August 2023 - Linux-stable-mirror

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.325 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:08:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.325-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.325-rc1 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "ARM: ep93xx: fix missing-prototype warnings" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "MIPS: Alchemy: fix dbdma2" ------------- Diffstat: Makefile | 4 ++-- arch/arm/mach-ep93xx/timer-ep93xx.c | 3 +-- arch/mips/alchemy/common/dbdma.c | 27 ++++++++++++--------------- 3 files changed, 15 insertions(+), 19 deletions(-)

1 year, 3 months

4
5
0 0

[PATCH] file: always lock position

by Christian Brauner

By abusing new methods of file descriptor transferal it is possible to break the assumption that f_pos_lock doesn't need to be acquired when the caller is single threaded and the file_count(file) is one aka when the caller holds the only reference to the file. The explanation has two parts. The first part is about a new io_uring interface that isn't merged yet where I realized that only acquiring the lock when multiple references to a file are held would be broken in some circumstances. The second part illustrates that this assumption is already broken by abusing another interface. During review of the io_uring patchset for adding getdents support I pointed out various problems in the locking assumptions that were made. Effectively, the guts of __fdget_pos() were copied out and a trylock scheme for f_pos_lock was introduced. The approach overall is workable but the locking was wrong because it copied the file_count(file) greater than one optimization that __fdget_pos() had into io_uring. But this assumption is broken when fixed file descriptors are used. Short reminder of fixed files here via some C pseudo code: T1 (still single threaded) fd_register = open("/some/file") -----------------> f_count == 1 fd_fixed = io_uring_register_file(fd_register) -> io_sqe_files_register(fd_register) -> fget(fd_register) --------------------------> f_count == 2 -> io_fixed_file_set(fd_register) close(fd_register); -> close_fd(fd_register) -> file = pick_file() -> filp_close(file) -> fput(file) ------------------------------> f_count == 1 The caller has now traded a regular file descriptor reference for a fixed file reference. Such fixed files never use fget() again and thus fully eliminate any fget()/fput() overhead. However, for getdents f_pos_lock needs to be acquired as state may often be kept that requires synchronization with seek and other concurrent getdent requests. Since io_uring is an asynchronous interface it is of course possible to register multiple concurrent getdent calls that aren't synchronized by io_uring as that's never done unless the user requests specific chaining. And since the reference count for fixed files is always one it's possible to create multiple racing getdent requests if locking is conditional on file_count(file) being greater than one. That wouldn't be a problem since io_uring can just unconditionally take f_pos_lock and eliminate this problem for fixed files since they aren't usable with the regular system call api. However, while thinking about this I realized that a while ago the file_count(file) greater than one optimization was already broken and that concurrent read/write/getdents/seek calls are possible in the regular system call api. The pidfd_getfd() system call allows a caller with ptrace_may_access() abilities on another process to steal a file descriptor from this process. This system call is used by debuggers, container runtimes, system call supervisors, networking proxies etc (cf. [1]-[3]). So while it is a special interest system call it is used in common tools. Via pidfd_getfd() it's possible to intercept syscalls such as connect(2). For example, a container manager might want to rewrite the connect(2) request to something other than the task intended for security reasons or because the task lacks the necessary information about the networking layout to connect to the right endpoint. In these cases pidfd_getfd(2) can be used to retrieve a copy of the file descriptor of the task and perform the connect(2) for it. When used in combination with the seccomp notifier things are pretty simple. The intercepted task itself is blocked in the seccomp code. That code runs before the actual requested system call is performed. So the task is blocked before any system call is performed. The seccomp notifier will then notify the supervising process which holds the seccomp notifier fd. The supervisor can now call pidfd_getfd() while the target process is blocked and steal the file descriptor. It can then perform whatever operation it wants on that file descriptor and then tell seccomp to either return a specific return value to the task once it is unblocked or even continue the task using the SECCOMP_USER_NOTIF_FLAG_CONTINUE flag. One of the most useful things for pidfd_getfd() is that the target task from which the caller is about to steal a file descriptor doesn't need to be blocked or stopped. But that makes it possible for the target process to be in the middle of a read/write/getdents/seek system call while the caller is stealing the file on which that read/write/getdents/seek was issued and issuing a concurrent read/write/getdents/seek system call: P1 P2 getdents(fd) -> fdget_pos() { * @file->f_count == 1 * @current->files->count == 1 => not taking @file->f_pos_lock } fd = pidfd_getfd(fd) -> __pidfd_fget() -> fget_task() ----> f_count = 2 -> receive_fd() -> get_file() --> f_count = 3 -> fd_install() -> fput() ---------> f_count = 2 getdents(fd) -> fdget_pos() { * @file->f_count == 1 * @file->f_count == 2 => taking @file->f_pos_lock and bumping @file->f_count = 3 } -> vfs_readdir() -> vfs_readdir() -> fdput() -> fdput()---------> f_count = 2 Although I'm not happy about it, I'm somewhat confident that this analysis is correct but that the race is hard to hit in real life but with some ingenuity it might be possible to make it more reliable. However, I was lazy and introduced a luscious 10 second delay after fdget_pos() succeeded into vfs_read() that was triggerable by passing -1 as the buffer size to the read() system call. I then used the very very ugly program in [4] to enforce the order illustrated above. Lastly, I wrote a bpftrace program which attached a kretfunc to __fdget_pos() and a kfunc and a kretfunc to vfs_read(). The bpftrace program would only trigger if the target file with a specific inode number was read: Attaching 3 probes... fdget_pos() on file pointer 0xffff8b3500d6a300: name(stealme) | i_ino(1591) | pid(9690) FDPUT_POS_UNLOCK(0), count(1) => mutex not acquired vfs_read() on file pointer 0xffff8b3500d6a300: pid 9690 started reading from name(stealme) | i_ino(1591) fdget_pos() on file pointer 0xffff8b3500d6a300: name(stealme) | i_ino(1591) | pid(9691) FDPUT_POS_UNLOCK(2), count(2) => mutex acquired vfs_read() on file pointer 0xffff8b3500d6a300: pid 9691 started reading from name(stealme) | i_ino(1591) vfs_read() on file pointer 0xffff8b3500d6a300: pid 9690 finished reading from name(stealme) | i_ino(1591) vfs_read() on file pointer 0xffff8b3500d6a300: pid 9691 finished reading from name(stealme) | i_ino(1591) I thought about various ways to fix this such as introducing some mechanism to refuse pidfd_getfd() if the target process is in the middle of an fdget_pos() protected system call with file count being one up to just not caring about it at all. But it is pretty nasty to leave this race open and it feels like something that'll bite us later anyway. Plus, with io_uring having to acquire f_pos_lock unconditionally anyway for getdents support I'm not sure that deviation in locking semantics here is worth keeping. So remove the locking optimization for file count being one. We'll see if this has a significant performance impact. This survives xfstests and LTP. Link: https://github.com/rr-debugger/rr [1] Link: https://github.com/opencontainers/runc [2] Link: https://brauner.io/2020/07/23/seccomp-notify.html [3] Link: https://gist.github.com/brauner/599d31048c8adcb3aa0c537b76c89e12 [4] Fixes: 8649c322f75c ("pid: Implement pidfd_getfd syscall") Cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> --- --- fs/file.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/file.c b/fs/file.c index 7893ea161d77..35c62b54c9d6 100644 --- a/fs/file.c +++ b/fs/file.c @@ -1042,10 +1042,8 @@ unsigned long __fdget_pos(unsigned int fd) struct file *file = (struct file *)(v & ~3); if (file && (file->f_mode & FMODE_ATOMIC_POS)) { - if (file_count(file) > 1) { - v |= FDPUT_POS_UNLOCK; - mutex_lock(&file->f_pos_lock); - } + v |= FDPUT_POS_UNLOCK; + mutex_lock(&file->f_pos_lock); } return v; } --- base-commit: 6eaae198076080886b9e7d57f4ae06fa782f90ef change-id: 20230724-vfs-fdget_pos-c6540e3ed7d9

