+++ /dev/null
-From 51e5b780d2d54efc8b3b92908c9789622a1e9603 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 7 Sep 2024 16:07:49 +0200
-Subject: netfilter: nft_socket: make cgroupsv2 matching work with namespaces
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 7f3287db654395f9c5ddd246325ff7889f550286 ]
-
-When running in container environmment, /sys/fs/cgroup/ might not be
-the real root node of the sk-attached cgroup.
-
-Example:
-
-In container:
-% stat /sys//fs/cgroup/
-Device: 0,21 Inode: 2214 ..
-% stat /sys/fs/cgroup/foo
-Device: 0,21 Inode: 2264 ..
-
-The expectation would be for:
-
- nft add rule .. socket cgroupv2 level 1 "foo" counter
-
-to match traffic from a process that got added to "foo" via
-"echo $pid > /sys/fs/cgroup/foo/cgroup.procs".
-
-However, 'level 3' is needed to make this work.
-
-Seen from initial namespace, the complete hierarchy is:
-
-% stat /sys/fs/cgroup/system.slice/docker-.../foo
- Device: 0,21 Inode: 2264 ..
-
-i.e. hierarchy is
-0 1 2 3
-/ -> system.slice -> docker-1... -> foo
-
-... but the container doesn't know that its "/" is the "docker-1.."
-cgroup. Current code will retrieve the 'system.slice' cgroup node
-and store its kn->id in the destination register, so compare with
-2264 ("foo" cgroup id) will not match.
-
-Fetch "/" cgroup from ->init() and add its level to the level we try to
-extract. cgroup root-level is 0 for the init-namespace or the level
-of the ancestor that is exposed as the cgroup root inside the container.
-
-In the above case, cgrp->level of "/" resolved in the container is 2
-(docker-1...scope/) and request for 'level 1' will get adjusted
-to fetch the actual level (3).
-
-v2: use CONFIG_SOCK_CGROUP_DATA, eval function depends on it.
- (kernel test robot)
-
-Cc: cgroups@vger.kernel.org
-Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")
-Reported-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/nft_socket.c | 41 +++++++++++++++++++++++++++++++++++---
- 1 file changed, 38 insertions(+), 3 deletions(-)
-
-diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
-index 0f37738e4b26..8722f712c019 100644
---- a/net/netfilter/nft_socket.c
-+++ b/net/netfilter/nft_socket.c
-@@ -9,7 +9,8 @@
-
- struct nft_socket {
- enum nft_socket_keys key:8;
-- u8 level;
-+ u8 level; /* cgroupv2 level to extract */
-+ u8 level_user; /* cgroupv2 level provided by userspace */
- u8 len;
- union {
- u8 dreg;
-@@ -53,6 +54,28 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo
- memcpy(dest, &cgid, sizeof(u64));
- return true;
- }
-+
-+/* process context only, uses current->nsproxy. */
-+static noinline int nft_socket_cgroup_subtree_level(void)
-+{
-+ struct cgroup *cgrp = cgroup_get_from_path("/");
-+ int level;
-+
-+ if (!cgrp)
-+ return -ENOENT;
-+
-+ level = cgrp->level;
-+
-+ cgroup_put(cgrp);
-+
-+ if (WARN_ON_ONCE(level > 255))
-+ return -ERANGE;
-+
-+ if (WARN_ON_ONCE(level < 0))
-+ return -EINVAL;
-+
-+ return level;
-+}
- #endif
