From: Willem de Bruijn <willemb(a)google.com>
commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab upstream.
Detect gso fraglist skbs with corrupted geometry (see below) and
pass these to skb_segment instead of skb_segment_list, as the first
can segment them correctly.
Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size
Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify these skbs, breaking these invariants.
In extreme cases they pull all data into skb linear. For UDP, this
causes a NULL ptr deref in __udpv4_gso_segment_list_csum at
udp_hdr(seg->next)->dest.
Detect invalid geometry due to pull, by checking head_skb size.
Don't just drop, as this may blackhole a destination. Convert to be
able to pass to regular skb_segment.
Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediate…
Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
Signed-off-by: Willem de Bruijn <willemb(a)google.com>
Cc: stable(a)vger.kernel.org
Link: https://patch.msgid.link/20241001171752.107580-1-willemdebruijn.kernel@gmai…
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Signed-off-by: Alexey Nepomnyashih <sdl(a)nppct.ru>
---
net/ipv4/udp_offload.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index b6952b88b505..515d591d00b9 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -8,6 +8,7 @@
#include <linux/skbuff.h>
#include <net/udp.h>
+#include <net/ip6_checksum.h>
#include <net/protocol.h>
#include <net/inet_common.h>
@@ -269,8 +270,26 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
__sum16 check;
__be16 newlen;
- if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)
- return __udp_gso_segment_list(gso_skb, features, is_ipv6);
+ if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) {
+ /* Detect modified geometry and pass those to skb_segment. */
+ if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size)
+ return __udp_gso_segment_list(gso_skb, features, is_ipv6);
+
+ /* Setup csum, as fraglist skips this in udp4_gro_receive. */
+ gso_skb->csum_start = skb_transport_header(gso_skb) - gso_skb->head;
+ gso_skb->csum_offset = offsetof(struct udphdr, check);
+ gso_skb->ip_summed = CHECKSUM_PARTIAL;
+
+ uh = udp_hdr(gso_skb);
+ if (is_ipv6)
+ uh->check = ~udp_v6_check(gso_skb->len,
+ &ipv6_hdr(gso_skb)->saddr,
+ &ipv6_hdr(gso_skb)->daddr, 0);
+ else
+ uh->check = ~udp_v4_check(gso_skb->len,
+ ip_hdr(gso_skb)->saddr,
+ ip_hdr(gso_skb)->daddr, 0);
+ }
mss = skb_shinfo(gso_skb)->gso_size;
if (gso_skb->len <= sizeof(*uh) + mss)
--
2.43.0
This is the start of the stable review cycle for the 6.6.85 release.
There are 76 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 28 Mar 2025 15:43:33 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.85-rc2…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.6.85-rc2
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
netfilter: nft_counter: Use u64_stats_t for statistic.
Benjamin Berg <benjamin.berg(a)intel.com>
wifi: iwlwifi: mvm: ensure offloading TID queue exists
Miri Korenblit <miriam.rachel.korenblit(a)intel.com>
wifi: iwlwifi: support BIOS override for 5G9 in CA also in LARI version 8
Shravya KN <shravya.k-n(a)broadcom.com>
bnxt_en: Fix receive ring space parameters when XDP is active
Josef Bacik <josef(a)toxicpanda.com>
btrfs: make sure that WRITTEN is set on all metadata blocks
Dietmar Eggemann <dietmar.eggemann(a)arm.com>
Revert "sched/core: Reduce cost of sched_move_task when config autogroup"
Justin Klaassen <justin(a)tidylabs.net>
arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Eagerly switch ZCR_EL{1,2}
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Mark some header functions as inline
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Refactor exit handlers
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Remove host FPSIMD saving for non-protected KVM
Mark Rutland <mark.rutland(a)arm.com>
KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
Fuad Tabba <tabba(a)google.com>
KVM: arm64: Calculate cptr_el2 traps on activating traps
Arthur Mongodin <amongodin(a)randorisec.fr>
mptcp: Fix data stream corruption in the address announcement
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix incorrect validation for num_aces field of smb_acl
