mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-06 03:45:24 -04:00
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Martin KaFai Lau
|
a26e10aa1c |
UPSTREAM: tcp: bpf: Add TCP_BPF_RTO_MIN for bpf_setsockopt
This patch adds bpf_setsockopt(TCP_BPF_RTO_MIN) to allow bpf prog to set the min rto of a connection. It could be used together with the earlier patch which has added bpf_setsockopt(TCP_BPF_DELACK_MAX). A later selftest patch will communicate the max delay ack in a bpf tcp header option and then the receiving side can use bpf_setsockopt(TCP_BPF_RTO_MIN) to set a shorter rto. Change-Id: Ifd2e4b1660283ba7f582d1894c8ffd9a12817fac Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190027.2884170-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
9768c9f10c |
UPSTREAM: tcp: bpf: Add TCP_BPF_DELACK_MAX setsockopt
This change is mostly from an internal patch and adapts it from sysctl config to the bpf_setsockopt setup. The bpf_prog can set the max delay ack by using bpf_setsockopt(TCP_BPF_DELACK_MAX). This max delay ack can be communicated to its peer through bpf header option. The receiving peer can then use this max delay ack and set a potentially lower rto by using bpf_setsockopt(TCP_BPF_RTO_MIN) which will be introduced in the next patch. Another later selftest patch will also use it like the above to show how to write and parse bpf tcp header option. Change-Id: Ia2591a16e948ced059df4b1e1447360e7aab9e0f Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190021.2884000-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
65c272f187 |
BACKPORT: tcp: Use a struct to represent a saved_syn
The TCP_SAVE_SYN has both the network header and tcp header. The total length of the saved syn packet is currently stored in the first 4 bytes (u32) of an array and the actual packet data is stored after that. A later patch will add a bpf helper that allows to get the tcp header alone from the saved syn without the network header. It will be more convenient to have a direct offset to a specific header instead of re-parsing it. This requires to separately store the network hdrlen. The total header length (i.e. network + tcp) is still needed for the current usage in getsockopt. Although this total length can be obtained by looking into the tcphdr and then get the (th->doff << 2), this patch chooses to directly store the tcp hdrlen in the second four bytes of this newly created "struct saved_syn". By using a new struct, it can give a readable name to each individual header length. Change-Id: I4ba88ba12fed185f61c74c01b4eaf7f09d26299b Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190014.2883694-1-kafai@fb.com |
||
Eric W. Biederman
|
44b60b7791 |
UPSTREAM: umd: Track user space drivers with struct pid
Use struct pid instead of user space pid values that are prone to wrap araound. In addition track the entire thread group instead of just the first thread that is started by exec. There are no multi-threaded user mode drivers today but there is nothing preclucing user drivers from being multi-threaded, so it is just a good idea to track the entire process. Take a reference count on the tgid's in question to make it possible to remove exit_umh in a future change. As a struct pid is available directly use kill_pid_info. The prior process signalling code was iffy in using a userspace pid known to be in the initial pid namespace and then looking up it's task in whatever the current pid namespace is. It worked only because kernel threads always run in the initial pid namespace. As the tgid is now refcounted verify the tgid is NULL at the start of fork_usermode_driver to avoid the possibility of silent pid leaks. v1: https://lkml.kernel.org/r/87mu4qdlv2.fsf_-_@x220.int.ebiederm.org v2: https://lkml.kernel.org/r/a70l4oy8.fsf_-_@x220.int.ebiederm.org Link: https://lkml.kernel.org/r/20200702164140.4468-12-ebiederm@xmission.com Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Tested-by: Alexei Starovoitov <ast@kernel.org> Change-Id: Ie626e056191a897a5d3a68d9f37245cc5142aa28 Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> |
||
|
Eric W. Biederman
|
80bb03b9d8 |
UPSTREAM: umd: Rename umd_info.cmdline umd_info.driver_name
The only thing supplied in the cmdline today is the driver name so rename the field to clarify the code. As this value is always supplied stop trying to handle the case of a NULL cmdline. Additionally since we now have a name we can count on use the driver_name any place where the code is looking for a name of the binary. v1: https://lkml.kernel.org/r/87imfef0k3.fsf_-_@x220.int.ebiederm.org v2: https://lkml.kernel.org/r/87366d63os.fsf_-_@x220.int.ebiederm.org Link: https://lkml.kernel.org/r/20200702164140.4468-7-ebiederm@xmission.com Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Tested-by: Alexei Starovoitov <ast@kernel.org> Change-Id: I216f8480957694d82fef6aa6a2d6f738d483dde1 Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> |
||
|
Eric W. Biederman
|
7022f69e2c |
UPSTREAM: umd: For clarity rename umh_info umd_info
This structure is only used for user mode drivers so change the prefix from umh to umd to make that clear. v1: https://lkml.kernel.org/r/87o8p6f0kw.fsf_-_@x220.int.ebiederm.org v2: https://lkml.kernel.org/r/878sg563po.fsf_-_@x220.int.ebiederm.org Link: https://lkml.kernel.org/r/20200702164140.4468-6-ebiederm@xmission.com Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Tested-by: Alexei Starovoitov <ast@kernel.org> Change-Id: I1187a8f998a41ac165abfdc8d3629531ed0dd9b0 Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> |
||
Jakub Kicinski
|
2b19312f62 |
BACKPORT: udp_tunnel: add central NIC RX port offload infrastructure
Cater to devices which: (a) may want to sleep in the callbacks; (b) only have IPv4 support; (c) need all the programming to happen while the netdev is up. Drivers attach UDP tunnel offload info struct to their netdevs, where they declare how many UDP ports of various tunnel types they support. Core takes care of tracking which ports to offload. Use a fixed-size array since this matches what almost all drivers do, and avoids a complexity and uncertainty around memory allocations in an atomic context. Make sure that tunnel drivers don't try to replay the ports when new NIC netdev is registered. Automatic replays would mess up reference counting, and will be removed completely once all drivers are converted. v4: - use a #define NULL to avoid build issues with CONFIG_INET=n. Change-Id: I1e704ed5de90fb40f7e9091f08a69e4f7432bd05 Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Yonghong Song
|
ccd34e4b58 |
UPSTREAM: bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t
This patch refactored target bpf_iter_init_seq_priv_t callback function to accept additional information. This will be needed in later patches for map element targets since a particular map should be passed to traverse elements for that particular map. In the future, other information may be passed to target as well, e.g., pid, cgroup id, etc. to customize the iterator. Change-Id: I3676c634f448874f4d6f12b2199915972a158d10 Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200723184110.590156-1-yhs@fb.com |
||
|
Yonghong Song
|
ecc4d9f640 |
UPSTREAM: bpf: Refactor bpf_iter_reg to have separate seq_info member
There is no functionality change for this patch. Struct bpf_iter_reg is used to register a bpf_iter target, which includes information for both prog_load, link_create and seq_file creation. This patch puts fields related seq_file creation into a different structure. This will be useful for map elements iterator where one iterator covers different map types and different map types may have different seq_ops, init/fini private_data function and private_data size. Change-Id: I2577d77f6b6be71319457720547ba77cff04c68b Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200723184109.590030-1-yhs@fb.com |
||
|
Yonghong Song
|
6be51943c7 |
UPSTREAM: bpf: net: Use precomputed btf_id for bpf iterators
One additional field btf_id is added to struct bpf_ctx_arg_aux to store the precomputed btf_ids. The btf_id is computed at build time with BTF_ID_LIST or BTF_ID_LIST_GLOBAL macro definitions. All existing bpf iterators are changed to used pre-compute btf_ids. Change-Id: I1cb3532f3c31b426f279ed17e092e311649d54e1 Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200720163403.1393551-1-yhs@fb.com |
||
|
Yonghong Song
|
0d692dd8f9 |
UPSTREAM: net: bpf: Implement bpf iterator for udp
The bpf iterator for udp is implemented. Both udp4 and udp6 sockets will be traversed. It is up to bpf program to filter for udp4 or udp6 only, or both families of sockets. Change-Id: I05176138b99a0ad5a9d3829ca0480bc0bed33cbc Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200623230813.3988404-1-yhs@fb.com |
||
|
Yonghong Song
|
dc0e88fef3 |
UPSTREAM: net: bpf: Add bpf_seq_afinfo in udp_iter_state
Similar to tcp_iter_state, a new field bpf_seq_afinfo is
added to udp_iter_state to provide bpf udp iterator
afinfo.
This does not change /proc/net/{udp, udp6} behavior. But
it enables bpf iterator to avoid get afinfo from PDE_DATA
and iterate through all udp and udp6 sockets in one pass.
Change-Id: I75e4639ec944f57ce0f05c2b4a4d728f69aa806f
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200623230812.3988347-1-yhs@fb.com
|
||
|
Yonghong Song
|
cd47c63227 |
UPSTREAM: net: bpf: Implement bpf iterator for tcp
The bpf iterator for tcp is implemented. Both tcp4 and tcp6 sockets will be traversed. It is up to bpf program to filter for tcp4 or tcp6 only, or both families of sockets. Change-Id: Ibc3bd9081feb4c6b8a30dfa5002aa3c6aaa7f6ce Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200623230805.3987959-1-yhs@fb.com |
||
|
Yonghong Song
|
b02622b77e |
UPSTREAM: net: bpf: Add bpf_seq_afinfo in tcp_iter_state
A new field bpf_seq_afinfo is added to tcp_iter_state
to provide bpf tcp iterator afinfo. There are two
reasons on why we did this.
First, the current way to get afinfo from PDE_DATA
does not work for bpf iterator as its seq_file
inode does not conform to /proc/net/{tcp,tcp6}
inode structures. More specifically, anonymous
bpf iterator will use an anonymous inode which
is shared in the system and we cannot change inode
private data structure at all.
Second, bpf iterator for tcp/tcp6 wants to
traverse all tcp and tcp6 sockets in one pass
and bpf program can control whether they want
to skip one sk_family or not. Having a different
afinfo with family AF_UNSPEC make it easier
to understand in the code.
This patch does not change /proc/net/{tcp,tcp6} behavior
as the bpf_seq_afinfo will be NULL for these two proc files.
Change-Id: I6bc5c311247e884bf76c8d133bf9b820706a1ce0
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200623230804.3987829-1-yhs@fb.com
|
||
Stanislav Fomichev
|
48d917f089 |
UPSTREAM: bpf: Add BPF_CGROUP_INET_SOCK_RELEASE hook
Sometimes it's handy to know when the socket gets freed. In particular, we'd like to try to use a smarter allocation of ports for bpf_bind and explore the possibility of limiting the number of SOCK_DGRAM sockets the process can have. Implement BPF_CGROUP_INET_SOCK_RELEASE hook that triggers on inet socket release. It triggers only for userspace sockets (not in-kernel ones) and therefore has the same semantics as the existing BPF_CGROUP_INET_SOCK_CREATE. Change-Id: If57133e0fdbd3906b4335dd68b0be887397d2364 Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/20200706230128.4073544-2-sdf@google.com |
||
Dmitry Yakunin
|
bb6c2b3f3e |
BACKPORT: tcp: Expose tcp_sock_set_keepidle_locked
This is preparation for usage in bpf_setsockopt. v2: - remove redundant EXPORT_SYMBOL (Alexei Starovoitov) Change-Id: Ie696e9bcc4d92c21210e07cdc35cfb9acb48303c Signed-off-by: Dmitry Yakunin <zeil@yandex-team.ru> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200620153052.9439-2-zeil@yandex-team.ru |
||
Christoph Hellwig
|
259e678a87 |
BACKPORT: tcp: add tcp_sock_set_keepidle
Add a helper to directly set the TCP_KEEP_IDLE sockopt from kernel space without going through a fake uaccess. Change-Id: I57286ea8efb618476bac4d8d74f16e01b17e12aa Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Ferenc Fejes
|
7d942dce7e |
BACKPORT: net: Make locking in sock_bindtoindex optional
The sock_bindtoindex intended for kernel wide usage however it will lock the socket regardless of the context. This modification relax this behavior optionally: locking the socket will be optional by calling the sock_bindtoindex with lock_sk = true. The modification applied to all users of the sock_bindtoindex. Change-Id: I9dc573d405527847ceeaa8d5d04f0c90fb5ab874 Signed-off-by: Ferenc Fejes <fejes@inf.elte.hu> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/bee6355da40d9e991b2f2d12b67d55ebb5f5b207.1590871065.git.fejes@inf.elte.hu |
||
|
Christoph Hellwig
|
c1aa7dc417 |
BACKPORT: net: add sock_bindtoindex
Add a helper to directly set the SO_BINDTOIFINDEX sockopt from kernel space without going through a fake uaccess. Change-Id: I6cf5767101ed908276085f7f54c0b1dc1437b6a3 Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Daniel Borkmann
|
72906343f2 |
UPSTREAM: bpf: Add get{peer, sock}name attach types for sock_addr
As stated in
|
||
|
Stanislav Fomichev
|
bf3c1fa865 |
UPSTREAM: bpf: Allow any port in bpf_bind helper
We want to have a tighter control on what ports we bind to in
the BPF_CGROUP_INET{4,6}_CONNECT hooks even if it means
connect() becomes slightly more expensive. The expensive part
comes from the fact that we now need to call inet_csk_get_port()
that verifies that the port is not used and allocates an entry
in the hash table for it.