-
- static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
-@@ -174,9 +197,10 @@ static int nft_socket_init(const struct nft_ctx *ctx,
- case NFT_SOCKET_MARK:
- len = sizeof(u32);
- break;
--#ifdef CONFIG_CGROUPS
-+#ifdef CONFIG_SOCK_CGROUP_DATA
- case NFT_SOCKET_CGROUPV2: {
- unsigned int level;
-+ int err;
-
- if (!tb[NFTA_SOCKET_LEVEL])
- return -EINVAL;
-@@ -185,6 +209,17 @@ static int nft_socket_init(const struct nft_ctx *ctx,
- if (level > 255)
- return -EOPNOTSUPP;
-
-+ err = nft_socket_cgroup_subtree_level();
-+ if (err < 0)
-+ return err;
-+
-+ priv->level_user = level;
-+
-+ level += err;
-+ /* Implies a giant cgroup tree */
-+ if (WARN_ON_ONCE(level > 255))
-+ return -EOPNOTSUPP;
-+
- priv->level = level;
- len = sizeof(u64);
- break;
-@@ -209,7 +244,7 @@ static int nft_socket_dump(struct sk_buff *skb,
- if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg))
- return -1;
- if (priv->key == NFT_SOCKET_CGROUPV2 &&
-- nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level)))
-+ nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user)))
- return -1;
- return 0;
- }
---
-2.43.0
-
octeontx2-af-modify-smq-flush-sequence-to-drop-packe.patch
net-ftgmac100-enable-tx-interrupt-to-avoid-tx-timeou.patch
netfilter-nft_socket-fix-sk-refcount-leaks.patch
-netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch
net-dpaa-pad-packets-to-eth_zlen.patch
spi-nxp-fspi-fix-the-kasan-report-out-of-bounds-bug.patch
soundwire-stream-revert-soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/hsr/hsr_device.c | 4 ++++
+ net/hsr/hsr_device.c | 4 ++++
1 file changed, 4 insertions(+)
-diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
-index ac56784c327c..049e22bdaafb 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
-@@ -414,6 +414,9 @@ static void hsr_proxy_announce(struct timer_list *t)
+@@ -427,6 +427,9 @@ static void hsr_proxy_announce(struct ti
* of SAN nodes stored in ProxyNodeTable.
*/
interlink = hsr_port_get_hsr(hsr, HSR_PT_INTERLINK);
list_for_each_entry_rcu(node, &hsr->proxy_node_db, mac_list) {
if (hsr_addr_is_redbox(hsr, node->macaddress_A))
continue;
-@@ -428,6 +431,7 @@ static void hsr_proxy_announce(struct timer_list *t)
+@@ -441,6 +444,7 @@ static void hsr_proxy_announce(struct ti
mod_timer(&hsr->announce_proxy_timer, jiffies + interval);
}
rcu_read_unlock();
}
---
-2.43.0
-
+++ /dev/null
-From 2df9e4d98088c7ec91d973a55bb91ccaf4ac72c1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 4 Sep 2024 13:37:25 +0000
-Subject: net: hsr: remove seqnr_lock
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit b3c9e65eb227269ed72a115ba22f4f51b4e62b4d ]
-
-syzbot found a new splat [1].
-
-Instead of adding yet another spin_lock_bh(&hsr->seqnr_lock) /
-spin_unlock_bh(&hsr->seqnr_lock) pair, remove seqnr_lock
-and use atomic_t for hsr->sequence_nr and hsr->sup_sequence_nr.
-
-This also avoid a race in hsr_fill_info().
-
-Also remove interlink_sequence_nr which is unused.