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd/display: Use HW lock mgr for PSR1 when only one eDP
Martin Tsai <martin.tsai(a)amd.com>
drm/amd/display: should support dmub hw lock on Replay
David Rosca <david.rosca(a)amd.com>
drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
David Rosca <david.rosca(a)amd.com>
drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size
qianyi liu <liuqianyi125(a)gmail.com>
drm/sched: Fix fence reference count leak
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
Saranya R <quic_sarar(a)quicinc.com>
soc: qcom: pdr: Fix the potential deadlock
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Ignore own maximum aggregation size during RX
Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru>
xsk: fix an integer overflow in xp_create_and_assign_umem()
Ard Biesheuvel <ardb(a)kernel.org>
efi/libstub: Avoid physical address 0x0 when doing random allocation
Geert Uytterhoeven <geert+renesas(a)glider.be>
ARM: shmobile: smp: Enforce shmobile_smp_* alignment
Stefan Eichenberger <stefan.eichenberger(a)toradex.com>
ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6
Shakeel Butt <shakeel.butt(a)linux.dev>
memcg: drain obj stock on cpu hotplug teardown
Ye Bin <yebin10(a)huawei.com>
proc: fix UAF in proc_get_inode()
Zi Yan <ziy(a)nvidia.com>
mm/migrate: fix shmem xarray update during migration
Raphael S. Carvalho <raphaelsc(a)scylladb.com>
mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT
Gu Bowen <gubowen5(a)huawei.com>
mmc: atmel-mci: Add missing clk_disable_unprepare()
Kamal Dasu <kamal.dasu(a)broadcom.com>
mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops
Quentin Schulz <quentin.schulz(a)cherry.de>
arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou
Stefan Eichenberger <stefan.eichenberger(a)toradex.com>
arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card
Stefan Eichenberger <stefan.eichenberger(a)toradex.com>
arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card
Dan Carpenter <dan.carpenter(a)linaro.org>
accel/qaic: Fix integer overflow in qaic_validate_req()
Christian Eggers <ceggers(a)arri.de>
regulator: check that dummy regulator has been probed before using it
Christian Eggers <ceggers(a)arri.de>
regulator: dummy: force synchronous probing
E Shattow <e(a)freeshell.de>
riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions
Maíra Canal <mcanal(a)igalia.com>
drm/v3d: Don't run jobs that have errors flagged in its fence
Haibo Chen <haibo.chen(a)nxp.com>
can: flexcan: disable transceiver during system PM
Haibo Chen <haibo.chen(a)nxp.com>
can: flexcan: only change CAN state when link up in system PM
Vincent Mailhol <mailhol.vincent(a)wanadoo.fr>
can: ucan: fix out of bound read in strscpy() source
Biju Das <biju.das.jz(a)bp.renesas.com>
can: rcar_canfd: Fix page entries in the AFL list
Andreas Kemnade <andreas(a)kemnade.info>
i2c: omap: fix IRQ storms
Guillaume Nault <gnault(a)redhat.com>
Revert "gre: Fix IPv6 link-local address generation."
Lin Ma <linma(a)zju.edu.cn>
net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
Justin Iurman <justin.iurman(a)uliege.be>
net: lwtunnel: fix recursion loops
Dan Carpenter <dan.carpenter(a)linaro.org>
net: atm: fix use after free in lec_send()
Kuniyuki Iwashima <kuniyu(a)amazon.com>
ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
Kuniyuki Iwashima <kuniyu(a)amazon.com>
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
David Lechner <dlechner(a)baylibre.com>
ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX
Jeffrey Hugo <quic_jhugo(a)quicinc.com>
accel/qaic: Fix possible data corruption in BOs > 2G
Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com>
Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters
Dan Carpenter <dan.carpenter(a)linaro.org>
Bluetooth: Fix error code in chan_alloc_skb_cb()
Junxian Huang <huangjunxian6(a)hisilicon.com>
RDMA/hns: Fix wrong value of max_sge_rd
Junxian Huang <huangjunxian6(a)hisilicon.com>
RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()
Junxian Huang <huangjunxian6(a)hisilicon.com>
RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
Junxian Huang <huangjunxian6(a)hisilicon.com>
RDMA/hns: Fix soft lockup during bt pages loop
Saravanan Vajravel <saravanan.vajravel(a)broadcom.com>
RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