Since we can't rely on "snum || !bind_address_no_port" to prevent
us from calling POST_BIND hook anymore, let's add another bind flag
to indicate that the call site is BPF program.
v5:
* fix wrong AF_INET (should be AF_INET6) in the bpf program for v6
v3:
* More bpf_bind documentation refinements (Martin KaFai Lau)
* Add UDP tests as well (Martin KaFai Lau)
* Don't start the thread, just do socket+bind+listen (Martin KaFai Lau)
v2:
* Update documentation (Andrey Ignatov)
* Pass BIND_FORCE_ADDRESS_NO_PORT conditionally (Andrey Ignatov)
Change-Id: Ia0d7052ae78cb82da3a0a7eea21afef9b174d26e
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrey Ignatov <rdna@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200508174611.228805-5-sdf@google.com
|
||
|
Stanislav Fomichev
|
cce1ba71f9 |
UPSTREAM: net: Refactor arguments of inet{,6}_bind
The intent is to add an additional bind parameter in the next commit. Instead of adding another argument, let's convert all existing flag arguments into an extendable bit field. No functional changes. Change-Id: I8b335adaa4989d837131f6307605cd90b7c98c8b Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrey Ignatov <rdna@fb.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200508174611.228805-4-sdf@google.com |
||
|
Christoph Hellwig
|
97a739c638 |
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
Instead of having all the sysctl handlers deal with user pointers, which is rather hairy in terms of the BPF interaction, copy the input to and from userspace in common code. This also means that the strings are always NUL-terminated by the common code, making the API a little bit safer. As most handler just pass through the data to one of the common handlers a lot of the changes are mechnical. Change-Id: Ib7ad5ec475ea28257d651bdea23a4026a268c576 Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Andrey Ignatov <rdna@fb.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> |
||
Joe Stringer
|
f59a02f5cb |
UPSTREAM: net: Track socket refcounts in skb_steal_sock()
Refactor the UDP/TCP handlers slightly to allow skb_steal_sock() to make the determination of whether the socket is reference counted in the case where it is prefetched by earlier logic such as early_demux. Change-Id: I19305f2f853f5f310811fb63580e76653c207ae0 Signed-off-by: Joe Stringer <joe@wand.net.nz> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200329225342.16317-3-joe@wand.net.nz |
||
|
Joe Stringer
|
9974c2cee8 |
BACKPORT: bpf: Add socket assign support
Add support for TPROXY via a new bpf helper, bpf_sk_assign(). This helper requires the BPF program to discover the socket via a call to bpf_sk*_lookup_*(), then pass this socket to the new helper. The helper takes its own reference to the socket in addition to any existing reference that may or may not currently be obtained for the duration of BPF processing. For the destination socket to receive the traffic, the traffic must be routed towards that socket via local route. The simplest example route is below, but in practice you may want to route traffic more narrowly (eg by CIDR): $ ip route add local default dev lo This patch avoids trying to introduce an extra bit into the skb->sk, as that would require more invasive changes to all code interacting with the socket to ensure that the bit is handled correctly, such as all error-handling cases along the path from the helper in BPF through to the orphan path in the input. Instead, we opt to use the destructor variable to switch on the prefetch of the socket. Change-Id: I66c9fce30fea682d2acaa741a6bbd46857083ed2 Signed-off-by: Joe Stringer <joe@wand.net.nz> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200329225342.16317-2-joe@wand.net.nz |
||
|
Martin KaFai Lau
|
5816ee7d64 |
UPSTREAM: bpf: Sanitize the bpf_struct_ops tcp-cc name
The bpf_struct_ops tcp-cc name should be sanitized in order to
avoid problematic chars (e.g. whitespaces).
This patch reuses the bpf_obj_name_cpy() for accepting the same set
of characters in order to keep a consistent bpf programming experience.
A "size" param is added. Also, the strlen is returned on success so
that the caller (like the bpf_tcp_ca here) can error out on empty name.
The existing callers of the bpf_obj_name_cpy() only need to change the
testing statement to "if (err < 0)". For all these existing callers,
the err will be overwritten later, so no extra change is needed
for the new strlen return value.
v3:
- reverse xmas tree style
v2:
- Save the orig_src to avoid "end - size" (Andrii)
Fixes: 0baf26b0fcd7 ("bpf: tcp: Support tcp_congestion_ops in bpf")
Change-Id: I5f1d0bad34d94e4ced7338af2bd828329e95fc90
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200314010209.1131542-1-kafai@fb.com
|
||
Lorenz Bauer
|
0802a05ee7 |
BACKPORT: bpf: sockmap: Move generic sockmap hooks from BPF TCP
The init, close and unhash handlers from TCP sockmap are generic, and can be reused by UDP sockmap. Move the helpers into the sockmap code base and expose them. This requires tcp_bpf_get_proto and tcp_bpf_clone to be conditional on BPF_STREAM_PARSER. The moved functions are unmodified, except that sk_psock_unlink is renamed to sock_map_unlink to better match its behaviour. Change-Id: I54a6692b3e357efc09dedf1a6a55724c844aea74 Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200309111243.6982-6-lmb@cloudflare.com |
||
Jakub Sitnicki
|
9966fdca23 |
UPSTREAM: tcp_bpf: Don't let child socket inherit parent protocol ops on copy
Prepare for cloning listening sockets that have their protocol callbacks overridden by sk_msg. Child sockets must not inherit parent callbacks that access state stored in sk_user_data owned by the parent. Restore the child socket protocol callbacks before it gets hashed and any of the callbacks can get invoked. Change-Id: I239c944c5b4943f7df2372894ea0810a6e9ec842 Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200218171023.844439-4-jakub@cloudflare.com |
||
|
Lorenz Bauer
|
358105e502 |
UPSTREAM: bpf: tcp: Move assertions into tcp_bpf_get_proto
We need to ensure that sk->sk_prot uses certain callbacks, so that code that directly calls e.g. tcp_sendmsg in certain corner cases works. To avoid spurious asserts, we must to do this only if sk_psock_update_proto has not yet been called. The same invariants apply for tcp_bpf_check_v6_needs_rebuild, so move the call as well. Doing so allows us to merge tcp_bpf_init and tcp_bpf_reinit. Change-Id: I4d38830ddf6296c583240bdd478e21285b49b27f Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200309111243.6982-4-lmb@cloudflare.com |
||
|
Lorenz Bauer
|
6aa78c8885 |
UPSTREAM: skmsg: Update saved hooks only once
Only update psock->saved_* if psock->sk_proto has not been initialized yet. This allows us to get rid of tcp_bpf_reinit_sk_prot. Change-Id: Idda8683c7abf3106adeca0cde9c94161f78c4a79 Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200309111243.6982-3-lmb@cloudflare.com |
||
|
Jakub Sitnicki
|
b309b36d0d |
UPSTREAM: net, sk_msg: Annotate lockless access to sk_prot on clone
sk_msg and ULP frameworks override protocol callbacks pointer in
sk->sk_prot, while tcp accesses it locklessly when cloning the listening
socket, that is with neither sk_lock nor sk_callback_lock held.
Once we enable use of listening sockets with sockmap (and hence sk_msg),
there will be shared access to sk->sk_prot if socket is getting cloned
while being inserted/deleted to/from the sockmap from another CPU:
Read side:
tcp_v4_rcv
sk = __inet_lookup_skb(...)
tcp_check_req(sk)
inet_csk(sk)->icsk_af_ops->syn_recv_sock
tcp_v4_syn_recv_sock
tcp_create_openreq_child
inet_csk_clone_lock
sk_clone_lock
READ_ONCE(sk->sk_prot)
Write side:
sock_map_ops->map_update_elem
sock_map_update_elem
sock_map_update_common
sock_map_link_no_progs
tcp_bpf_init
tcp_bpf_update_sk_prot
sk_psock_update_proto
WRITE_ONCE(sk->sk_prot, ops)
sock_map_ops->map_delete_elem
sock_map_delete_elem
__sock_map_delete
sock_map_unref
sk_psock_put
sk_psock_drop
sk_psock_restore_proto
tcp_update_ulp
WRITE_ONCE(sk->sk_prot, proto)
Mark the shared access with READ_ONCE/WRITE_ONCE annotations.
Change-Id: I167c4a1f5fc7254ebfcebe3475d26a6854431a29
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20200218171023.844439-2-jakub@cloudflare.com
|
||
|
Martin KaFai Lau
|
b042559ba9 |
BACKPORT: bpf: Add BPF_FUNC_tcp_send_ack helper
Add a helper to send out a tcp-ack. It will be used in the later bpf_dctcp implementation that requires to send out an ack when the CE state changed. Change-Id: Iebba1f612c4bef7d11c4aea61d65bbd905208666 Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20200109004551.3900448-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
a382bdd3a6 |
UPSTREAM: bpf: tcp: Support tcp_congestion_ops in bpf
This patch makes "struct tcp_congestion_ops" to be the first user of BPF STRUCT_OPS. It allows implementing a tcp_congestion_ops in bpf. The BPF implemented tcp_congestion_ops can be used like regular kernel tcp-cc through sysctl and setsockopt. e.g. [root@arch-fb-vm1 bpf]# sysctl -a | egrep congestion net.ipv4.tcp_allowed_congestion_control = reno cubic bpf_cubic net.ipv4.tcp_available_congestion_control = reno bic cubic bpf_cubic net.ipv4.tcp_congestion_control = bpf_cubic There has been attempt to move the TCP CC to the user space (e.g. CCP in TCP). The common arguments are faster turn around, get away from long-tail kernel versions in production...etc, which are legit points. BPF has been the continuous effort to join both kernel and userspace upsides together (e.g. XDP to gain the performance advantage without bypassing the kernel). The recent BPF advancements (in particular BTF-aware verifier, BPF trampoline, BPF CO-RE...) made implementing kernel struct ops (e.g. tcp cc) possible in BPF. It allows a faster turnaround for testing algorithm in the production while leveraging the existing (and continue growing) BPF feature/framework instead of building one specifically for userspace TCP CC. This patch allows write access to a few fields in tcp-sock (in bpf_tcp_ca_btf_struct_access()). The optional "get_info" is unsupported now. It can be added later. One possible way is to output the info with a btf-id to describe the content. Change-Id: I73c741f15ec5418c21d95977025185d6fa79bb1b Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20200109003508.3856115-1-kafai@fb.com |
||
basamaryan
|
612434f5cc |
tcp: Fix compiler error due to type confusion
tcp_tso_should_defer() used the min() macro on incompatible types (u64 vs long)
error: comparison of distinct pointer types
('typeof (srtt_in_ns >> 1) *' (aka 'unsigned long long *')
and 'typeof (1000000L) *' (aka 'long *'))
Fix this up by using min_t to ensure the comparison is performed as
unsigned 64-bit integers
Fixes:
|
||
|
basamaryan
|
9181ada660 |
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common: Linux 5.4.302 Input: pegasus-notetaker - fix potential out-of-bounds access Input: remove third argument of usb_maxpacket() usb: deprecate the third argument of usb_maxpacket() ata: libata-scsi: Fix system suspend for a security locked drive fs/proc: fix uaf in proc_readdir_de() pmdomain: imx: Fix reference count leak in imx_gpc_remove pmdomain: arm: scmi: Fix genpd leak on provider registration failure net: netpoll: fix incorrect refcount handling causing incorrect cleanup net: qede: Initialize qede_ll_ops with designated initializer uio_hv_generic: Set event for all channels on the device net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error ALSA: usb-audio: fix uac2 clock source at terminal parser mm/page_alloc: fix hash table order logging in alloc_large_system_hash() kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup vsock: Ignore signal/timeout on connect() if already established s390/ctcm: Fix double-kfree net: openvswitch: remove never-working support for setting nsh fields mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() MIPS: Malta: Fix !EVA SOC-it PCI MMIO scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() scsi: sg: Do not sleep in atomic context Input: cros_ec_keyb - fix an invalid memory access be2net: pass wrb_params in case of OS2BMC HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection EDAC/altera: Handle OCRAM ECC enable after warm reset spi: Try to get ACPI GPIO IRQ earlier ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe strparser: Fix signed/unsigned mismatch bug gcov: add support for GCC 15 mm/ksm: fix flag-dropping behavior in ksm_madvise ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE ASoC: cs4271: Fix regulator leak on probe failure regulator: fixed: fix GPIO descriptor leak on register failure regulator: fixed: use dev_err_probe for register Bluetooth: L2CAP: export l2cap_chan_hold for modules net_sched: limit try_bulk_dequeue_skb() batches net_sched: remove need_resched() from qdisc_run() net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps net/mlx5e: Fix maxrate wraparound in threshold between units net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak wifi: mac80211: skip rate verification for not captured PSDUs net: mdio: fix resource leak in mdiobus_register_device() tipc: Fix use-after-free in tipc_mon_reinit_self(). tipc: simplify the finalize work queue sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto sctp: get netns from asoc and ep base Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF net: fec: correct rx_bytes statistic for the case SHIFT16 is set ASoC: max98090/91: fixed max98091 ALSA widget powering up/down HID: quirks: avoid Cooler Master MM712 dongle wakeup bug NFS4: Fix state renewals missing after boot compiler_types: Move unused static inline functions warning to W=2 extcon: adc-jack: Cleanup wakeup source only if it was enabled tracing: Fix memory leaks in create_field_var() net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup sctp: Prevent TOCTOU out-of-bounds write sctp: Hold RCU read lock while iterating over address list net: dsa: b53: stop reading ARL entries if search is done net: dsa: b53: fix enabling ip multicast net: dsa: b53: fix resetting speed and pause on forced link net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 net: dsa/b53: change b53_force_port_config() pause argument net: vlan: sync VLAN features with lower device ceph: add checking