1 year, 3 months

7
36
0 0

[PATCH 5.15 0/9] 5.15.130-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.130 release. There are 9 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:08:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.130-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.130-rc1 Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Add trc_inspect_reader() checks for exiting critical section Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Wait for trc_read_check_handler() IPIs Neeraj Upadhyay <neeraju(a)codeaurora.org> rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader Paul E. McKenney <paulmck(a)kernel.org> rcu: Prevent expedited GP from enabling tick on offline CPU James Morse <james.morse(a)arm.com> ARM: module: Use module_init_layout_section() to spot init sections James Morse <james.morse(a)arm.com> arm64: module: Use module_init_layout_section() to spot init sections Arnd Bergmann <arnd(a)arndb.de> arm64: module-plts: inline linux/moduleloader.h James Morse <james.morse(a)arm.com> module: Expose module_init_layout_section() Mario Limonciello <mario.limonciello(a)amd.com> ACPI: thermal: Drop nocrt parameter ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 4 --- Makefile | 4 +-- arch/arm/kernel/module-plts.c | 2 +- arch/arm64/kernel/module-plts.c | 3 ++- drivers/acpi/thermal.c | 6 +---- include/linux/moduleloader.h | 5 ++++ kernel/module.c | 2 +- kernel/rcu/tasks.h | 36 ++++++++++++++++++------- kernel/rcu/tree_exp.h | 5 +++- 9 files changed, 42 insertions(+), 25 deletions(-)