Phil Elwell <phil(a)raspberrypi.com>
ARM: dts: bcm2711: Don't mark timer regs unconfigured
Arnd Bergmann <arnd(a)arndb.de>
ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP
Qasim Ijaz <qasdev00(a)gmail.com>
RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()
Kashyap Desai <kashyap.desai(a)broadcom.com>
RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
Yao Zi <ziyao(a)disroot.org>
arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1
Phil Elwell <phil(a)raspberrypi.com>
ARM: dts: bcm2711: PL011 UARTs are actually r1p5
Peng Fan <peng.fan(a)nxp.com>
soc: imx8m: Unregister cpufreq and soc dev in cleanup path
Marek Vasut <marex(a)denx.de>
soc: imx8m: Use devm_* to simplify probe failure handling
Marek Vasut <marex(a)denx.de>
soc: imx8m: Remove global soc_uid
Cosmin Ratiu <cratiu(a)nvidia.com>
xfrm_output: Force software GSO only in tunnel mode
Alexandre Cassen <acassen(a)corp.free.fr>
xfrm: fix tunnel mode TX datapath in packet offload mode
Alexander Stein <alexander.stein(a)ew.tq-group.com>
arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply
Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp>
firmware: imx-scu: fix OF node leak in .probe()
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/broadcom/bcm2711.dtsi | 11 +-
arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi | 10 +-
arch/arm/mach-davinci/Kconfig | 1 +
arch/arm/mach-omap1/Kconfig | 1 +
arch/arm/mach-shmobile/headsmp.S | 1 +
.../boot/dts/freescale/imx8mm-verdin-dahlia.dtsi | 6 +-
.../arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 16 +--
.../boot/dts/freescale/imx8mp-verdin-dahlia.dtsi | 6 +-
.../boot/dts/rockchip/px30-ringneck-haikou.dts | 2 +
arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 2 +-
arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 -
arch/arm64/include/asm/kvm_host.h | 7 +-
arch/arm64/include/asm/kvm_hyp.h | 1 +
arch/arm64/kernel/fpsimd.c | 25 ----
arch/arm64/kvm/arm.c | 1 -
arch/arm64/kvm/fpsimd.c | 89 +++---------
arch/arm64/kvm/hyp/entry.S | 5 +
arch/arm64/kvm/hyp/include/hyp/switch.h | 106 ++++++++++-----
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 15 +-
arch/arm64/kvm/hyp/nvhe/pkvm.c | 29 +---
arch/arm64/kvm/hyp/nvhe/switch.c | 112 ++++++++++-----
arch/arm64/kvm/hyp/vhe/switch.c | 13 +-
arch/arm64/kvm/reset.c | 3 +
arch/riscv/boot/dts/starfive/jh7110-pinfunc.h | 2 +-
drivers/accel/qaic/qaic_data.c | 9 +-
drivers/firmware/efi/libstub/randomalloc.c | 4 +
drivers/firmware/imx/imx-scu.c | 1 +
drivers/gpu/drm/amd/amdgpu/nv.c | 20 +--
drivers/gpu/drm/amd/amdgpu/soc15.c | 20 +--
drivers/gpu/drm/amd/amdgpu/vi.c | 36 ++---
.../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 15 ++
drivers/gpu/drm/radeon/radeon_vce.c | 2 +-
drivers/gpu/drm/scheduler/sched_entity.c | 11 +-
drivers/gpu/drm/v3d/v3d_sched.c | 9 +-
drivers/i2c/busses/i2c-omap.c | 26 +---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 -
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 +-
drivers/infiniband/hw/hns/hns_roce_hem.c | 16 ++-
drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_qp.c | 10 +-
drivers/infiniband/hw/mlx5/ah.c | 14 +-
drivers/mmc/host/atmel-mci.c | 4 +-
drivers/mmc/host/sdhci-brcmstb.c | 10 ++
drivers/net/can/flexcan/flexcan-core.c | 18 ++-
drivers/net/can/rcar/rcar_canfd.c | 28 ++--
drivers/net/can/usb/ucan.c | 43 +++---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +-
drivers/net/wireless/intel/iwlwifi/fw/file.h | 4 +-
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 9 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 37 ++++-
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 28 ++++
drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 3 +-
drivers/regulator/core.c | 12 +-
drivers/regulator/dummy.c | 2 +-
drivers/soc/imx/soc-imx8m.c | 151 ++++++++++-----------
drivers/soc/qcom/pdr_interface.c | 8 +-
fs/btrfs/tree-checker.c | 30 ++--
fs/btrfs/tree-checker.h | 1 +
fs/proc/generic.c | 10 +-
fs/proc/inode.c | 6 +-
fs/proc/internal.h | 14 ++
fs/smb/server/smbacl.c | 5 +-
include/linux/proc_fs.h | 7 +-
include/net/bluetooth/hci.h | 2 +-
kernel/sched/core.c | 22 +--
mm/filemap.c | 13 +-
mm/memcontrol.c | 9 ++
mm/migrate.c | 10 +-
net/atm/lec.c | 3 +-
net/batman-adv/bat_iv_ogm.c | 3 +-