of wait_for_completion_killable() return value fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds ACPI: property: Return present device nodes only on fwnode interface 9p: sysfs_init: don't hardcode error to ENOMEM 9p: fix /sys/fs/9p/caches overwriting itself fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink ACPICA: Update dsmethod.c to get rid of unused variable warning orangefs: fix xattr related buffer overflow... page_pool: Clamp pool size to max 16K pages Bluetooth: bcsp: receive data only if registered Bluetooth: SCO: Fix UAF on sco_conn_free net: macb: avoid dealing with endianness in macb_set_hwaddr() nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing NFSv4.1: fix mount hang after CREATE_SESSION failure NFSv4: handle ERR_GRACE on delegation recalls remoteproc: qcom: q6v5: Avoid handling handover twice sparc/module: Add R_SPARC_UA64 relocation handling net: intel: fm10k: Fix parameter idx set but not used jfs: fix uninitialized waitqueue in transaction manager jfs: Verify inode mode when loading from disk ipv6: np->rxpmtu race annotation usb: xhci: plat: Facilitate using autosuspend for xhci plat devices usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs allow finish_no_open(file, ERR_PTR(-E...)) scsi: lpfc: Define size of debugfs entry for xri rebalancing scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency net/cls_cgroup: Fix task_get_classid() during qdisc run selftests: Replace sleep with slowwait selftests: Disable dad for ipv6 in fcnal-test.sh media: redrat3: use int type to store negative error codes net: sh_eth: Disable WoL if system can not suspend phy: cadence: cdns-dphy: Enable lower resolutions in dphy usb: gadget: f_hid: Fix zero length packet transfer net: call cond_resched() less often in __release_sock() ALSA: usb-audio: apply quirk for MOONDROP Quark2 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: sh: setup_xref error handling scsi: pm8001: Use int instead of u32 to store error codes mips: lantiq: xway: sysctrl: rename stp clock mips: lantiq: danube: add missing device_type in pci node mips: lantiq: danube: add missing properties to cpu node media: fix uninitialized symbol warnings drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption extcon: adc-jack: Fix wakeup source leaks on device unbind rds: Fix endianness annotation for RDS_MPATH_HASH PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. net: When removing nexthops, don't call synchronize_net if it is not necessary char: misc: Does not request module for miscdevice with dynamic minor usb: gadget: f_ncm: Fix MAC assignment NCM ethernet iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register media: imon: make send_packet() more robust net: ipv6: fix field-spanning memcpy warning in AH output bridge: Redirect to backup port when port is administratively down powerpc/eeh: Use result of error_detected() in uevent x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall media: pci: ivtv: Don't create fake v4l2_fh drm/amdkfd: return -ENOTTY for unsupported IOCTLs selftests/net: Ensure assert() triggers in psock_tpacket.c selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 PCI: Disable MSI on RDC PCI to PCIe bridges drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() mfd: madera: Work around false-positive -Wininitialized warning mfd: stmpe-i2c: Add missing MODULE_LICENSE mfd: stmpe: Remove IRQ domain upon removal tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: Enhance HWP enable tools/cpupower: Fix incorrect size in cpuidle_state_disable() hwmon: (dell-smm) Add support for Dell OptiPlex 7040 uprobe: Do not emulate/sstep original instruction when ip is changed clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel video: backlight: lp855x_bl: Set correct EPROM start for LP8556 tee: allow a driver to allocate a tee_device without a pool ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment arc: Fix __fls() const-foldability via __builtin_clzl() cpufreq/longhaul: handle NULL policy in longhaul_exit selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 ACPI: video: force native for Lenovo 82K8 memstick: Add timeout to prevent indefinite waiting mmc: host: renesas_sdhi: Fix the actual clock bpf: Don't use %pK through printk spi: loopback-test: Don't use %pK through printk soc: qcom: smem: Fix endian-unaware access of num_entries usb: gadget: f_fs: Fix epfile null pointer access after ep enable. serial: 8250_dw: handle reset control deassert error serial: 8250_dw: Use devm_add_action_or_reset() serial: 8250_dw: Use devm_clk_get_optional() to get the input clock can: gs_usb: increase max interface to U8_MAX devcoredump: Fix circular locking dependency with devcd->mutex. net: ravb: Enforce descriptor type ordering x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode net: phy: dp83867: Disable EEE support as not implemented regmap: slimbus: fix bus_context pointer in regmap init calls drm/etnaviv: fix flush sequence logic usbnet: Prevents free active kevent wifi: ath10k: Fix memory leak on unsupported WMI command ASoC: qdsp6: q6asm: do not sleep while atomic fbdev: valkyriefb: Fix reference count leak in valkyriefb_init fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: bitblit: bound-check glyph index in bit_putcs* ACPI: video: Fix use-after-free in acpi_video_switch_brightness() fbdev: atyfb: Check if pll_ops->init_pll failed net: usb: asix_devices: Check return value of usbnet_get_endpoints btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() x86/bugs: Fix reporting of LFENCE retpoline net/sched: sch_qfq: Fix null-deref in agg_dequeue Conflicts: drivers/mmc/host/sdhci-msm.c drivers/usb/host/xhci-plat.c Change-Id: I30739fea8840ace3825ea8955598d9efa687bb27 |
||
Michael Bestas
|
350c4ccfe1 |
Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-12-01 CVE-2025-48623 CVE-2025-48624 CVE-2025-48637 CVE-2025-48638 CVE-2024-35970 CVE-2025-38236 CVE-2025-38349 CVE-2025-48610 CVE-2025-38500 * tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common: UPSTREAM: crypto: essiv - Check ssize for decryption and in-place encryption ANDROID: GKI: fix up build break where timer_delete_sync() was used Revert "net: rtnetlink: remove redundant assignment to variable err" Revert "net: rtnetlink: add msg kind names" Revert "net: rtnetlink: add helper to extract msg type's kind" Revert "net: rtnetlink: use BIT for flag values" Revert "net: netlink: add NLM_F_BULK delete request modifier" Revert "net: rtnetlink: add bulk delete support flag" Revert "net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg" Revert "net: add ndo_fdb_del_bulk" Revert "net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del" Revert "rtnetlink: Allow deleting FDB entries in user namespace" Linux 5.4.301 net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg media: s5p-mfc: remove an unused/uninitialized variable NFSD: Fix last write offset handling in layoutcommit NFSD: Minor cleanup in layoutcommit processing padata: Reset next CPU when reorder sequence wraps around KEYS: trusted_tpm1: Compare HMAC values in constant time NFSD: Define a proc_layoutcommit for the FlexFiles layout type vfs: Don't leak disconnected dentries on umount jbd2: ensure that all ongoing I/O complete before freeing blocks ext4: detect invalid INLINE_DATA + EXTENTS flag combination drm/amdgpu: use atomic functions with memory barriers for vm fault info ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() spi: cadence-quadspi: Flush posted register writes before DAC access spi: cadence-quadspi: Flush posted register writes before INDAC access memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe memory: samsung: exynos-srom: Correct alignment arm64: errata: Apply workarounds for Neoverse-V3AE arm64: cputype: Add Neoverse-V3AE definitions comedi: fix divide-by-zero in comedi_buf_munge() binder: remove "invalid inc weak" check xhci: dbc: enable back DbC in resume if it was enabled before suspend usb/core/quirks: Add Huawei ME906S to wakeup quirk USB: serial: option: add Telit FN920C04 ECM compositions USB: serial: option: add Quectel RG255C USB: serial: option: add UNISOC UIS7720 net: ravb: Ensure memory write completes before ringing TX doorbell net: usb: rtl8150: Fix frame padding ocfs2: clear extent cache after moving/defragmenting extents MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering Revert "cpuidle: menu: Avoid discarding useful information" net: bonding: fix possible peer notify event loss or dup issue sctp: avoid NULL dereference when chunk data buffer is missing arm64, mm: avoid always making PTE dirty in pte_mkwrite() net: enetc: correct the value of ENETC_RXB_TRUESIZE rtnetlink: Allow deleting FDB entries in user namespace net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del net: add ndo_fdb_del_bulk net: rtnetlink: add bulk delete support flag net: netlink: add NLM_F_BULK delete request modifier net: rtnetlink: use BIT for flag values net: rtnetlink: add helper to extract msg type's kind net: rtnetlink: add msg kind names net: rtnetlink: remove redundant assignment to variable err m68k: bitops: Fix find_*_bit() signatures hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() dlm: check for defined force value in dlm_lockspace_release hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() hfs: validate record offset in hfsplus_bmap_alloc hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() hfs: make proper initalization of struct hfs_find_data hfs: clear offset and space out of valid records in b-tree node exec: Fix incorrect type for ret hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings sched/fair: Fix pelt lost idle time detection sched/balancing: Rename newidle_balance() => sched_balance_newidle() sched/fair: Trivial correction of the newidle_balance() comment sched: Make newidle_balance() static again tls: don't rely on tx_work during send() tls: always set record_type in tls_process_cmsg tg3: prevent use of uninitialized remote_adv and local_adv variables tcp: fix tcp_tso_should_defer() vs large RTT amd-xgbe: Avoid spurious link down messages during interface toggle net/ip6_tunnel: Prevent perpetual tunnel growth net: dlink: handle dma_map_single() failure properly net: dl2k: switch from 'pci_' to 'dma_' API media: pci: ivtv: Add missing check after DMA map media: pci/ivtv: switch from 'pci_' to 'dma_' API xen/events: Update virq_to_irq on migration media: lirc: Fix error handling in lirc_register() media: rc: Directly use ida_free() drm/exynos: exynos7_drm_decon: remove ctx->suspended btrfs: avoid potential out-of-bounds in btrfs_encode_fh() pwm: berlin: Fix wrong register in suspend/resume media: cx18: Add missing check after DMA map xen/events: Cleanup find_virq() return codes cramfs: Verify inode mode when loading from disk fs: Add 'initramfs_options' to set initramfs mount options pid: Add a judgment for ns null in pid_nr_ns minixfs: Verify inode mode when loading from disk tracing: Fix race condition in kprobe initialization causing NULL pointer dereference dm: fix NULL pointer dereference in __dm_suspend() mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value Squashfs: reject negative file sizes in squashfs_read_inode() Squashfs: add additional inode sanity checking media: mc: Clear minor number before put device mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() fs: udf: fix OOB read in lengthAllocDescs handling KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O net/9p: fix double req put in p9_fd_cancelled ext4: guard against EA inode refcount underflow in xattr update ext4: correctly handle queries for metadata mappings ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() nfsd: nfserr_jukebox in nlm_fopen should lead to a retry x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) x86/umip: Check that the instruction opcode is at least two bytes PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit PCI/AER: Fix missing uevent on recovery when a reset is requested PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV rseq/selftests: Use weak symbol reference, not definition, to link with glibc rtc: interface: Fix long-standing race when setting alarm rtc: interface: Ensure alarm irq is enabled when UIE is enabled mmc: core: SPI mode remove cmd7 mtd: rawnand: fsmc: Default to autodetect buswidth sparc: fix error handling in scan_one_device() sparc64: fix hugetlb for sun4u sctp: Fix MAC comparison to be constant-time scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() parisc: don't reference obsolete termio struct for TC* constants lib/genalloc: fix device leak in of_gen_pool_get() iio: frequency: adf4350: Fix prescaler usage. iio: dac: ad5421: use int type to store negative error codes iio: dac: ad5360: use int type to store negative error codes crypto: atmel - Fix dma_unmap_sg() direction cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() drm/nouveau: fix bad ret code in nouveau_bo_move_prep media: i2c: mt9v111: fix incorrect type for ret firmware: meson_sm: fix device leak at probe xen/manage: Fix suspend error path arm64: dts: qcom: msm8916: Add missing MDSS reset ACPI: debug: fix signedness issues in read/write helpers ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single tpm, tpm_tis: Claim locality before writing interrupt registers crypto: essiv - Check ssize for decryption and in-place encryption mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call tools build: Align warning options with perf net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() drm/vmwgfx: Fix Use-after-free in validation net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() scsi: mvsas: Fix use-after-free bugs in mvs_work_queue scsi: mvsas: Use sas_task_find_rq() for tagging scsi: mvsas: Delete mvs_tag_init() scsi: libsas: Add sas_task_find_rq() clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() perf session: Fix handling when buffer exceeds 2 GiB rtc: x1205: Fix Xicor X1205 vendor prefix perf util: Fix compression checks returning -1 as bool iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE clocksource/drivers/clps711x: Fix resource leaks in error paths pinctrl: check the return value of pinmux_ops::get_function_name() Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak mm: hugetlb: avoid soft lockup when mprotect to large memory area uio_hv_generic: Let userspace take care of interrupt mask Squashfs: fix uninit-value in squashfs_get_parent Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable nfp: fix RSS hash key size when RSS is not supported drivers/base/node: fix double free in register_one_node() ocfs2: fix double free in user_cluster_connect() net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast RDMA/siw: Always report immediate post SQ errors usb: vhci-hcd: Prevent suspending virtually attached devices scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() ipvs: Defer ip_vs_ftp unregister during netns cleanup NFSv4.1: fix backchannel max_resp_sz verification check remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice sparc: fix accurate exception reporting in copy_{from,to}_user for M7 sparc: fix accurate exception reporting in copy_to_user for Niagara 4 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC IB/sa: Fix sa_local_svc_timeout_ms read race RDMA/core: Resolve MAC of next-hop device without ARP support wifi: mt76: fix potential memory leak in mt76_wmac_probe() drivers/base/node: handle error properly in register_one_node() watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog netfilter: ipset: Remove unused htable_bits in macro ahash_region iio: consumers: Fix offset handling in iio_convert_raw_to_processed() ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping pps: fix warning in pps_register_cdev when register device fail misc: genwqe: Fix incorrect cmd field being reported in error usb: gadget: configfs: Correctly set use_os_string at bind usb: phy: twl6030: Fix incorrect type for ret tcp: fix __tcp_close() to only send RST when required PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation wifi: mwifiex: send world regulatory domain to driver ALSA: lx_core: use int type to store negative error codes media: rj54n1cb0c: Fix memleak in rj54n1_probe() scsi: myrs: Fix dma_alloc_coherent() error check scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod serial: max310x: Add error checking in probe() usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup drm/radeon/r600_cs: clean up of dead code in r600_cs i2c: designware: Add disabling clocks when probe fails i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD bpf: Explicitly check accesses to bpf_sock_addr selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported pwm: tiehrpwm: Fix corner case in clock divisor calculation block: use int to store blk_stack_limits() return value blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx pinctrl: meson-gxl: add missing i2c_d pinmux soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS ACPI: processor: idle: Fix memory leak when register cpuidle device failed regmap: Remove superfluous check for !config in __regmap_init() x86/vdso: Fix output operand size of RDPID perf: arm_spe: Prevent overflow in PERF_IDX2OFF() driver core/PM: Set power.no_callbacks along with power.no_pm staging: axis-fifo: flush RX FIFO on read errors staging: axis-fifo: fix maximum TX packet length check perf subcmd: avoid crash in exclude_cmds when excludes is empty dm-integrity: limit MAX_TAG_SIZE to 255 wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 USB: serial: option: add SIMCom 8230C compositions media: rc: fix races with imon_disconnect() media: imon: grab lock earlier in imon_ir_change_protocol() media: imon: reorganize serialization media: rc: Add support for another iMON 0xffdc device media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe media: tuner: xc5000: Fix use-after-free in xc5000_release media: tunner: xc5000: Refactor firmware load udp: Fix memory accounting leak. media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove scsi: target: target_core_configfs: Add length check to avoid buffer overflow Conflicts: drivers/soc/qcom/rpmh-rsc.c kernel/sched/fair.c Change-Id: I58ab24a3db8be4c698c41fd47daeb1f1fb7884ee |
||
Greg Kroah-Hartman
|
ca00e0f525 |
This is the 5.4.302 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkwI4sACgkQONu9yGCS aT46Mg//f9a0IiDkO2ybqt7JAStVCkQ5MM2CgPjlgHGyns6hWyxUES5twrVrTO0v mdYmeXLztyFSArUHMnoWcUK1O4IVUVK32SX3eEMFy81ojX+LpYm/m5TZg3tU1rvq jaTE0i6ihmwG48ciB63i28TxQfhY8QuVJTEV400Ro+ILY2hs1l6c6DYf9i0S/v4g gKDQpzuwR0AnGNFI+D6D6D0D8jbLVcBYnAndyvDrLYTIILczf7nJ66ZePYTBvlg3 rIiIMjG0BX0V2ctPmez3mz0BDTpnZY4pwIwIG8K/bX4UZrgOKJPSZWh1SzbASaGN vTJQwRs9nGHvM/kK9CUUsi1+hhaAl7UmQEiRJ06BkXlR7chFCcL/fI/VEQjf12wL dyw6/RR/rXPxLbLxCYk+9C9ANTE/ByirLKSeJkNT/yoeiCSpaFuKxtoYkNslBK/B i0/Qweez0IzJuVUtUp/2/PrkNKyCaEbbqhDerbnLhU/0lcnT0fkFlFoLLLNzxNdt hj6RRJrcpoQB+Qrkf0+5Sxx6W1feP5clZJ2nRSL+rtUNEzCWk7HVh4GprCyvDn6i xjINN9Yh40suJkuKaE0+IrPF1tcL3/128OaT3e0VlL57wK5M4YmJTwrb7g4mlR2/ 31Z4bL1IFYju9WYPW2fWHrdrZUH4h22vLcpW6Q/VFdG0wTC6wVc= =Wt2i -----END PGP SIGNATURE----- Merge 5.4.302 into android11-5.4-lts Changes in 5.4.302 net/sched: sch_qfq: Fix null-deref in agg_dequeue x86/bugs: Fix reporting of LFENCE retpoline btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() net: usb: asix_devices: Check return value of usbnet_get_endpoints fbdev: atyfb: Check if pll_ops->init_pll failed ACPI: video: Fix use-after-free in acpi_video_switch_brightness() fbdev: bitblit: bound-check glyph index in bit_putcs* fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: valkyriefb: Fix reference count leak in valkyriefb_init ASoC: qdsp6: q6asm: do not sleep while atomic wifi: ath10k: Fix memory leak on unsupported WMI command usbnet: Prevents free active kevent drm/etnaviv: fix flush sequence logic regmap: slimbus: fix bus_context pointer in regmap init calls net: phy: dp83867: Disable EEE support as not implemented wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID net: ravb: Enforce descriptor type ordering devcoredump: Fix circular locking dependency with devcd->mutex. can: gs_usb: increase max interface to U8_MAX serial: 8250_dw: Use devm_clk_get_optional() to get the input clock serial: 8250_dw: Use devm_add_action_or_reset() serial: 8250_dw: handle reset control deassert error usb: gadget: f_fs: Fix epfile null pointer access after ep enable. soc: qcom: smem: Fix endian-unaware access of num_entries spi: loopback-test: Don't use %pK through printk bpf: Don't use %pK through printk mmc: host: renesas_sdhi: Fix the actual clock memstick: Add timeout to prevent indefinite waiting ACPI: video: force native for Lenovo 82K8 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 cpufreq/longhaul: handle NULL policy in longhaul_exit arc: Fix __fls() const-foldability via __builtin_clzl() irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() tee: allow a driver to allocate a tee_device without a pool video: backlight: lp855x_bl: Set correct EPROM start for LP8556 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel uprobe: Do not emulate/sstep original instruction when ip is changed hwmon: (dell-smm) Add support for Dell OptiPlex 7040 tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Prefer driver HWP limits mfd: stmpe: Remove IRQ domain upon removal mfd: stmpe-i2c: Add missing MODULE_LICENSE mfd: madera: Work around false-positive -Wininitialized warning drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() PCI: Disable MSI on RDC PCI to PCIe bridges selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 selftests/net: Ensure assert() triggers in psock_tpacket.c drm/amdkfd: return -ENOTTY for unsupported IOCTLs media: pci: ivtv: Don't create fake v4l2_fh x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall powerpc/eeh: Use result of error_detected() in uevent bridge: Redirect to backup port when port is administratively down net: ipv6: fix field-spanning memcpy warning in AH output media: imon: make send_packet() more robust iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register usb: gadget: f_ncm: Fix MAC assignment NCM ethernet char: misc: Does not request module for miscdevice with dynamic minor net: When removing nexthops, don't call synchronize_net if it is not necessary net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call rds: Fix endianness annotation for RDS_MPATH_HASH extcon: adc-jack: Fix wakeup source leaks on device unbind drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption media: fix uninitialized symbol warnings mips: lantiq: danube: add missing properties to cpu node mips: lantiq: danube: add missing device_type in pci node mips: lantiq: xway: sysctrl: rename stp clock scsi: pm8001: Use int instead of u32 to store error codes dmaengine: sh: setup_xref error handling dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: dw-edma: Set status for callback_result net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms ALSA: usb-audio: apply quirk for MOONDROP Quark2 net: call cond_resched() less often in __release_sock() usb: gadget: f_hid: Fix zero length packet transfer phy: cadence: cdns-dphy: Enable lower resolutions in dphy net: sh_eth: Disable WoL if system can not suspend media: redrat3: use int type to store negative error codes selftests: Disable dad for ipv6 in fcnal-test.sh selftests: Replace sleep with slowwait net/cls_cgroup: Fix task_get_classid() during qdisc run selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET scsi: lpfc: Define size of debugfs entry for xri rebalancing allow finish_no_open(file, ERR_PTR(-E...)) usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs usb: xhci: plat: Facilitate using autosuspend for xhci plat devices ipv6: np->rxpmtu race annotation jfs: Verify inode mode when loading from disk jfs: fix uninitialized waitqueue in transaction manager net: intel: fm10k: Fix parameter idx set but not used sparc/module: Add R_SPARC_UA64 relocation handling remoteproc: qcom: q6v5: Avoid handling handover twice NFSv4: handle ERR_GRACE on delegation recalls NFSv4.1: fix mount hang after CREATE_SESSION failure nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing net: macb: avoid dealing with endianness in macb_set_hwaddr() Bluetooth: SCO: Fix UAF on sco_conn_free Bluetooth: bcsp: receive data only if registered page_pool: Clamp pool size to max 16K pages orangefs: fix xattr related buffer overflow... ACPICA: Update dsmethod.c to get rid of unused variable warning fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink 9p: fix /sys/fs/9p/caches overwriting itself 9p: sysfs_init: don't hardcode error to ENOMEM ACPI: property: Return present device nodes only on fwnode interface fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds ceph: add checking of wait_for_completion_killable() return value net: vlan: sync VLAN features with lower device net: dsa/b53: change b53_force_port_config() pause argument net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 net: dsa: b53: fix resetting speed and pause on forced link net: dsa: b53: fix enabling ip multicast net: dsa: b53: stop reading ARL entries if search is done sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup tracing: Fix memory leaks in create_field_var() extcon: adc-jack: Cleanup wakeup source only if it was enabled compiler_types: Move unused static inline functions warning to W=2 NFS4: Fix state renewals missing after boot HID: quirks: avoid Cooler Master MM712 dongle wakeup bug ASoC: max98090/91: fixed max98091 ALSA widget powering up/down net: fec: correct rx_bytes statistic for the case SHIFT16 is set Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions sctp: get netns from asoc and ep base sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto tipc: simplify the finalize work queue tipc: Fix use-after-free in tipc_mon_reinit_self(). net: mdio: fix resource leak in mdiobus_register_device() wifi: mac80211: skip rate verification for not captured PSDUs net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak net/mlx5e: Fix maxrate wraparound in threshold between units net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps net_sched: remove need_resched() from qdisc_run() net_sched: limit try_bulk_dequeue_skb() batches Bluetooth: L2CAP: export l2cap_chan_hold for modules regulator: fixed: use dev_err_probe for register regulator: fixed: fix GPIO descriptor leak on register failure ASoC: cs4271: Fix regulator leak on probe failure drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd mm/ksm: fix flag-dropping behavior in ksm_madvise gcov: add support for GCC 15 strparser: Fix signed/unsigned mismatch bug ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe spi: Try to get ACPI GPIO IRQ earlier EDAC/altera: Handle OCRAM ECC enable after warm reset EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 be2net: pass wrb_params in case of OS2BMC Input: cros_ec_keyb - fix an invalid memory access scsi: sg: Do not sleep in atomic context scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() MIPS: Malta: Fix !EVA SOC-it PCI MMIO mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() net: openvswitch: remove never-working support for setting nsh fields s390/ctcm: Fix double-kfree vsock: Ignore signal/timeout on connect() if already established kconfig/mconf: Initialize the default locale at startup kconfig/nconf: Initialize the default locale at startup mm/page_alloc: fix hash table order logging in alloc_large_system_hash() ALSA: usb-audio: fix uac2 clock source at terminal parser net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error uio_hv_generic: Set event for all channels on the device net: qede: Initialize qede_ll_ops with designated initializer net: netpoll: fix incorrect refcount handling causing incorrect cleanup pmdomain: arm: scmi: Fix genpd leak on provider registration failure pmdomain: imx: Fix reference count leak in imx_gpc_remove fs/proc: fix uaf in proc_readdir_de() ata: libata-scsi: Fix system suspend for a security locked drive usb: deprecate the third argument of usb_maxpacket() Input: remove third argument of usb_maxpacket() Input: pegasus-notetaker - fix potential out-of-bounds access Linux 5.4.302 Change-Id: I7291d845c3cfde8a154957356156fadcc4b96b80 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Chuang Wang
|
69d35c1216 |
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
commit ac1499fcd40fe06479e9b933347b837ccabc2a40 upstream.