1 year, 3 months

9
17
0 0

[PATCH 6.5 0/8] 6.5.1-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.5.1 release. There are 8 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:08:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.1-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.5.1-rc1 Yonghong Song <yonghong.song(a)linux.dev> kallsyms: Fix kallsyms_selftest failure Helge Deller <deller(a)gmx.de> lockdep: fix static memory detection even more Eric Dumazet <edumazet(a)google.com> ipv6: remove hard coded limitation on ipv6_pinfo Andrea Righi <andrea.righi(a)canonical.com> module/decompress: use vmalloc() for zstd decompression workspace James Morse <james.morse(a)arm.com> ARM: module: Use module_init_layout_section() to spot init sections James Morse <james.morse(a)arm.com> arm64: module: Use module_init_layout_section() to spot init sections James Morse <james.morse(a)arm.com> module: Expose module_init_layout_section() Mario Limonciello <mario.limonciello(a)amd.com> ACPI: thermal: Drop nocrt parameter ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 4 --- Makefile | 4 +-- arch/arm/kernel/module-plts.c | 2 +- arch/arm64/kernel/module-plts.c | 2 +- arch/x86/include/asm/sections.h | 18 ------------- drivers/acpi/thermal.c | 6 +---- include/linux/ipv6.h | 15 +++-------- include/linux/moduleloader.h | 5 ++++ include/net/sock.h | 1 + kernel/kallsyms.c | 17 +++++------- kernel/kallsyms_selftest.c | 23 +--------------- kernel/locking/lockdep.c | 36 ++++++++++--------------- kernel/module/decompress.c | 4 +-- kernel/module/main.c | 2 +- net/dccp/ipv6.c | 1 + net/dccp/ipv6.h | 4 --- net/ipv6/af_inet6.c | 4 +-- net/ipv6/ping.c | 1 + net/ipv6/raw.c | 1 + net/ipv6/tcp_ipv6.c | 1 + net/ipv6/udp.c | 1 + net/ipv6/udplite.c | 1 + net/l2tp/l2tp_ip6.c | 4 +-- net/mptcp/protocol.c | 1 + net/sctp/socket.c | 1 + 25 files changed, 51 insertions(+), 108 deletions(-)

1 year, 3 months

8
15
0 0

[PATCH 6.4 0/9] 6.4.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.4.14 release. There are 9 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:11:18 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.14-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.4.14-rc1 Yonghong Song <yonghong.song(a)linux.dev> kallsyms: Fix kallsyms_selftest failure Helge Deller <deller(a)gmx.de> parisc: sys_parisc: parisc_personality() is called from asm code Helge Deller <deller(a)gmx.de> lockdep: fix static memory detection even more James Morse <james.morse(a)arm.com> ARM: module: Use module_init_layout_section() to spot init sections James Morse <james.morse(a)arm.com> arm64: module: Use module_init_layout_section() to spot init sections Arnd Bergmann <arnd(a)arndb.de> arm64: module-plts: inline linux/moduleloader.h James Morse <james.morse(a)arm.com> module: Expose module_init_layout_section() Andrea Righi <andrea.righi(a)canonical.com> module/decompress: use vmalloc() for zstd decompression workspace Mario Limonciello <mario.limonciello(a)amd.com> ACPI: thermal: Drop nocrt parameter ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 4 --- Makefile | 4 +-- arch/arm/kernel/module-plts.c | 2 +- arch/arm64/kernel/module-plts.c | 3 ++- arch/parisc/kernel/sys_parisc.c | 3 ++- arch/x86/include/asm/sections.h | 18 ------------- drivers/acpi/thermal.c | 6 +---- include/linux/moduleloader.h | 5 ++++ kernel/kallsyms.c | 17 +++++------- kernel/kallsyms_selftest.c | 23 +--------------- kernel/locking/lockdep.c | 36 ++++++++++--------------- kernel/module/decompress.c | 4 +-- kernel/module/main.c | 2 +- 13 files changed, 38 insertions(+), 89 deletions(-)