-
-[1]
- WARNING: CPU: 1 PID: 9723 at net/hsr/hsr_forward.c:602 handle_std_frame+0x247/0x2c0 net/hsr/hsr_forward.c:602
-Modules linked in:
-CPU: 1 UID: 0 PID: 9723 Comm: syz.0.1657 Not tainted 6.11.0-rc6-syzkaller-00026-g88fac17500f4 #0
-Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
- RIP: 0010:handle_std_frame+0x247/0x2c0 net/hsr/hsr_forward.c:602
-Code: 49 8d bd b0 01 00 00 be ff ff ff ff e8 e2 58 25 00 31 ff 89 c5 89 c6 e8 47 53 a8 f6 85 ed 0f 85 5a ff ff ff e8 fa 50 a8 f6 90 <0f> 0b 90 e9 4c ff ff ff e8 cc e7 06 f7 e9 8f fe ff ff e8 52 e8 06
-RSP: 0018:ffffc90000598598 EFLAGS: 00010246
-RAX: 0000000000000000 RBX: ffffc90000598670 RCX: ffffffff8ae2c919
-RDX: ffff888024e94880 RSI: ffffffff8ae2c926 RDI: 0000000000000005
-RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
-R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
-R13: ffff8880627a8cc0 R14: 0000000000000000 R15: ffff888012b03c3a
-FS: 0000000000000000(0000) GS:ffff88802b700000(0063) knlGS:00000000f5696b40
-CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
-CR2: 0000000020010000 CR3: 00000000768b4000 CR4: 0000000000350ef0
-DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-Call Trace:
- <IRQ>
- hsr_fill_frame_info+0x2c8/0x360 net/hsr/hsr_forward.c:630
- fill_frame_info net/hsr/hsr_forward.c:700 [inline]
- hsr_forward_skb+0x7df/0x25c0 net/hsr/hsr_forward.c:715
- hsr_handle_frame+0x603/0x850 net/hsr/hsr_slave.c:70
- __netif_receive_skb_core.constprop.0+0xa3d/0x4330 net/core/dev.c:5555
- __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5737
- __netif_receive_skb_list net/core/dev.c:5804 [inline]
- netif_receive_skb_list_internal+0x753/0xda0 net/core/dev.c:5896
- gro_normal_list include/net/gro.h:515 [inline]
- gro_normal_list include/net/gro.h:511 [inline]
- napi_complete_done+0x23f/0x9a0 net/core/dev.c:6247
- gro_cell_poll+0x162/0x210 net/core/gro_cells.c:66
- __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6772
- napi_poll net/core/dev.c:6841 [inline]
- net_rx_action+0xa92/0x1010 net/core/dev.c:6963
- handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
- do_softirq kernel/softirq.c:455 [inline]
- do_softirq+0xb2/0xf0 kernel/softirq.c:442
- </IRQ>
- <TASK>
-
-Fixes: 06afd2c31d33 ("hsr: Synchronize sending frames to have always incremented outgoing seq nr.")
-Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/hsr/hsr_device.c | 35 ++++++++++-------------------------
- net/hsr/hsr_forward.c | 4 +---
- net/hsr/hsr_main.h | 6 ++----
- net/hsr/hsr_netlink.c | 2 +-
- 4 files changed, 14 insertions(+), 33 deletions(-)
-
-diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
-index e4cc6b78dcfc..ac56784c327c 100644
---- a/net/hsr/hsr_device.c
-+++ b/net/hsr/hsr_device.c
-@@ -231,9 +231,7 @@ static netdev_tx_t hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev)
- skb->dev = master->dev;
- skb_reset_mac_header(skb);
- skb_reset_mac_len(skb);
-- spin_lock_bh(&hsr->seqnr_lock);
- hsr_forward_skb(skb, master);
-- spin_unlock_bh(&hsr->seqnr_lock);
- } else {
- dev_core_stats_tx_dropped_inc(dev);
- dev_kfree_skb_any(skb);