The sit driver's packet transmission path calls: sit_tunnel_xmit() ->
update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called
to delete entries exceeding FNHE_RECLAIM_DEPTH+random.
The race window is between fnhe_remove_oldest() selecting fnheX for
deletion and the subsequent kfree_rcu(). During this time, the
concurrent path's __mkroute_output() -> find_exception() can fetch the
soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a
new dst using a dst_hold(). When the original fnheX is freed via RCU,
the dst reference remains permanently leaked.
CPU 0 CPU 1
__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]
This issue manifests as a device reference count leak and a warning in
dmesg when unregistering the net device:
unregister_netdevice: waiting for sitX to become free. Usage count = N
Ido Schimmel provided the simple test validation method [1].
The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes().
Since rt_bind_exception() checks this field, setting it to zero prevents
the stale fnhe from being reused and bound to a new dst just before it
is freed.
[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1
Cc: stable@vger.kernel.org
Fixes: 67d6d681e15b ("ipv4: make exception cache less predictible")
Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251111064328.24440-1-nashuiliang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Christoph Paasch
|
e3efebfee6 |
net: When removing nexthops, don't call synchronize_net if it is not necessary
[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
When removing a nexthop, commit
90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
call to synchronize_rcu() (later changed to _net()) to make sure
everyone sees the new nexthop-group before the rtnl-lock is released.
When one wants to delete a large number of groups and nexthops, it is
fastest to first flush the groups (ip nexthop flush groups) and then
flush the nexthops themselves (ip -6 nexthop flush). As that way the
groups don't need to be rebalanced.
However, `ip -6 nexthop flush` will still take a long time if there is
a very large number of nexthops because of the call to
synchronize_net(). Now, if there are no more groups, there is no point
in calling synchronize_net(). So, let's skip that entirely by checking
if nh->grp_list is empty.
This gives us a nice speedup:
BEFORE:
=======
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 2097152 nexthops
real 1m45.345s
user 0m0.001s
sys 0m0.005s
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 4194304 nexthops
real 3m10.430s
user 0m0.002s
sys 0m0.004s
AFTER:
======
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 2097152 nexthops
real 0m17.545s
user 0m0.003s
sys 0m0.003s
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 4194304 nexthops
real 0m35.823s
user 0m0.002s
sys 0m0.004s
Signed-off-by: Christoph Paasch <cpaasch@openai.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Greg Kroah-Hartman
|
f6520a7c91 |
This is the 5.4.301 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkCD9kACgkQONu9yGCS
aT756BAAwEcL3lKO/0QKjMUrvgv7FRoRm9TH9Usq7Nswmiax6YKI3oPgZKfZZL6u
yLGSnYqV8f+Jo8kALMJAybu+Oc3Z8WbBZJG/dvlAkvR7iN19ZCuKa2NwWmh8BTGd
5ZP4/nyXlNlg0/IIZ8xJa3067U895y9IhgMDmSvOZoUFGFecqUmJNBoj8bHgJaPL
/MENYb7D0CcKWbgCwzsqN0EEm9UKb7xgtaaC52sfZD+GHUPF/RLq9QNyUGtyL0m8
y20HG6zXmBiVP+zdtYpTaaEP6OSNOCmiOweSZOFafnatd2XO1hRdnAoEk7+t2Lj+
Xa5GowVUuglmBd8bPbeY8cwVihMxr81DxMns+OpQJTiDD8Q6Whcxbaqwv+tVe7z4
cVDh1xlKG4U2rsDTeiGhbZVNb6gqqy3LnVFqImQE+dcZqlwC0pbqwO2lLdHMa8NF
f+l1U3ab0k9qYx8HQegYDTufW5Eb0Rki/3YyHk8o3alOYd2Oc3r16lw9rpSw2Nq3
Rku+VMSy6z8uvmIP7Ywobla6j73SGFrDc61F0nsU1x+Gd/dMIgkn36dfxciBCgPa
/AmkK1Psx04s7dIPMowx/nXy5Jk8J4k3JlVMeBnMCuFVUNCNp3qzq5WXdeL1G5f5
GFPJPblaZrfKQNSSlpUAmstl8v5t8aJcjxobmHn28fVliFAJdDI=
=XPvH
-----END PGP SIGNATURE-----
Merge 5.4.301 into android11-5.4-lts
Changes in 5.4.301
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
udp: Fix memory accounting leak.
media: tunner: xc5000: Refactor firmware load
media: tuner: xc5000: Fix use-after-free in xc5000_release
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
media: rc: Add support for another iMON 0xffdc device
media: imon: reorganize serialization
media: imon: grab lock earlier in imon_ir_change_protocol()
media: rc: fix races with imon_disconnect()
USB: serial: option: add SIMCom 8230C compositions
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
dm-integrity: limit MAX_TAG_SIZE to 255
perf subcmd: avoid crash in exclude_cmds when excludes is empty
staging: axis-fifo: fix maximum TX packet length check
staging: axis-fifo: flush RX FIFO on read errors
driver core/PM: Set power.no_callbacks along with power.no_pm
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
x86/vdso: Fix output operand size of RDPID
regmap: Remove superfluous check for !config in __regmap_init()
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
pinctrl: meson-gxl: add missing i2c_d pinmux
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
block: use int to store blk_stack_limits() return value
pwm: tiehrpwm: Fix corner case in clock divisor calculation
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
bpf: Explicitly check accesses to bpf_sock_addr
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
i2c: designware: Add disabling clocks when probe fails
drm/radeon/r600_cs: clean up of dead code in r600_cs
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
serial: max310x: Add error checking in probe()
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
scsi: myrs: Fix dma_alloc_coherent() error check
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
ALSA: lx_core: use int type to store negative error codes
wifi: mwifiex: send world regulatory domain to driver
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
tcp: fix __tcp_close() to only send RST when required
usb: phy: twl6030: Fix incorrect type for ret
usb: gadget: configfs: Correctly set use_os_string at bind
misc: genwqe: Fix incorrect cmd field being reported in error
pps: fix warning in pps_register_cdev when register device fail
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
netfilter: ipset: Remove unused htable_bits in macro ahash_region
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
drivers/base/node: handle error properly in register_one_node()
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
RDMA/core: Resolve MAC of next-hop device without ARP support
IB/sa: Fix sa_local_svc_timeout_ms read race
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
NFSv4.1: fix backchannel max_resp_sz verification check
ipvs: Defer ip_vs_ftp unregister during netns cleanup
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
usb: vhci-hcd: Prevent suspending virtually attached devices
RDMA/siw: Always report immediate post SQ errors
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
ocfs2: fix double free in user_cluster_connect()
drivers/base/node: fix double free in register_one_node()
nfp: fix RSS hash key size when RSS is not supported
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Squashfs: fix uninit-value in squashfs_get_parent
uio_hv_generic: Let userspace take care of interrupt mask
mm: hugetlb: avoid soft lockup when mprotect to large memory area
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
pinctrl: check the return value of pinmux_ops::get_function_name()
clocksource/drivers/clps711x: Fix resource leaks in error paths
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
perf util: Fix compression checks returning -1 as bool
rtc: x1205: Fix Xicor X1205 vendor prefix
perf session: Fix handling when buffer exceeds 2 GiB
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
scsi: libsas: Add sas_task_find_rq()
scsi: mvsas: Delete mvs_tag_init()
scsi: mvsas: Use sas_task_find_rq() for tagging
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
drm/vmwgfx: Fix Use-after-free in validation
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
tools build: Align warning options with perf
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
crypto: essiv - Check ssize for decryption and in-place encryption
tpm, tpm_tis: Claim locality before writing interrupt registers
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
ACPI: debug: fix signedness issues in read/write helpers
arm64: dts: qcom: msm8916: Add missing MDSS reset
xen/manage: Fix suspend error path
firmware: meson_sm: fix device leak at probe
media: i2c: mt9v111: fix incorrect type for ret
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
crypto: atmel - Fix dma_unmap_sg() direction
iio: dac: ad5360: use int type to store negative error codes
iio: dac: ad5421: use int type to store negative error codes
iio: frequency: adf4350: Fix prescaler usage.