net/batman-adv/bat_v_ogm.c | 3 +-
net/bluetooth/6lowpan.c | 7 +-
net/core/lwtunnel.c | 65 +++++++--
net/core/neighbour.c | 1 +
net/ipv6/addrconf.c | 15 +-
net/ipv6/route.c | 5 +-
net/mptcp/options.c | 6 +-
net/netfilter/nft_counter.c | 90 ++++++------
net/xdp/xsk_buff_pool.c | 2 +-
net/xfrm/xfrm_output.c | 43 +++++-
81 files changed, 808 insertions(+), 600 deletions(-)
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025032853-copy-crank-1c82@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb Mon Sep 17 00:00:00 2001
From: Shakeel Butt <shakeel.butt(a)linux.dev>
Date: Mon, 10 Mar 2025 16:09:34 -0700
Subject: [PATCH] memcg: drain obj stock on cpu hotplug teardown
Currently on cpu hotplug teardown, only memcg stock is drained but we
need to drain the obj stock as well otherwise we will miss the stats
accumulated on the target cpu as well as the nr_bytes cached. The stats
include MEMCG_KMEM, NR_SLAB_RECLAIMABLE_B & NR_SLAB_UNRECLAIMABLE_B. In
addition we are leaking reference to struct obj_cgroup object.
Link: https://lkml.kernel.org/r/20250310230934.2913113-1-shakeel.butt@linux.dev
Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
Signed-off-by: Shakeel Butt <shakeel.butt(a)linux.dev>
Reviewed-by: Roman Gushchin <roman.gushchin(a)linux.dev>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Muchun Song <muchun.song(a)linux.dev>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 8f9b35f80e24..a037ec92881d 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1921,9 +1921,18 @@ void drain_all_stock(struct mem_cgroup *root_memcg)
static int memcg_hotplug_cpu_dead(unsigned int cpu)
{
struct memcg_stock_pcp *stock;
+ struct obj_cgroup *old;
+ unsigned long flags;
stock = &per_cpu(memcg_stock, cpu);
+
+ /* drain_obj_stock requires stock_lock */
+ local_lock_irqsave(&memcg_stock.stock_lock, flags);
+ old = drain_obj_stock(stock);
+ local_unlock_irqrestore(&memcg_stock.stock_lock, flags);
+
drain_stock(stock);
+ obj_cgroup_put(old);
return 0;
}
Because Linux credentials are managed per thread, user space relies on
some hack to synchronize credential update across threads from the same
process. This is required by the Native POSIX Threads Library and
implemented by set*id(2) wrappers and libcap(3) to use tgkill(2) to
synchronize threads. See nptl(7) and libpsx(3). Furthermore, some
runtimes like Go do not enable developers to have control over threads
[1].
To avoid potential issues, and because threads are not security
boundaries, let's relax the Landlock (optional) signal scoping to always
allow signals sent between threads of the same process. This exception
is similar to the __ptrace_may_access() one.
hook_file_set_fowner() now checks if the target task is part of the same
process as the caller. If this is the case, then the related signal
triggered by the socket will always be allowed.
Scoping of abstract UNIX sockets is not changed because kernel objects
(e.g. sockets) should be tied to their creator's domain at creation
time.
Note that creating one Landlock domain per thread puts each of these
threads (and their future children) in their own scope, which is
probably not what users expect, especially in Go where we do not control
threads. However, being able to drop permissions on all threads should
not be restricted by signal scoping. We are working on a way to make it
possible to atomically restrict all threads of a process with the same
domain [2].
Add erratum for signal scoping.
Closes: https://github.com/landlock-lsm/go-landlock/issues/36
Fixes: 54a6e6bbf3be ("landlock: Add signal scoping")
Fixes: c8994965013e ("selftests/landlock: Test signal scoping for threads")
Depends-on: 26f204380a3c ("fs: Fix file_set_fowner LSM hook inconsistencies")
Link: https://pkg.go.dev/kernel.org/pub/linux/libs/security/libcap/psx [1]
Link: https://github.com/landlock-lsm/linux/issues/2 [2]
Cc: Günther Noack <gnoack(a)google.com>
Cc: Paul Moore <paul(a)paul-moore.com>
Cc: Serge Hallyn <serge(a)hallyn.com>
Cc: Tahera Fahimi <fahimitahera(a)gmail.com>
Cc: stable(a)vger.kernel.org
Acked-by: Christian Brauner <brauner(a)kernel.org>
Signed-off-by: Mickaël Salaün <mic(a)digikod.net>
Link: https://lore.kernel.org/r/20250318161443.279194-6-mic@digikod.net
---
Changes since v1:
- Add Acked-by Christian.