-@@ -314,14 +312,10 @@ static void send_hsr_supervision_frame(struct hsr_port *port,
- set_hsr_stag_HSR_ver(hsr_stag, hsr->prot_version);
-
- /* From HSRv1 on we have separate supervision sequence numbers. */
-- spin_lock_bh(&hsr->seqnr_lock);
-- if (hsr->prot_version > 0) {
-- hsr_stag->sequence_nr = htons(hsr->sup_sequence_nr);
-- hsr->sup_sequence_nr++;
-- } else {
-- hsr_stag->sequence_nr = htons(hsr->sequence_nr);
-- hsr->sequence_nr++;
-- }
-+ if (hsr->prot_version > 0)
-+ hsr_stag->sequence_nr = htons(atomic_inc_return(&hsr->sup_sequence_nr));
-+ else
-+ hsr_stag->sequence_nr = htons(atomic_inc_return(&hsr->sequence_nr));
-
- hsr_stag->tlv.HSR_TLV_type = type;
- /* TODO: Why 12 in HSRv0? */
-@@ -343,13 +337,11 @@ static void send_hsr_supervision_frame(struct hsr_port *port,
- ether_addr_copy(hsr_sp->macaddress_A, hsr->macaddress_redbox);
- }
-
-- if (skb_put_padto(skb, ETH_ZLEN)) {
-- spin_unlock_bh(&hsr->seqnr_lock);
-+ if (skb_put_padto(skb, ETH_ZLEN))
- return;
-- }
-
- hsr_forward_skb(skb, port);
-- spin_unlock_bh(&hsr->seqnr_lock);
-+
- return;
- }
-
-@@ -374,9 +366,7 @@ static void send_prp_supervision_frame(struct hsr_port *master,
- set_hsr_stag_HSR_ver(hsr_stag, (hsr->prot_version ? 1 : 0));
-
- /* From HSRv1 on we have separate supervision sequence numbers. */
-- spin_lock_bh(&hsr->seqnr_lock);
-- hsr_stag->sequence_nr = htons(hsr->sup_sequence_nr);
-- hsr->sup_sequence_nr++;
-+ hsr_stag->sequence_nr = htons(atomic_inc_return(&hsr->sup_sequence_nr));
- hsr_stag->tlv.HSR_TLV_type = PRP_TLV_LIFE_CHECK_DD;
- hsr_stag->tlv.HSR_TLV_length = sizeof(struct hsr_sup_payload);
-
-@@ -384,13 +374,10 @@ static void send_prp_supervision_frame(struct hsr_port *master,
- hsr_sp = skb_put(skb, sizeof(struct hsr_sup_payload));
- ether_addr_copy(hsr_sp->macaddress_A, master->dev->dev_addr);
-
-- if (skb_put_padto(skb, ETH_ZLEN)) {
-- spin_unlock_bh(&hsr->seqnr_lock);
-+ if (skb_put_padto(skb, ETH_ZLEN))
- return;
-- }
-
- hsr_forward_skb(skb, master);
-- spin_unlock_bh(&hsr->seqnr_lock);
- }
-
- /* Announce (supervision frame) timer function
-@@ -621,11 +608,9 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
- if (res < 0)
- return res;
-
-- spin_lock_init(&hsr->seqnr_lock);
- /* Overflow soon to find bugs easier: */
-- hsr->sequence_nr = HSR_SEQNR_START;
-- hsr->sup_sequence_nr = HSR_SUP_SEQNR_START;
-- hsr->interlink_sequence_nr = HSR_SEQNR_START;
-+ atomic_set(&hsr->sequence_nr, HSR_SEQNR_START);
-+ atomic_set(&hsr->sup_sequence_nr, HSR_SUP_SEQNR_START);
-
- timer_setup(&hsr->announce_timer, hsr_announce, 0);
- timer_setup(&hsr->prune_timer, hsr_prune_nodes, 0);
-diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
-index 960ef386bc3a..9254037e9436 100644
---- a/net/hsr/hsr_forward.c
-+++ b/net/hsr/hsr_forward.c
-@@ -599,9 +599,7 @@ static void handle_std_frame(struct sk_buff *skb,
- if (port->type == HSR_PT_MASTER ||
- port->type == HSR_PT_INTERLINK) {
- /* Sequence nr for the master/interlink node */
-- lockdep_assert_held(&hsr->seqnr_lock);
-- frame->sequence_nr = hsr->sequence_nr;
-- hsr->sequence_nr++;
-+ frame->sequence_nr = atomic_inc_return(&hsr->sequence_nr);
- }
- }
-
-diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h
-index ab1f8d35d9dc..6f7bbf01f3e4 100644
---- a/net/hsr/hsr_main.h
-+++ b/net/hsr/hsr_main.h
-@@ -202,11 +202,9 @@ struct hsr_priv {
- struct timer_list prune_timer;
- struct timer_list prune_proxy_timer;
- int announce_count;
-- u16 sequence_nr;
-- u16 interlink_sequence_nr; /* Interlink port seq_nr */
-- u16 sup_sequence_nr; /* For HSRv1 separate seq_nr for supervision */
-+ atomic_t sequence_nr;
-+ atomic_t sup_sequence_nr; /* For HSRv1 separate seq_nr for supervision */
- enum hsr_version prot_version; /* Indicate if HSRv0, HSRv1 or PRPv1 */
-- spinlock_t seqnr_lock; /* locking for sequence_nr */
- spinlock_t list_lock; /* locking for node list */
- struct hsr_proto_ops *proto_ops;
- #define PRP_LAN_ID 0x5 /* 0x1010 for A and 0x1011 for B. Bit 0 is set
-diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
-index f6ff0b61e08a..8aea4ff5f49e 100644
---- a/net/hsr/hsr_netlink.c
-+++ b/net/hsr/hsr_netlink.c
-@@ -163,7 +163,7 @@ static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev)
-
- if (nla_put(skb, IFLA_HSR_SUPERVISION_ADDR, ETH_ALEN,
- hsr->sup_multicast_addr) ||
-- nla_put_u16(skb, IFLA_HSR_SEQ_NR, hsr->sequence_nr))
-+ nla_put_u16(skb, IFLA_HSR_SEQ_NR, atomic_read(&hsr->sequence_nr)))
- goto nla_put_failure;
- if (hsr->prot_version == PRP_V1)
- proto = HSR_PROTOCOL_PRP;
---
-2.43.0
-
+++ /dev/null
-From 3666ebb403366008bbbfaf723124e54828ea4d3b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 7 Sep 2024 16:07:49 +0200
-Subject: netfilter: nft_socket: make cgroupsv2 matching work with namespaces
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 7f3287db654395f9c5ddd246325ff7889f550286 ]
-
-When running in container environmment, /sys/fs/cgroup/ might not be
-the real root node of the sk-attached cgroup.
-
-Example:
-
-In container:
-% stat /sys//fs/cgroup/
-Device: 0,21 Inode: 2214 ..
-% stat /sys/fs/cgroup/foo
-Device: 0,21 Inode: 2264 ..
-
-The expectation would be for:
-
- nft add rule .. socket cgroupv2 level 1 "foo" counter
-
-to match traffic from a process that got added to "foo" via
-"echo $pid > /sys/fs/cgroup/foo/cgroup.procs".
-
-However, 'level 3' is needed to make this work.
-
-Seen from initial namespace, the complete hierarchy is:
-
-% stat /sys/fs/cgroup/system.slice/docker-.../foo
- Device: 0,21 Inode: 2264 ..
-
-i.e. hierarchy is
-0 1 2 3
-/ -> system.slice -> docker-1... -> foo
-
-... but the container doesn't know that its "/" is the "docker-1.."
-cgroup. Current code will retrieve the 'system.slice' cgroup node
-and store its kn->id in the destination register, so compare with
-2264 ("foo" cgroup id) will not match.
-
-Fetch "/" cgroup from ->init() and add its level to the level we try to
-extract. cgroup root-level is 0 for the init-namespace or the level
-of the ancestor that is exposed as the cgroup root inside the container.
-
-In the above case, cgrp->level of "/" resolved in the container is 2
-(docker-1...scope/) and request for 'level 1' will get adjusted
-to fetch the actual level (3).
-
-v2: use CONFIG_SOCK_CGROUP_DATA, eval function depends on it.