1 year, 3 months

11
19
0 0

[PATCH 6.1 00/10] 6.1.51-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.51 release. There are 10 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:08:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.51-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.51-rc1 Yonghong Song <yonghong.song(a)linux.dev> kallsyms: Fix kallsyms_selftest failure Helge Deller <deller(a)gmx.de> io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc Helge Deller <deller(a)gmx.de> parisc: sys_parisc: parisc_personality() is called from asm code John David Anglin <dave(a)parisc-linux.org> parisc: Cleanup mmap implementation regarding color alignment Helge Deller <deller(a)gmx.de> lockdep: fix static memory detection even more James Morse <james.morse(a)arm.com> ARM: module: Use module_init_layout_section() to spot init sections James Morse <james.morse(a)arm.com> arm64: module: Use module_init_layout_section() to spot init sections Arnd Bergmann <arnd(a)arndb.de> arm64: module-plts: inline linux/moduleloader.h James Morse <james.morse(a)arm.com> module: Expose module_init_layout_section() Mario Limonciello <mario.limonciello(a)amd.com> ACPI: thermal: Drop nocrt parameter ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 4 - Makefile | 4 +- arch/arm/kernel/module-plts.c | 2 +- arch/arm64/kernel/module-plts.c | 3 +- arch/parisc/kernel/sys_parisc.c | 173 +++++++++--------------- arch/x86/include/asm/sections.h | 18 --- drivers/acpi/thermal.c | 6 +- include/linux/moduleloader.h | 5 + io_uring/io_uring.c | 46 +++++++ kernel/kallsyms.c | 17 +-- kernel/locking/lockdep.c | 36 ++--- kernel/module/main.c | 2 +- 12 files changed, 146 insertions(+), 170 deletions(-)

1 year, 3 months

11
20
0 0

[PATCH 5.4 0/3] 5.4.256-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.256 release. There are 3 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:08:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.256-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.256-rc1 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "MIPS: Alchemy: fix dbdma2" YueHaibing <yuehaibing(a)huawei.com> powerpc/pmac/smp: Drop unnecessary volatile qualifier Ilie Halip <ilie.halip(a)gmail.com> powerpc/pmac/smp: Avoid unused-variable warnings ------------- Diffstat: Makefile | 4 ++-- arch/mips/alchemy/common/dbdma.c | 27 ++++++++++++--------------- arch/powerpc/platforms/powermac/smp.c | 8 ++++---- 3 files changed, 18 insertions(+), 21 deletions(-)

1 year, 3 months

7
9
0 0

[PATCH 4.19 0/2] 4.19.294-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.294 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 17:22:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.294-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.294-rc2 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "ARM: ep93xx: fix missing-prototype warnings" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "MIPS: Alchemy: fix dbdma2" ------------- Diffstat: Makefile | 4 ++-- arch/arm/mach-ep93xx/timer-ep93xx.c | 3 +-- arch/mips/alchemy/common/dbdma.c | 27 ++++++++++++--------------- 3 files changed, 15 insertions(+), 19 deletions(-)

1 year, 3 months

5
4
0 0

[PATCH 4.19 0/1] 4.19.294-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.294 release. There are 1 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 02 Sep 2023 11:08:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.294-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.294-rc1 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "MIPS: Alchemy: fix dbdma2" ------------- Diffstat: Makefile | 4 ++-- arch/mips/alchemy/common/dbdma.c | 27 ++++++++++++--------------- 2 files changed, 14 insertions(+), 17 deletions(-)

1 year, 3 months

3
4
0 0

[PATCH v3] skbuff: skb_segment, Call zero copy functions before using skbuff frags