- Add Landlock erratum.
- Update subject.
---
security/landlock/errata/abi-6.h | 19 ++++++++++++++++
security/landlock/fs.c | 22 +++++++++++++++----
security/landlock/task.c | 12 ++++++++++
.../selftests/landlock/scoped_signal_test.c | 2 +-
4 files changed, 50 insertions(+), 5 deletions(-)
create mode 100644 security/landlock/errata/abi-6.h
diff --git a/security/landlock/errata/abi-6.h b/security/landlock/errata/abi-6.h
new file mode 100644
index 000000000000..df7bc0e1fdf4
--- /dev/null
+++ b/security/landlock/errata/abi-6.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+/**
+ * DOC: erratum_2
+ *
+ * Erratum 2: Scoped signal handling
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This fix addresses an issue where signal scoping was overly restrictive,
+ * preventing sandboxed threads from signaling other threads within the same
+ * process if they belonged to different domains. Because threads are not
+ * security boundaries, user space might assume that any thread within the same
+ * process can send signals between themselves (see :manpage:`nptl(7)` and
+ * :manpage:`libpsx(3)`). Consistent with :manpage:`ptrace(2)` behavior, direct
+ * interaction between threads of the same process should always be allowed.
+ * This change ensures that any thread is allowed to send signals to any other
+ * thread within the same process, regardless of their domain.
+ */
+LANDLOCK_ERRATUM(2)
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index 71b9dc331aae..47c862fe14e4 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -27,7 +27,9 @@
#include <linux/mount.h>
#include <linux/namei.h>
#include <linux/path.h>
+#include <linux/pid.h>
#include <linux/rcupdate.h>
+#include <linux/sched/signal.h>
#include <linux/spinlock.h>
#include <linux/stat.h>
#include <linux/types.h>
@@ -1630,15 +1632,27 @@ static int hook_file_ioctl_compat(struct file *file, unsigned int cmd,
static void hook_file_set_fowner(struct file *file)
{
- struct landlock_ruleset *new_dom, *prev_dom;
+ struct fown_struct *fown = file_f_owner(file);
+ struct landlock_ruleset *new_dom = NULL;
+ struct landlock_ruleset *prev_dom;
+ struct task_struct *p;
/*
* Lock already held by __f_setown(), see commit 26f204380a3c ("fs: Fix
* file_set_fowner LSM hook inconsistencies").
*/
- lockdep_assert_held(&file_f_owner(file)->lock);
- new_dom = landlock_get_current_domain();
- landlock_get_ruleset(new_dom);
+ lockdep_assert_held(&fown->lock);
+
+ /*
+ * Always allow sending signals between threads of the same process. This
+ * ensures consistency with hook_task_kill().
+ */
+ p = pid_task(fown->pid, fown->pid_type);
+ if (!same_thread_group(p, current)) {
+ new_dom = landlock_get_current_domain();
+ landlock_get_ruleset(new_dom);
+ }
+
prev_dom = landlock_file(file)->fown_domain;
landlock_file(file)->fown_domain = new_dom;
diff --git a/security/landlock/task.c b/security/landlock/task.c
index dc7dab78392e..4578ce6e319d 100644
--- a/security/landlock/task.c
+++ b/security/landlock/task.c
@@ -13,6 +13,7 @@
#include <linux/lsm_hooks.h>
#include <linux/rcupdate.h>
#include <linux/sched.h>
+#include <linux/sched/signal.h>
#include <net/af_unix.h>
#include <net/sock.h>
@@ -264,6 +265,17 @@ static int hook_task_kill(struct task_struct *const p,
/* Dealing with USB IO. */
dom = landlock_cred(cred)->domain;
} else {
+ /*
+ * Always allow sending signals between threads of the same process.
+ * This is required for process credential changes by the Native POSIX
+ * Threads Library and implemented by the set*id(2) wrappers and
+ * libcap(3) with tgkill(2). See nptl(7) and libpsx(3).
+ *
+ * This exception is similar to the __ptrace_may_access() one.