- (kernel test robot)
-
-Cc: cgroups@vger.kernel.org
-Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")
-Reported-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/nft_socket.c | 41 +++++++++++++++++++++++++++++++++++---
- 1 file changed, 38 insertions(+), 3 deletions(-)
-
-diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
-index 765ffd6e06bc..12cdff640492 100644
---- a/net/netfilter/nft_socket.c
-+++ b/net/netfilter/nft_socket.c
-@@ -9,7 +9,8 @@
-
- struct nft_socket {
- enum nft_socket_keys key:8;
-- u8 level;
-+ u8 level; /* cgroupv2 level to extract */
-+ u8 level_user; /* cgroupv2 level provided by userspace */
- u8 len;
- union {
- u8 dreg;
-@@ -53,6 +54,28 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo
- memcpy(dest, &cgid, sizeof(u64));
- return true;
- }
-+
-+/* process context only, uses current->nsproxy. */
-+static noinline int nft_socket_cgroup_subtree_level(void)
-+{
-+ struct cgroup *cgrp = cgroup_get_from_path("/");
-+ int level;
-+
-+ if (!cgrp)
-+ return -ENOENT;
-+
-+ level = cgrp->level;
-+
-+ cgroup_put(cgrp);
-+
-+ if (WARN_ON_ONCE(level > 255))
-+ return -ERANGE;
-+
-+ if (WARN_ON_ONCE(level < 0))
-+ return -EINVAL;
-+
-+ return level;
-+}
- #endif
-
- static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
-@@ -174,9 +197,10 @@ static int nft_socket_init(const struct nft_ctx *ctx,
- case NFT_SOCKET_MARK:
- len = sizeof(u32);
- break;
--#ifdef CONFIG_CGROUPS
-+#ifdef CONFIG_SOCK_CGROUP_DATA
- case NFT_SOCKET_CGROUPV2: {
- unsigned int level;
-+ int err;
-
- if (!tb[NFTA_SOCKET_LEVEL])
- return -EINVAL;
-@@ -185,6 +209,17 @@ static int nft_socket_init(const struct nft_ctx *ctx,
- if (level > 255)
- return -EOPNOTSUPP;
-
-+ err = nft_socket_cgroup_subtree_level();
-+ if (err < 0)
-+ return err;
-+
-+ priv->level_user = level;
-+
-+ level += err;
-+ /* Implies a giant cgroup tree */
-+ if (WARN_ON_ONCE(level > 255))
-+ return -EOPNOTSUPP;
-+
- priv->level = level;
- len = sizeof(u64);
- break;
-@@ -209,7 +244,7 @@ static int nft_socket_dump(struct sk_buff *skb,
- if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg))
- return -1;
- if (priv->key == NFT_SOCKET_CGROUPV2 &&
-- nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level)))
-+ nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user)))
- return -1;
- return 0;
- }
---
-2.43.0
-
cxl-restore-xor-d-position-bits-during-address-trans.patch
selftests-bpf-support-sock_stream-in-unix_inet_redir.patch
net-hsr-send-supervisory-frames-to-hsr-network-with-.patch
-net-hsr-remove-seqnr_lock.patch
hwmon-pmbus-conditionally-clear-individual-status-bi.patch
ice-fix-lldp-packets-dropping-after-changing-the-num.patch
ice-fix-accounting-for-filters-shared-by-multiple-vs.patch
drivers-perf-fix-smp_processor_id-use-in-preemptible.patch
riscv-disable-preemption-while-handling-pr_riscv_ctx.patch
netfilter-nft_socket-fix-sk-refcount-leaks.patch
-netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch
net-hsr-prevent-null-pointer-dereference-in-hsr_prox.patch
net-dsa-felix-ignore-pending-status-of-tas-module-wh.patch
net-dpaa-pad-packets-to-eth_zlen.patch
+++ /dev/null
-From 5dd0738faba0150678d02eb8e04277fa8c242a77 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 7 Sep 2024 16:07:49 +0200
-Subject: netfilter: nft_socket: make cgroupsv2 matching work with namespaces
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit 7f3287db654395f9c5ddd246325ff7889f550286 ]
-
-When running in container environmment, /sys/fs/cgroup/ might not be
-the real root node of the sk-attached cgroup.
-
-Example:
-
-In container:
-% stat /sys//fs/cgroup/
-Device: 0,21 Inode: 2214 ..
-% stat /sys/fs/cgroup/foo
-Device: 0,21 Inode: 2264 ..
-
-The expectation would be for:
-
- nft add rule .. socket cgroupv2 level 1 "foo" counter
-
-to match traffic from a process that got added to "foo" via
-"echo $pid > /sys/fs/cgroup/foo/cgroup.procs".
-
-However, 'level 3' is needed to make this work.
-
-Seen from initial namespace, the complete hierarchy is:
-
-% stat /sys/fs/cgroup/system.slice/docker-.../foo
- Device: 0,21 Inode: 2264 ..
-
-i.e. hierarchy is
-0 1 2 3
-/ -> system.slice -> docker-1... -> foo
-
-... but the container doesn't know that its "/" is the "docker-1.."