by Mohamed Khalfella

Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy functions in skb_segment(). The change introduced a bug in skb_segment() because skb_orphan_frags() may possibly change the number of fragments or allocate new fragments altogether leaving nrfrags and frag to point to the old values. This can cause a panic with stacktrace like the one below. [ 193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc [ 193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G O 5.15.123+ #26 [ 193.903919] RIP: 0010:skb_segment+0xb0e/0x12f0 [ 194.021892] Call Trace: [ 194.027422] <TASK> [ 194.072861] tcp_gso_segment+0x107/0x540 [ 194.082031] inet_gso_segment+0x15c/0x3d0 [ 194.090783] skb_mac_gso_segment+0x9f/0x110 [ 194.095016] __skb_gso_segment+0xc1/0x190 [ 194.103131] netem_enqueue+0x290/0xb10 [sch_netem] [ 194.107071] dev_qdisc_enqueue+0x16/0x70 [ 194.110884] __dev_queue_xmit+0x63b/0xb30 [ 194.121670] bond_start_xmit+0x159/0x380 [bonding] [ 194.128506] dev_hard_start_xmit+0xc3/0x1e0 [ 194.131787] __dev_queue_xmit+0x8a0/0xb30 [ 194.138225] macvlan_start_xmit+0x4f/0x100 [macvlan] [ 194.141477] dev_hard_start_xmit+0xc3/0x1e0 [ 194.144622] sch_direct_xmit+0xe3/0x280 [ 194.147748] __dev_queue_xmit+0x54a/0xb30 [ 194.154131] tap_get_user+0x2a8/0x9c0 [tap] [ 194.157358] tap_sendmsg+0x52/0x8e0 [tap] [ 194.167049] handle_tx_zerocopy+0x14e/0x4c0 [vhost_net] [ 194.173631] handle_tx+0xcd/0xe0 [vhost_net] [ 194.176959] vhost_worker+0x76/0xb0 [vhost] [ 194.183667] kthread+0x118/0x140 [ 194.190358] ret_from_fork+0x1f/0x30 [ 194.193670] </TASK> In this case calling skb_orphan_frags() updated nr_frags leaving nrfrags local variable in skb_segment() stale. This resulted in the code hitting i >= nrfrags prematurely and trying to move to next frag_skb using list_skb pointer, which was NULL, and caused kernel panic. Move the call to zero copy functions before using frags and nr_frags. Fixes: bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") Signed-off-by: Mohamed Khalfella <mkhalfella(a)purestorage.com> Reported-by: Amit Goyal <agoyal(a)purestorage.com> Cc: stable(a)vger.kernel.org --- net/core/skbuff.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a298992060e6..74a8829a6b59 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4354,21 +4354,20 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, struct sk_buff *segs = NULL; struct sk_buff *tail = NULL; struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list; - skb_frag_t *frag = skb_shinfo(head_skb)->frags; unsigned int mss = skb_shinfo(head_skb)->gso_size; unsigned int doffset = head_skb->data - skb_mac_header(head_skb); - struct sk_buff *frag_skb = head_skb; unsigned int offset = doffset; unsigned int tnl_hlen = skb_tnl_header_len(head_skb); unsigned int partial_segs = 0; unsigned int headroom; unsigned int len = head_skb->len; + struct sk_buff *frag_skb; + skb_frag_t *frag; __be16 proto; bool csum, sg; - int nfrags = skb_shinfo(head_skb)->nr_frags; int err = -ENOMEM; int i = 0; - int pos; + int nfrags, pos; if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) && mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) { @@ -4445,6 +4444,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, headroom = skb_headroom(head_skb); pos = skb_headlen(head_skb); + if (skb_orphan_frags(head_skb, GFP_ATOMIC)) + return ERR_PTR(-ENOMEM); + + nfrags = skb_shinfo(head_skb)->nr_frags; + frag = skb_shinfo(head_skb)->frags; + frag_skb = head_skb; + do { struct sk_buff *nskb; skb_frag_t *nskb_frag; @@ -4465,6 +4471,10 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, (skb_headlen(list_skb) == len || sg)) { BUG_ON(skb_headlen(list_skb) > len); + nskb = skb_clone(list_skb, GFP_ATOMIC); + if (unlikely(!nskb)) + goto err; + i = 0; nfrags = skb_shinfo(list_skb)->nr_frags; frag = skb_shinfo(list_skb)->frags; @@ -4483,12 +4493,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, frag++; } - nskb = skb_clone(list_skb, GFP_ATOMIC); list_skb = list_skb->next; - if (unlikely(!nskb)) - goto err; - if (unlikely(pskb_trim(nskb, len))) { kfree_skb(nskb); goto err; @@ -4564,12 +4570,16 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags & SKBFL_SHARED_FRAG; - if (skb_orphan_frags(frag_skb, GFP_ATOMIC) || - skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) + if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) goto err; while (pos < offset + len) { if (i >= nfrags) { + if (skb_orphan_frags(list_skb, GFP_ATOMIC) || + skb_zerocopy_clone(nskb, list_skb, + GFP_ATOMIC)) + goto err; + i = 0; nfrags = skb_shinfo(list_skb)->nr_frags; frag = skb_shinfo(list_skb)->frags; @@ -4583,10 +4593,6 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, i--; frag--; } - if (skb_orphan_frags(frag_skb, GFP_ATOMIC) || - skb_zerocopy_clone(nskb, frag_skb, - GFP_ATOMIC)) - goto err; list_skb = list_skb->next; } -- 2.17.1

1 year, 3 months

3
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2023