+ */
+ if (same_thread_group(p, current))
+ return 0;
+
dom = landlock_get_current_domain();
}
dom = landlock_get_applicable_domain(dom, signal_scope);
diff --git a/tools/testing/selftests/landlock/scoped_signal_test.c b/tools/testing/selftests/landlock/scoped_signal_test.c
index 475ee62a832d..767f117703b7 100644
--- a/tools/testing/selftests/landlock/scoped_signal_test.c
+++ b/tools/testing/selftests/landlock/scoped_signal_test.c
@@ -281,7 +281,7 @@ TEST(signal_scoping_threads)
/* Restricts the domain after creating the first thread. */
create_scoped_domain(_metadata, LANDLOCK_SCOPE_SIGNAL);
- ASSERT_EQ(EPERM, pthread_kill(no_sandbox_thread, 0));
+ ASSERT_EQ(0, pthread_kill(no_sandbox_thread, 0));
ASSERT_EQ(1, write(thread_pipe[1], ".", 1));
ASSERT_EQ(0, pthread_create(&scoped_thread, NULL, thread_func, NULL));
--
2.48.1
commit 8a7d12d674ac ("net: usb: usbnet: fix name regression") assumed
that local addresses always came from the kernel, but some devices hand
out local mac addresses so we ended up with point-to-point devices with
a mac set by the driver, renaming to eth%d when they used to be named
usb%d.
Userspace should not rely on device name, but for the sake of stability
restore the local mac address check portion of the naming exception:
point to point devices which either have no mac set by the driver or
have a local mac handed out by the driver will keep the usb%d name.
(some USB LTE modems are known to hand out a stable mac from the locally
administered range; that mac appears to be random (different for
mulitple devices) and can be reset with device-specific commands, so
while such devices would benefit from getting a OUI reserved, we have
to deal with these and might as well preserve the existing behavior
to avoid breaking fragile openwrt configurations and such on upgrade.)
Link: https://lkml.kernel.org/r/20241203130457.904325-1-asmadeus@codewreck.org
Fixes: 8a7d12d674ac ("net: usb: usbnet: fix name regression")
Cc: stable(a)vger.kernel.org
Tested-by: Ahmed Naseef <naseefkm(a)gmail.com>
Signed-off-by: Dominique Martinet <dominique.martinet(a)atmark-techno.com>
---
Changes in v2:
- Added Cc stable as requested
- Fix block comment style (checkpatch warning)
- Added some more details about the local device handing out local macs
and openwrt, thank you for the reminder Ahmed.
(FWIW this commit has been in our downstream tree all this time and we've
had no obvious errors due to it)
- Link to v1: https://lore.kernel.org/r/20241203130457.904325-1-asmadeus@codewreck.org
---
drivers/net/usb/usbnet.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 44179f4e807fc350f3d5710f0bc5f42e6414fd6e..aeab2308b15008185336f717172b090739f4f9d0 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -178,6 +178,17 @@ int usbnet_get_ethernet_addr(struct usbnet *dev, int iMACAddress)
}
EXPORT_SYMBOL_GPL(usbnet_get_ethernet_addr);
+static bool usbnet_needs_usb_name_format(struct usbnet *dev, struct net_device *net)
+{
+ /* Point to point devices which don't have a real MAC address
+ * (or report a fake local one) have historically used the usb%d
+ * naming. Preserve this..
+ */
+ return (dev->driver_info->flags & FLAG_POINTTOPOINT) != 0 &&
+ (is_zero_ether_addr(net->dev_addr) ||
+ is_local_ether_addr(net->dev_addr));
+}
+
static void intr_complete (struct urb *urb)
{
struct usbnet *dev = urb->context;
@@ -1762,13 +1773,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
if (status < 0)
goto out1;
- // heuristic: "usb%d" for links we know are two-host,
- // else "eth%d" when there's reasonable doubt. userspace
- // can rename the link if it knows better.
+ /* heuristic: rename to "eth%d" if we are not sure this link
+ * is two-host (these links keep "usb%d")
+ */
if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
- ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
- /* somebody touched it*/
- !is_zero_ether_addr(net->dev_addr)))
+ !usbnet_needs_usb_name_format(dev, net))
strscpy(net->name, "eth%d", sizeof(net->name));
/* WLAN devices should always be named "wlan%d" */
if ((dev->driver_info->flags & FLAG_WLAN) != 0)
---
base-commit: 0fed89a961ea851945d23cc35beb59d6e56c0964
change-id: 20250326-usbnet_rename-dff11e407634
Best regards,
--
Dominique Martinet <dominique.martinet(a)atmark-techno.com>