lib/genalloc: fix device leak in of_gen_pool_get()
parisc: don't reference obsolete termio struct for TC* constants
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
sctp: Fix MAC comparison to be constant-time
sparc64: fix hugetlb for sun4u
sparc: fix error handling in scan_one_device()
mtd: rawnand: fsmc: Default to autodetect buswidth
mmc: core: SPI mode remove cmd7
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
rtc: interface: Fix long-standing race when setting alarm
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
PCI/AER: Fix missing uevent on recovery when a reset is requested
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
x86/umip: Check that the instruction opcode is at least two bytes
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
ext4: correctly handle queries for metadata mappings
ext4: guard against EA inode refcount underflow in xattr update
net/9p: fix double req put in p9_fd_cancelled
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
fs: udf: fix OOB read in lengthAllocDescs handling
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
media: mc: Clear minor number before put device
Squashfs: add additional inode sanity checking
Squashfs: reject negative file sizes in squashfs_read_inode()
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
dm: fix NULL pointer dereference in __dm_suspend()
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
minixfs: Verify inode mode when loading from disk
pid: Add a judgment for ns null in pid_nr_ns
fs: Add 'initramfs_options' to set initramfs mount options
cramfs: Verify inode mode when loading from disk
xen/events: Cleanup find_virq() return codes
media: cx18: Add missing check after DMA map
pwm: berlin: Fix wrong register in suspend/resume
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
drm/exynos: exynos7_drm_decon: remove ctx->suspended
media: rc: Directly use ida_free()
media: lirc: Fix error handling in lirc_register()
xen/events: Update virq_to_irq on migration
media: pci/ivtv: switch from 'pci_' to 'dma_' API
media: pci: ivtv: Add missing check after DMA map
net: dl2k: switch from 'pci_' to 'dma_' API
net: dlink: handle dma_map_single() failure properly
net/ip6_tunnel: Prevent perpetual tunnel growth
amd-xgbe: Avoid spurious link down messages during interface toggle
tcp: fix tcp_tso_should_defer() vs large RTT
tg3: prevent use of uninitialized remote_adv and local_adv variables
tls: always set record_type in tls_process_cmsg
tls: don't rely on tx_work during send()
sched: Make newidle_balance() static again
sched/fair: Trivial correction of the newidle_balance() comment
sched/balancing: Rename newidle_balance() => sched_balance_newidle()
sched/fair: Fix pelt lost idle time detection
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
exec: Fix incorrect type for ret
hfs: clear offset and space out of valid records in b-tree node
hfs: make proper initalization of struct hfs_find_data
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
hfs: validate record offset in hfsplus_bmap_alloc
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
dlm: check for defined force value in dlm_lockspace_release
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
m68k: bitops: Fix find_*_bit() signatures
net: rtnetlink: remove redundant assignment to variable err
net: rtnetlink: add msg kind names
net: rtnetlink: add helper to extract msg type's kind
net: rtnetlink: use BIT for flag values
net: netlink: add NLM_F_BULK delete request modifier
net: rtnetlink: add bulk delete support flag
net: add ndo_fdb_del_bulk
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
rtnetlink: Allow deleting FDB entries in user namespace
net: enetc: correct the value of ENETC_RXB_TRUESIZE
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
sctp: avoid NULL dereference when chunk data buffer is missing
net: bonding: fix possible peer notify event loss or dup issue
Revert "cpuidle: menu: Avoid discarding useful information"
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
ocfs2: clear extent cache after moving/defragmenting extents
net: usb: rtl8150: Fix frame padding
net: ravb: Ensure memory write completes before ringing TX doorbell
USB: serial: option: add UNISOC UIS7720
USB: serial: option: add Quectel RG255C
USB: serial: option: add Telit FN920C04 ECM compositions
usb/core/quirks: Add Huawei ME906S to wakeup quirk
xhci: dbc: enable back DbC in resume if it was enabled before suspend
binder: remove "invalid inc weak" check
comedi: fix divide-by-zero in comedi_buf_munge()
arm64: cputype: Add Neoverse-V3AE definitions
arm64: errata: Apply workarounds for Neoverse-V3AE
memory: samsung: exynos-srom: Correct alignment
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
spi: cadence-quadspi: Flush posted register writes before INDAC access
spi: cadence-quadspi: Flush posted register writes before DAC access
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
drm/amdgpu: use atomic functions with memory barriers for vm fault info
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
jbd2: ensure that all ongoing I/O complete before freeing blocks
vfs: Don't leak disconnected dentries on umount
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
KEYS: trusted_tpm1: Compare HMAC values in constant time
padata: Reset next CPU when reorder sequence wraps around
NFSD: Minor cleanup in layoutcommit processing
NFSD: Fix last write offset handling in layoutcommit
media: s5p-mfc: remove an unused/uninitialized variable
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
Linux 5.4.301
Change-Id: Ie2685625a0f630cb01ac8d8c9ddcd68c64ea6ed7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Eric Dumazet
|
8b7ac7af3a |
tcp: fix tcp_tso_should_defer() vs large RTT
[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
Neal reported that using neper tcp_stream with TCP_TX_DELAY
set to 50ms would often lead to flows stuck in a small cwnd mode,
regardless of the congestion control.
While tcp_stream sets TCP_TX_DELAY too late after the connect(),
it highlighted two kernel bugs.
The following heuristic in tcp_tso_should_defer() seems wrong
for large RTT:
delta = tp->tcp_clock_cache - head->tstamp;
/* If next ACK is likely to come too late (half srtt), do not defer */
if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
goto send_now;
If next ACK is expected to come in more than 1 ms, we should
not defer because we prefer a smooth ACK clocking.
While blamed commit was a step in the good direction, it was not
generic enough.
Another patch fixing TCP_TX_DELAY for established flows
will be proposed when net-next reopens.
Fixes:
|
||
Dmitry Safonov
|
566f8d5c8a |
net/ip6_tunnel: Prevent perpetual tunnel growth
[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
While ipv4 tunnel headroom adjustment growth was limited in
commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
ipv6 tunnel yet increases the headroom without any ceiling.
Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
Credits to Francesco Ruggeri, who was originally debugging this issue
and wrote local Arista-specific patch and a reproducer.
Fixes:
|
||
Kuniyuki Iwashima
|
e359b742ea |
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ] syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ> Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") Reported-by: syzkaller <syzkaller@googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Eric Dumazet
|
4f88c5c187 |
tcp: fix __tcp_close() to only send RST when required
[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
If the receive queue contains payload that was already
received, __tcp_close() can send an unexpected RST.
Refine the code to take tp->copied_seq into account,
as we already do in tcp recvmsg().
Fixes:
|
||
Kuniyuki Iwashima
|
1355027317 |
udp: Fix memory accounting leak.
commit df207de9d9e7a4d92f8567e2c539d9c8c12fd99d upstream.
Matt Dowling reported a weird UDP memory usage issue.
Under normal operation, the UDP memory usage reported in /proc/net/sockstat
remains close to zero. However, it occasionally spiked to 524,288 pages
and never dropped. Moreover, the value doubled when the application was
terminated. Finally, it caused intermittent packet drops.
We can reproduce the issue with the script below [0]:
1. /proc/net/sockstat reports 0 pages
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 0
2. Run the script till the report reaches 524,288
# python3 test.py & sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 3 mem 524288 <-- (INT_MAX + 1) >> PAGE_SHIFT
3. Kill the socket and confirm the number never drops
# pkill python3 && sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 524288
4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()
# python3 test.py & sleep 1 && pkill python3
5. The number doubles
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 1048577
The application set INT_MAX to SO_RCVBUF, which triggered an integer
overflow in udp_rmem_release().
When a socket is close()d, udp_destruct_common() purges its receive
queue and sums up skb->truesize in the queue. This total is calculated
and stored in a local unsigned integer variable.
The total size is then passed to udp_rmem_release() to adjust memory
accounting. However, because the function takes a signed integer
argument, the total size can wrap around, causing an overflow.
Then, the released amount is calculated as follows:
1) Add size to sk->sk_forward_alloc.
2) Round down sk->sk_forward_alloc to the nearest lower multiple of
PAGE_SIZE and assign it to amount.
3) Subtract amount from sk->sk_forward_alloc.
4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().
When the issue occurred, the total in udp_destruct_common() was 2147484480
(INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().
At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and
2) sets -2147479552 to amount. 3) reverts the wraparound, so we don't
see a warning in inet_sock_destruct(). However, udp_memory_allocated
ends up doubling at 4).
Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for
memory_allocated"), memory usage no longer doubles immediately after
a socket is close()d because __sk_mem_reduce_allocated() caches the
amount in udp_memory_per_cpu_fw_alloc. However, the next time a UDP
socket receives a packet, the subtraction takes effect, causing UDP
memory usage to double.
This issue makes further memory allocation fail once the socket's
sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet
drops.
To prevent this issue, let's use unsigned int for the calculation and
call sk_forward_alloc_add() only once for the small delta.
Note that first_packet_length() also potentially has the same problem.
[0]:
from socket import *
SO_RCVBUFFORCE = 33
INT_MAX = (2 ** 31) - 1
s = socket(AF_INET, SOCK_DGRAM)
s.bind(('', 0))
s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)
c = socket(AF_INET, SOCK_DGRAM)
c.connect(s.getsockname())
data = b'a' * 100
while True:
c.send(data)
Fixes:
|
||
|
Michael Bestas
|
b4aa467048 |
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common: Revert "genirq: Provide new interfaces for affinity hints" Revert "i40e: Use irq_update_affinity_hint()" Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path" Linux 5.4.300 mm/hugetlb: fix folio is still mapped when deleted i40e: add mask to apply valid bits for itr_idx i40e: fix validation of VF state in get resources i40e: fix idx validation in config queues msg i40e: add validation for ring_len param i40e: increase max descriptors for XL710 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() fbcon: Fix OOB access in font allocation fbcon: fix integer overflow in fbcon_do_set_font i40e: add max boundary check for VF filters i40e: fix input validation logic for action_meta i40e: fix idx validation in i40e_validate_queue_map drm/gma500: Fix null dereference in hdmi teardown can: peak_usb: fix shift-out-of-bounds issue can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow can: hi311x: populate ndo_change_mtu() to prevent buffer overflow can: rcar_can: rcar_can_resume(): fix s2ram with PSCI IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions usb: core: Add 0x prefix to quirks debug output ALSA: usb-audio: Fix build with CONFIG_INPUT=n ALSA: usb-audio: Convert comma to semicolon ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks ALSA: usb-audio: Simplify NULL comparison in mixer_quirks ALSA: usb-audio: Avoid multiple assignments in mixer_quirks ALSA: usb-audio: Fix block comments in mixer_quirks KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer net: rfkill: gpio: add DT support serial: sc16is7xx: fix bug in flow control levels init USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels usb: gadget: dummy_hcd: remove usage of list iterator past the loop body ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message ASoC: wm8974: Correct PLL rate rounding ASoC: wm8940: Correct typo in control name rds: ib: Increment i_fastreg_wrs before bailing out mmc: mvsdio: Fix dma_unmap_sg() nents value power: supply: bq27xxx: restrict no-battery detection to bq27000 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* cnic: Fix use-after-free bugs in cnic_delete_task net: liquidio: fix overflow in octeon_init_instr_queue() Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). i40e: remove redundant memory barrier when cleaning Tx descs net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure cgroup: split cgroup_destroy_wq into 3 workqueues pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch wifi: mac80211: fix incorrect type for ret ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory soc: qcom: mdt_loader: Deal with zero e_shentsize phy: ti-pipe3: fix device leak at unbind dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees dmaengine: ti: edma: Fix memory allocation size for queue_priority_map can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path i40e: Use irq_update_affinity_hint() genirq: Provide new interfaces for affinity hints genirq: Export affinity setter for modules genirq/affinity: Add irq_update_affinity_desc() igb: fix link test skipping when interface is admin down net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions USB: serial: option: add Telit Cinterion FN990A w/audio compositions tty: hvc_console: Call hvc_kick in hvc_write unconditionally mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing mtd: nand: raw: atmel: Fix comment in timings preparation mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer mm/khugepaged: fix the address passed to notifier on testing young fuse: prevent overflow in copy_file_range return value fuse: check if copy_file_range() returns larger than requested size mtd: rawnand: stm32_fmc2: fix ECC overwrite ocfs2: fix recursive semaphore deadlock in fiemap call EDAC/altera: Delete an inappropriate dma_free_coherent() call tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. NFSv4: Don't clear capabilities that won't be reset net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. usb: hub: Fix flushing of delayed work used for post resume purposes Change-Id: I9cbae559320c1ca8d46d8443b8ce47f1c9a50f4b |
||
|
Michael Bestas
|
b31d93f6d6 |
