: add pfmemalloc check in sk_add_backlog()

From: Eric Dumazet <[email protected]>

[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ]

Greg reported crashes hitting the following check in __sk_backlog_rcv()

	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));

The pfmemalloc bit is currently checked in sk_filter().

This works correctly for TCP, because sk_filter() is ran in tcp_v[46]_rcv() before hitting the prequeue or backlog checks.

For UDP or other protocols, this does not work, because the sk_filter() is ran from sock_queue_rcv_skb(), which might be called _after_ backlog queuing if socket is owned by user by the time packet is processed by softirq handler.

---
 include/net/sock.h |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -826,6 +826,14 @@ static inline __must_check int sk_add_ba
 	if (sk_rcvqueues_full(sk, limit))
 		return -ENOBUFS;
 
+	/*
+	 * If the skb was allocated from pfmemalloc reserves, only
+	 * allow SOCK_MEMALLOC sockets to use it as this socket is
+	 * helping free memory
+	 */
+	if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC))
+		return -ENOMEM;
+
 	__sk_add_backlog(sk, skb);
 	sk->sk_backlog.len += skb->truesize;
 	return 0;

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/inet-fix-races-in-reqsk_queue_hash_req.patch queue-4.1/net-add-pfmemalloc-check-in-sk_add_backlog.patch queue-4.1/inet-fix-race-in-reqsk_queue_unlink.patch queue-4.1/net-unix-fix-logic-about-sk_peek_offset.patch queue-4.1/act_mirred-clear-sender-cpu-before-sending-to-tx.patch