-cgroup. Current code will retrieve the 'system.slice' cgroup node
-and store its kn->id in the destination register, so compare with
-2264 ("foo" cgroup id) will not match.
-
-Fetch "/" cgroup from ->init() and add its level to the level we try to
-extract. cgroup root-level is 0 for the init-namespace or the level
-of the ancestor that is exposed as the cgroup root inside the container.
-
-In the above case, cgrp->level of "/" resolved in the container is 2
-(docker-1...scope/) and request for 'level 1' will get adjusted
-to fetch the actual level (3).
-
-v2: use CONFIG_SOCK_CGROUP_DATA, eval function depends on it.
- (kernel test robot)
-
-Cc: cgroups@vger.kernel.org
-Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")
-Reported-by: Nadia Pinaeva <n.m.pinaeva@gmail.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/nft_socket.c | 41 +++++++++++++++++++++++++++++++++++---
- 1 file changed, 38 insertions(+), 3 deletions(-)
-
-diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
-index 765ffd6e06bc..12cdff640492 100644
---- a/net/netfilter/nft_socket.c
-+++ b/net/netfilter/nft_socket.c
-@@ -9,7 +9,8 @@
-
- struct nft_socket {
- enum nft_socket_keys key:8;
-- u8 level;
-+ u8 level; /* cgroupv2 level to extract */
-+ u8 level_user; /* cgroupv2 level provided by userspace */
- u8 len;
- union {
- u8 dreg;
-@@ -53,6 +54,28 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo
- memcpy(dest, &cgid, sizeof(u64));
- return true;
- }
-+
-+/* process context only, uses current->nsproxy. */
-+static noinline int nft_socket_cgroup_subtree_level(void)
-+{
-+ struct cgroup *cgrp = cgroup_get_from_path("/");
-+ int level;
-+
-+ if (!cgrp)
-+ return -ENOENT;
-+
-+ level = cgrp->level;
-+
-+ cgroup_put(cgrp);
-+
-+ if (WARN_ON_ONCE(level > 255))
-+ return -ERANGE;
-+
-+ if (WARN_ON_ONCE(level < 0))
-+ return -EINVAL;
-+
-+ return level;
-+}
- #endif
-
- static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
-@@ -174,9 +197,10 @@ static int nft_socket_init(const struct nft_ctx *ctx,
- case NFT_SOCKET_MARK:
- len = sizeof(u32);
- break;
--#ifdef CONFIG_CGROUPS
-+#ifdef CONFIG_SOCK_CGROUP_DATA
- case NFT_SOCKET_CGROUPV2: {
- unsigned int level;
-+ int err;
-
- if (!tb[NFTA_SOCKET_LEVEL])
- return -EINVAL;
-@@ -185,6 +209,17 @@ static int nft_socket_init(const struct nft_ctx *ctx,
- if (level > 255)
- return -EOPNOTSUPP;
-
-+ err = nft_socket_cgroup_subtree_level();
-+ if (err < 0)
-+ return err;
-+
-+ priv->level_user = level;
-+
-+ level += err;
-+ /* Implies a giant cgroup tree */
-+ if (WARN_ON_ONCE(level > 255))
-+ return -EOPNOTSUPP;
-+
- priv->level = level;
- len = sizeof(u64);
- break;
-@@ -209,7 +244,7 @@ static int nft_socket_dump(struct sk_buff *skb,
- if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg))
- return -1;
- if (priv->key == NFT_SOCKET_CGROUPV2 &&
-- nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level)))
-+ nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user)))
- return -1;
- return 0;
- }
---
-2.43.0
-
net-ftgmac100-enable-tx-interrupt-to-avoid-tx-timeou.patch
selftests-net-csum-fix-checksums-for-packets-with-no.patch
netfilter-nft_socket-fix-sk-refcount-leaks.patch
-netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch
net-dsa-felix-ignore-pending-status-of-tas-module-wh.patch
net-dpaa-pad-packets-to-eth_zlen.patch
tracing-osnoise-fix-build-when-timerlat-is-not-enabled.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