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-10-01 * tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common: UPSTREAM: vsock: Do not allow binding to VMADDR_PORT_ANY Linux 5.4.299 dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() cifs: fix integer overflow in match_server() spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort spi: spi-fsl-lpspi: Set correct chip-select polarity bit spi: spi-fsl-lpspi: Fix transmissions when using CONT pcmcia: Add error handling for add_interval() in do_validate_mem() ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model randstruct: gcc-plugin: Fix attribute addition randstruct: gcc-plugin: Remove bogus void member vmxnet3: update MTU after device quiesce net: dsa: microchip: linearize skb for tail-tagging switches net: dsa: microchip: update tag_ksz masks for KSZ9477 family dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup gpio: pca953x: fix IRQ storm on system wake up iio: light: opt3001: fix deadlock due to concurrent flag access iio: chemical: pms7003: use aligned_s64 for timestamp KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer cpufreq/sched: Explicitly synchronize limits_changed flag handling mm/slub: avoid accessing metadata when pointer is invalid in object_err() scsi: lpfc: Fix buffer free/clear order in deferred receive path mm/khugepaged: fix ->anon_vma race e1000e: fix heap overflow in e1000_set_eeprom batman-adv: fix OOB read/write in network-coding decode drm/amdgpu: drop hw access in non-DC audio fini wifi: mwifiex: Initialize the chan_stats array to zero pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() ALSA: usb-audio: Add mute TLV for playback volumes on some devices ppp: fix memory leak in pad_compress_skb net: atm: fix memory leak in atm_register_sysfs when device_register fail ax25: properly unshare skbs in ax25_kiss_rcv() ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() net: thunder_bgx: decrement cleanup index before use net: thunder_bgx: add a missing of_node_put wifi: libertas: cap SSID len in lbs_associate() wifi: cw1200: cap SSID length in cw1200_do_join() net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets i40e: Fix potential invalid access when MAC list is empty icmp: fix icmp_ndo_send address translation for reply direction mISDN: Fix memory leak in dsp_hwec_enable() xirc2ps_cs: fix register access when enabling FullDuplex Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() netfilter: conntrack: helper: Replace -EEXIST by -EBUSY wifi: cfg80211: fix use-after-free in cmp_bss() powerpc: boot: Remove leading zero in label in udelay() Linux 5.4.298 Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Revert "drm/amdgpu: fix incorrect vm flags to map bo" HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() HID: wacom: Add a new Art Pen 2 HID: asus: fix UAF via HID_CLAIMED_INPUT validation KVM: x86: use array_index_nospec with indices that come from guest efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare sctp: initialize more fields in sctp_v6_from_sk() net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net/mlx5e: Set local Xoff after FW update net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Update and set Xon/Xoff upon MTU set net: dlink: fix multicast stats being counted incorrectly atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). net/atm: remove the atmdev_ops {get, set}sockopt methods Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced powerpc/kvm: Fix ifdef to remove build warning net: ipv4: fix regression in local-broadcast routes vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() scsi: core: sysfs: Correct sysfs attributes access rights ftrace: Fix potential warning in trace_printk_seq during ftrace_dump pinctrl: STMFX: add missing HAS_IOMEM dependency Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports" Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()" Linux 5.4.297 alloc_fdtable(): change calling conventions. s390/hypfs: Enable limited access during lockdown s390/hypfs: Avoid unnecessary ioctl registration in debugfs ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add ALSA: usb-audio: Fix size validation in convert_chmap_v3() scsi: qla4xxx: Prevent a potential error pointer dereference usb: xhci: Fix slot_id resource race conflict nfs: fix UAF in direct writes NFS: Fix up commit deadlocks cifs: Fix UAF in cifs_demultiplex_thread() Bluetooth: fix use-after-free in device_for_each_child() act_mirred: use the backlog for nested calls to mirred ingress net/sched: act_mirred: better wording on protection against excessive stack growth net/sched: act_mirred: refactor the handle of xmit selftests: forwarding: tc_actions.sh: add matchall mirror test net: sched: don't expose action qstats to skb_tc_reinsert() net: sched: extract qstats update code into functions net: sched: extract bstats update code into function net: sched: extract common action counters update code into function mm: perform the mapping_map_writable() check after call_mmap() mm: update memfd seal write check to include F_SEAL_WRITE mm: drop the assumption that VM_SHARED always implies writable codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_drr: make drr_qlen_notify() idempotent btrfs: populate otime when logging an inode item media: venus: hfi: explicitly release IRQ during teardown f2fs: fix to avoid out-of-boundary access in dnode page media: venus: protect against spurious interrupts during probe media: qcom: camss: cleanup media device allocated resource on error path media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS pwm: mediatek: Fix duty and period setting pwm: mediatek: Handle hardware enable and clock enable separately pwm: mediatek: Implement .apply() callback media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() media: v4l2-ctrls: always copy the controls on completion ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig soc: qcom: mdt_loader: Ensure we don't read past the ELF header rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 usb: musb: omap2430: fix device leak at unbind NFS: Fix the setting of capabilities when automounting a new filesystem NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() NFSv4: Fix nfs4_bitmap_copy_adjust() usb: typec: fusb302: cache PD RX state cdc-acm: fix race between initial clearing halt and open USB: cdc-acm: do not log successful probe on later errors mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() x86/fpu: Delay instruction pointer fixup until after warning mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov tracing: Add down_write(trace_event_sem) when adding trace event usb: hub: Don't try to recover devices lost during warm reset. usb: hub: avoid warm port reset during USB3 disconnect x86/mce/amd: Add default names for MCA banks and blocks iio: hid-sensor-prox: Fix incorrect OFFSET calculation f2fs: fix to do sanity check on ino and xnid mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() drm/sched: Remove optimization that causes hang when killing dependent jobs ice: Fix a null pointer dereference in ice_copy_and_init_pkg() net: usbnet: Fix the wrong netif_carrier_on() call net: usbnet: Avoid potential RCU stall on LINK_CHANGE event PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large comedi: Fix initialization of data for instructions that write to subdevice kbuild: Add KBUILD_CPPFLAGS to as-option invocation kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS kbuild: Add CLANG_FLAGS to as-instr mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation kbuild: Update assembler calls to use proper flags and language target ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS usb: dwc3: Ignore late xferNotReady event to prevent halt timeout USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles usb: storage: realtek_cr: Use correct byte order for bcs->Residue USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive iio: proximity: isl29501: fix buffered read on big-endian systems ftrace: Also allocate and copy hash for reading of filter files fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() use uniform permission checks for all mount propagation changes move_mount: allow to add a mount into an existing group fs/buffer: fix use-after-free when call bh_read() helper drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 squashfs: fix memory leak in squashfs_fill_super memstick: Fix deadlock by moving removing flag earlier media: venus: Add a check for packet size after reading from shared memory media: ov2659: Fix memory leaks in ov2659_probe() media: usbtv: Lock resolution while streaming media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() media: gspca: Add bounds checking to firmware parser soc/tegra: pmc: Ensure power-domains are in a known state jbd2: prevent softlockup in jbd2_log_do_checkpoint() PCI: endpoint: Fix configfs group removal on driver teardown PCI: endpoint: Fix configfs group list head handling mtd: rawnand: fsmc: Add missing check after DMA map pwm: imx-tpm: Reset counter if CMOD is 0 wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() zynq_fpga: use sgtable-based scatterlist wrappers ata: libata-scsi: Fix ata_to_sense_error() status handling ext4: fix reserved gdt blocks handling in fsmap ext4: fix fsmap end of range reporting with bigalloc ext4: check fast symlink for ea_inode correctly Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" vt: defkeymap: Map keycodes above 127 to K_HOLE vt: keyboard: Don't process Unicode characters in K_OFF mode usb: dwc3: meson-g12a: fix device leaks at unbind usb: gadget: udc: renesas_usb3: fix device leak at unbind usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() m68k: Fix lost column on framebuffer debug console cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() serial: 8250: fix panic due to PSLVERR media: uvcvideo: Do not mark valid metadata as invalid media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() parisc: Makefile: fix a typo in palo.conf btrfs: fix log tree replay failure due to file with 0 links and extents thunderbolt: Fix copy+paste error in match_service_id() comedi: fix race between polling and detaching misc: rtsx: usb: Ensure mmc child device is active when card is present drm/amdgpu: fix incorrect vm flags to map bo scsi: lpfc: Remove redundant assignment to avoid memory leak rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe pNFS: Fix uninited ptr deref in block/scsi layout pNFS: Handle RPC size limit for layoutcommits pNFS: Fix disk addr range check in block/scsi layout pNFS: Fix stripe mapping in block/scsi layout net: phy: smsc: add proper reset flags for LAN8710A ipmi: Fix strcpy source and destination the same kconfig: lxdialog: fix 'space' to (de)select options kconfig: gconf: fix potential memory leak in renderer_edited() kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() ipmi: Use dev_warn_ratelimited() for incorrect message warnings scsi: aacraid: Stop using PCI_IRQ_AFFINITY scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans kconfig: nconf: Ensure null termination where strncpy is used kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c i3c: don't fail if GETHDRCAP is unsupported PCI: pnv_php: Work around switches with broken presence detection i3c: add missing include to internal header media: uvcvideo: Fix bandwidth issue for Alcor camera media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() media: usb: hdpvr: disable zero-length read messages media: tc358743: Increase FIFO trigger level to 374 media: tc358743: Return an appropriate colorspace from tc358743_set_fmt media: tc358743: Check I2C succeeded during probe pinctrl: stm32: Manage irq affinity settings scsi: mpt3sas: Correctly handle ATA device errors scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() MIPS: Don't crash in stack_top() for tasks without ABI or vDSO jfs: upper bound check of tree index in dbAllocAG jfs: Regular file corruption check jfs: truncate good inode pages when hard link is 0 scsi: bfa: Double-free fix MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} watchdog: dw_wdt: Fix default timeout fs/orangefs: use snprintf() instead of sprintf() scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr cifs: Fix calling CIFSFindFirst() for root path without msearch vhost: fail early when __vhost_add_used() fails net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 uapi: in6: restore visibility of most IPv6 socket options net: ncsi: Fix buffer overflow in fetching version id net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs wifi: iwlegacy: Check rate_idx range after addition netmem: fix skb_frag_address_safe with unreadable skbs wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() net: fec: allow disable coalescing (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer s390/stp: Remove udelay from stp_sync_clock() wifi: iwlwifi: mvm: fix scan request validation net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() net: ipv4: fix incorrect MTU in broadcast routes wifi: cfg80211: Fix interface type validation rcu: Protect ->defer_qs_iw_pending from data race net: ag71xx: Add missing check after DMA map et131x: Add missing check after DMA map be2net: Use correct byte order and format string for TCP seq and ack_seq s390/time: Use monotonic clock in get_cycles() wifi: cfg80211: reject HTC bit for management frames ktest.pl: Prevent recursion of default variable options ASoC: codecs: rt5640: Retry DEVICE_ID verification ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() usb: core: usb_submit_urb: downgrade type check ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path ACPI: processor: fix acpi_object initialization PM: sleep: console: Fix the black screen issue thermal: sysfs: Return ENODATA instead of EAGAIN for reads PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() selftests: tracing: Use mutex_unlock for testing glob filter ARM: tegra: Use I/O memcpy to write to IRAM gpio: tps65912: check the return value of regmap_update_bits() ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed ARM: rockchip: fix kernel hang during smp initialization cpufreq: Exit governor when failed to start old governor usb: xhci: Avoid showing errors during surprise removal usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command usb: xhci: Avoid showing warnings for dying controller selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t usb: xhci: print xhci->xhc_state when queue_command failed securityfs: don't pin dentries twice, once is enough... hfs: fix not erasing deleted b-tree node issue drbd: add missing kref_get in handle_write_conflicts udf: Verify partition map count arm64: Handle KCOV __init vs inline mismatches hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() hfs: fix slab-out-of-bounds in hfs_bnode_read() sctp: linearize cloned gso packets in sctp_rcv netfilter: ctnetlink: fix refcount leak on table dump udp: also consider secpath when evaluating ipsec use for checksumming ACPI: processor: perflib: Move problematic pr->performance check ACPI: processor: perflib: Fix initial _PPC limit application Documentation: ACPI: Fix parent device references fs: Prevent file descriptor table allocations exceeding INT_MAX sunvdc: Balance device refcount in vdc_port_mpgroup_check NFSD: detect mismatch of file handle and delegation stateid in OPEN op net: dpaa: fix device leak when querying time stamp info net: gianfar: fix device leak when querying time stamp info netlink: avoid infinite retry looping in netlink_unicast() ALSA: usb-audio: Validate UAC3 cluster segment descriptors ALSA: usb-audio: Validate UAC3 power domain descriptors, too io_uring: don't use int for ABI usb: gadget : fix use-after-free in composite_dev_cleanup() MIPS: mm: tlb-r4k: Uniquify TLB entries on init USB: serial: option: add Foxconn T99W709 vsock: Do not allow binding to VMADDR_PORT_ANY net/packet: fix a race in packet_set_ring() and packet_notifier() perf/core: Prevent VMA split of buffer mappings perf/core: Exit early on perf_mmap() fail perf/core: Don't leak AUX buffer refcount on allocation failure pptp: fix pptp_xmit() error path smb: client: let recv_done() cleanup before notifying the callers. benet: fix BUG when creating VFs net: drop UFO packets in udp_rcv_segment() ipv6: reject malicious packets in ipv6_gso_segment() pptp: ensure minimal skb length in pptp_xmit() netpoll: prevent hanging NAPI when netcons gets enabled NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() pci/hotplug/pnv-php: Wrap warnings in macro pci/hotplug/pnv-php: Improve error msg on power state change failure usb: chipidea: udc: fix sleeping function called from invalid context f2fs: fix to avoid out-of-boundary access in devs.path f2fs: fix to avoid panic in f2fs_evict_inode f2fs: fix to avoid UAF in f2fs_sync_inode_meta() rtc: pcf8563: fix incorrect maximum clock rate handling rtc: hym8563: fix incorrect maximum clock rate handling rtc: ds1307: fix incorrect maximum clock rate handling module: Restore the moduleparam prefix length check bpf: Check flow_dissector ctx accesses are aligned mtd: rawnand: atmel: set pmecc data setup time mtd: rawnand: atmel: Fix dma_mapping_error() address jfs: fix metapage reference count leak in dbAllocCtl fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref crypto: qat - fix seq_file position update in adf_ring_next() dmaengine: nbpfaxi: Add missing check after DMA map dmaengine: mv_xor: Fix missing check after DMA map and missing unmap fs/orangefs: Allow 2 more characters in do_c_string() soundwire: stream: restore params when prepare ports fail crypto: img-hash - Fix dma_unmap_sg() nents value hwrng: mtk - handle devm_pm_runtime_enable errors watchdog: ziirave_wdt: check record length in ziirave_firm_verify() scsi: isci: Fix dma_unmap_sg() nents value scsi: mvsas: Fix dma_unmap_sg() nents value scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value clk: sunxi-ng: v3s: Fix de clock definition perf tests bp_account: Fix leaked file descriptor crypto: ccp - Fix crash when rebind ccp device for ccp.ko pinctrl: sunxi: Fix memory leak on krealloc failure power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set clk: davinci: Add NULL check in davinci_lpsc_clk_register() mtd: fix possible integer overflow in erase_xfer() crypto: marvell/cesa - Fix engine load inaccuracy PCI: rockchip-host: Fix "Unexpected Completion" log message vrf: Drop existing dst reference in vrf_ip6_input_dst selftests: rtnetlink.sh: remove esp4_offload after test netfilter: xt_nfacct: don't assume acct name is null-terminated can: kvaser_usb: Assign netdev.dev_port based on device channel index can: kvaser_pciefd: Store device channel index wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" mwl8k: Add missing check after DMA map wifi: rtl8xxxu: Fix RX skb size for aggregation disabled net/sched: Restrict conditions for adding duplicating netems to qdisc tree arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX netfilter: nf_tables: adjust lockdep assertions handling drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value m68k: Don't unregister boot console needlessly tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range iwlwifi: Add missing check for alloc_ordered_workqueue wifi: iwlwifi: Fix memory leak in iwl_mvm_init() wifi: rtl818x: Kill URBs before clearing tx status queue caif: reduce stack size, again bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls staging: nvec: Fix incorrect null termination of battery manufacturer samples: mei: Fix building on musl libc cpufreq: Init policy->rwsem before it may be possibly used ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface usb: early: xhci-dbc: Fix early_ioremap leak Revert "vmci: Prevent the dispatching of uninitialized payloads" pps: fix poll support vmci: Prevent the dispatching of uninitialized payloads staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() ARM: dts: vfxxx: Correctly use two tuples for timer address ASoC: ops: dynamically allocate struct snd_ctl_elem_value hfsplus: remove mutex_lock check in hfsplus_free_extents ASoC: Intel: fix SND_SOC_SOF dependencies ethernet: intel: fix building with large NR_CPUS usb: phy: mxs: disconnect line when USB charger is attached usb: chipidea: add USB PHY event usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use usb: chipidea: udc: protect usb interrupt enable usb: chipidea: udc: add new API ci_hdrc_gadget_connect ALSA: hda: Add missing NVIDIA HDA codec IDs comedi: comedi_test: Fix possible deletion of uninitialized timers nilfs2: reject invalid file types when reading inodes i2c: qup: jump out of the loop in case of timeout net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net: appletalk: Fix use-after-free in AARP proxy probe net: appletalk: fix kerneldoc warnings RDMA/core: Rate limit GID cache warning messages regulator: core: fix NULL dereference on unbind due to stale coupling data usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm usb: hub: fix detection of high tier USB3 devices behind suspended hubs net_sched: sch_sfq: reject invalid perturb period net_sched: sch_sfq: move the limit validation net_sched: sch_sfq: use a temporary work area for validating configuration net_sched: sch_sfq: don't allow 1 packet limit net_sched: sch_sfq: handle bigger packets net_sched: sch_sfq: annotate data-races around q->perturb_period power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync power: supply: bq24190_charger: Fix runtime PM imbalance on error xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS virtio-net: ensure the received length does not exceed allocated size ASoC: fsl_sai: Force a software reset when starting in consumer mode usb: dwc3: qcom: Don't leave BCR asserted usb: musb: fix gadget state on disconnect net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout Bluetooth: SMP: If an unallowed command is received consider it a failure Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() usb: net: sierra: check for no status endpoint net/sched: sch_qfq: Fix race condition on qfq_aggregate net: emaclite: Fix missing pointer increment in aligned_read() comedi: Fix use of uninitialized data in insn_rw_emulate_bits() comedi: Fix some signed shift left operations comedi: das6402: Fix bit shift out of bounds comedi: das16m1: Fix bit shift out of bounds comedi: aio_iiro_16: Fix bit shift out of bounds comedi: pcl812: Fix bit shift out of bounds iio: adc: stm32-adc: Fix race in installing chained IRQ handler iio: adc: max1363: Reorder mode_list[] entries iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order mmc: sdhci_am654: Workaround for Errata i2312 mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models mmc: bcm2835: Fix dma_unmap_sg() nents value memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() isofs: Verify inode mode when loading from disk dmaengine: nbpfaxi: Fix memory corruption in probe() af_packet: fix soft lockup issue caused by tpacket_snd() af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() HID: core: do not bypass hid_hw_raw_request HID: core: ensure __hid_request reserves the report ID as the first byte HID: core: ensure the allocated report buffer can contain the reserved report ID pch_uart: Fix dma_sync_sg_for_device() nents value Input: xpad - set correct controller type for Acer NGR200 i2c: stm32: fix the device used for the DMA map usb: gadget: configfs: Fix OOB read on empty string write USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI USB: serial: option: add Foxconn T99W640 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition Conflicts: drivers/soc/qcom/mdt_loader.c drivers/usb/dwc3/dwc3-qcom.c drivers/usb/host/xhci-plat.c mm/slub.c mm/zsmalloc.c Change-Id: I83183b507249a323eba0ecec4c7b4b04d76cc7f6 |
||
|
Greg Kroah-Hartman
|
901ffda291 |
This is the 5.4.300 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjeY04ACgkQONu9yGCS aT7jARAAtuC4ENHOhlmT+k8n2jrrNZ5RPHsFipG61AFMkXlTVDxF+ysmlR4Z7i7h fcVDqAfLBehA9rBHya/4A1WPsc5plXGLSy8Xl9C7243RnQRITBE6Y36ZB4MT5Lhy fWMmcE2X9YratNZ4X6pREueQgmtddNusEwB+ZJeYsa3byeLPB0yx9PhZUiitTpvI pLdp6hGtPAAOT8O0wuUhbHZ0khbeCiEmrMXbP44DVjjgAfcdMid+6/x76fgMJZ++ gT8UkkCN2dqMJnT4LgazVBjrCxfbXrU+YNgTkU1O2k3ZINYdYWXZ1Aw2uRIDYwhE NUAbmqZkcafinjhw2/DVp/Rys2zCSsYf9VaZR5BVd+qHNAFnRiw2mOKiynxN/+bT pr3gzw6/SD/faYGMtoFmFcv8COZGx9Az9f2LJmfUoi+ieV9sxQ6xW4c0xDW0ZsQD wp/PBcvKGy6A9WHqT1oQ1lHUrCUY4kZ3/ymPGy1xuyIoB3ILtXAa19LgFB1wMMo6 iPLBlXa+7GsluvYTYzFkJ7wA4BKgtvLONJ/ARyhG2jDpxHdMgikgdimiwmjaZyej uGoOm7Qmt5FPHt2dMlCj8DG120NuXwCgc4+tA/Y9iBVWrHZZsh0myCiO2TImnKwT pHrPWd4Rva8bgZClEFhulreW3evnWrVW3B6a4PJVMRb2csVdCjo= =FesN -----END PGP SIGNATURE----- Merge 5.4.300 into android11-5.4-lts Changes in 5.4.300 usb: hub: Fix flushing of delayed work used for post resume purposes net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. NFSv4: Don't clear capabilities that won't be reset tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. EDAC/altera: Delete an inappropriate dma_free_coherent() call ocfs2: fix recursive semaphore deadlock in fiemap call mtd: rawnand: stm32_fmc2: fix ECC overwrite fuse: check if copy_file_range() returns larger than requested size fuse: prevent overflow in copy_file_range return value mm/khugepaged: fix the address passed to notifier on testing young mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer mtd: nand: raw: atmel: Fix comment in timings preparation mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing tty: hvc_console: Call hvc_kick in hvc_write unconditionally USB: serial: option: add Telit Cinterion FN990A w/audio compositions USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() igb: fix link test skipping when interface is admin down genirq/affinity: Add irq_update_affinity_desc() genirq: Export affinity setter for modules genirq: Provide new interfaces for affinity hints i40e: Use irq_update_affinity_hint() i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails dmaengine: ti: edma: Fix memory allocation size for queue_priority_map dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees phy: ti-pipe3: fix device leak at unbind soc: qcom: mdt_loader: Deal with zero e_shentsize mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported wifi: mac80211: fix incorrect type for ret pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch cgroup: split cgroup_destroy_wq into 3 workqueues net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure i40e: remove redundant memory barrier when cleaning Tx descs tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" net: liquidio: fix overflow in octeon_init_instr_queue() cnic: Fix use-after-free bugs in cnic_delete_task nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery power: supply: bq27xxx: restrict no-battery detection to bq27000 mmc: mvsdio: Fix dma_unmap_sg() nents value rds: ib: Increment i_fastreg_wrs before bailing out ASoC: wm8940: Correct typo in control name ASoC: wm8974: Correct PLL rate rounding ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message usb: gadget: dummy_hcd: remove usage of list iterator past the loop body USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels serial: sc16is7xx: fix bug in flow control levels init net: rfkill: gpio: add DT support net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active ALSA: usb-audio: Fix block comments in mixer_quirks ALSA: usb-audio: Avoid multiple assignments in mixer_quirks ALSA: usb-audio: Simplify NULL comparison in mixer_quirks ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 ALSA: usb-audio: Convert comma to semicolon ALSA: usb-audio: Fix build with CONFIG_INPUT=n usb: core: Add 0x prefix to quirks debug output IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions can: rcar_can: rcar_can_resume(): fix s2ram with PSCI can: hi311x: populate ndo_change_mtu() to prevent buffer overflow can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow can: peak_usb: fix shift-out-of-bounds issue drm/gma500: Fix null dereference in hdmi teardown i40e: fix idx validation in i40e_validate_queue_map i40e: fix input validation logic for action_meta i40e: add max boundary check for VF filters fbcon: fix integer overflow in fbcon_do_set_font fbcon: Fix OOB access in font allocation mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() i40e: increase max descriptors for XL710 i40e: add validation for ring_len param i40e: fix idx validation in config queues msg i40e: fix validation of VF state in get resources i40e: add mask to apply valid bits for itr_idx mm/hugetlb: fix folio is still mapped when deleted Linux 5.4.300 Change-Id: I24b202860574c8b633ccc93f52ac4330e4ae51bf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Kuniyuki Iwashima
|
7ec092a91f |
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
[ Upstream commit 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 ]
syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk
in the TCP_ESTABLISHED state. [0]
syzbot reused the server-side TCP Fast Open socket as a new client before
the TFO socket completes 3WHS:
1. accept()
2. connect(AF_UNSPEC)
3. connect() to another destination
As of accept(), sk->sk_state is TCP_SYN_RECV, and tcp_disconnect() changes
it to TCP_CLOSE and makes connect() possible, which restarts timers.
Since tcp_disconnect() forgot to clear tcp_sk(sk)->fastopen_rsk, the
retransmit timer triggered the warning and the intended packet was not
retransmitted.
Let's call reqsk_fastopen_remove() in tcp_disconnect().
[0]:
WARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))
Modules linked in:
CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))
Code: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 <0f> 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e
RSP: 0018:ffffc900002f8d40 EFLAGS: 00010293
RAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017
RDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400
RBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8
R10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540
R13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0
FS: 0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0
Call Trace:
<IRQ>
tcp_write_timer (net/ipv4/tcp_timer.c:738)
call_timer_fn (kernel/time/timer.c:1747)
__run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)
timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)
tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)
__walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))
tmigr_handle_remote (kernel/time/timer_migration.c:1096)
handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)
irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))
</IRQ>
Fixes:
|
||
|
Kuniyuki Iwashima
|
08f58d10f5 |
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
[ Upstream commit a3967baad4d533dc254c31e0d221e51c8d223d58 ]
syzbot reported the splat below. [0]
The repro does the following:
1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes)
2. Attach the prog to a SOCKMAP
3. Add a socket to the SOCKMAP
4. Activate fault injection
5. Send data less than cork_bytes
At 5., the data is carried over to the next sendmsg() as it is
smaller than the cork_bytes specified by bpf_msg_cork_bytes().
Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold
the data, but this fails silently due to fault injection + __GFP_NOWARN.
If the allocation fails, we need to revert the sk->sk_forward_alloc
change done by sk_msg_alloc().
Let's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate
psock->cork.
The "*copied" also needs to be updated such that a proper error can
be returned to the caller, sendmsg. It fails to allocate psock->cork.
Nothing has been corked so far, so this patch simply sets "*copied"
to 0.
[0]:
WARNING: net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983
Modules linked in:
CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156
Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc
RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246
RAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80
RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000
RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4
R10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380
R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872
FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0
Call Trace:
<IRQ>
__sk_destruct+0x86/0x660 net/core/sock.c:2339
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
</IRQ>
Fixes:
|