drop queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch

diff --git a/queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch b/queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch
deleted file mode 100644 (file)
index 8b30c71..0000000
--- a/queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From b6c2d6d20cdc81b9ec442bc0061a176915d05099 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jul 2021 18:16:09 +0200
-Subject: net: do not reuse skbuff allocated from skbuff_fclone_cache in the
- skb cache
-
-From: Antoine Tenart <atenart@kernel.org>
-
-[ Upstream commit 28b34f01a73435a754956ebae826e728c03ffa38 ]
-
-Some socket buffers allocated in the fclone cache (in __alloc_skb) can
-end-up in the following path[1]:
-
-napi_skb_finish
-  __kfree_skb_defer
-    napi_skb_cache_put
-
-The issue is napi_skb_cache_put is not fclone friendly and will put
-those skbuff in the skb cache to be reused later, although this cache
-only expects skbuff allocated from skbuff_head_cache. When this happens
-the skbuff is eventually freed using the wrong origin cache, and we can
-see traces similar to:
-
-[ 1223.947534] cache_from_obj: Wrong slab cache. skbuff_head_cache but object is from skbuff_fclone_cache
-[ 1223.948895] WARNING: CPU: 3 PID: 0 at mm/slab.h:442 kmem_cache_free+0x251/0x3e0
-[ 1223.950211] Modules linked in:
-[ 1223.950680] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.13.0+ #474
-[ 1223.951587] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-3.fc34 04/01/2014
-[ 1223.953060] RIP: 0010:kmem_cache_free+0x251/0x3e0
-
-Leading sometimes to other memory related issues.
-
-Fix this by using __kfree_skb for fclone skbuff, similar to what is done
-the other place __kfree_skb_defer is called.
-
-[1] At least in setups using veth pairs and tunnels. Building a kernel
-    with KASAN we can for example see packets allocated in
-    sk_stream_alloc_skb hit the above path and later the issue arises
-    when the skbuff is reused.
-
-Fixes: 9243adfc311a ("skbuff: queue NAPI_MERGED_FREE skbs into NAPI cache instead of freeing")
-Cc: Alexander Lobakin <alobakin@pm.me>
-Signed-off-by: Antoine Tenart <atenart@kernel.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/dev.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 6b08de52bf0e..86a0fe0f4c02 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -6100,6 +6100,8 @@ static gro_result_t napi_skb_finish(struct napi_struct *napi,
-       case GRO_MERGED_FREE:
-               if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
-                       napi_skb_free_stolen_head(skb);
-+              else if (skb->fclone != SKB_FCLONE_UNAVAILABLE)
-+                      __kfree_skb(skb);
-               else
-                       __kfree_skb(skb);
-               break;
--- 
-2.30.2
-

diff --git a/queue-5.10/series b/queue-5.10/series
index caeb3168c77ba08eaa292426353befcf3e7a5f18..38ac60c3c7101e10c5e2d64692ce964ad1d8846a 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -26,7 +26,6 @@ selftests-icmp_redirect-remove-from-checking-for-ipv.patch
 selftests-icmp_redirect-ipv6-pmtu-info-should-be-cle.patch
 pwm-sprd-ensure-configuring-period-and-duty_cycle-is.patch
 cxgb4-fix-irq-free-race-during-driver-unload.patch
-net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch
 mptcp-fix-warning-in-__skb_flow_dissect-when-do-syn-.patch
 nvme-pci-do-not-call-nvme_dev_remove_admin-from-nvme.patch
 kvm-x86-pmu-clear-anythread-deprecated-bit-when-0xa-.patch

diff --git a/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch b/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch
index 38784acd4d45d25f64ff03adf0c6d18bb5732fc8..5bf5ec4da9f01d19eb2490b15c3ff8e32d6736fd 100644 (file)
--- a/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch
+++ b/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch
@@ -46,7 +46,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
                NAPI_GRO_CB(p)->same_flow = !diffs;
        }
  
-@@ -6151,6 +6163,7 @@ static void napi_reuse_skb(struct napi_s
+@@ -6149,6 +6161,7 @@ static void napi_reuse_skb(struct napi_s
        skb_shinfo(skb)->gso_type = 0;
        skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
        skb_ext_reset(skb);

diff --git a/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch b/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch
index abc9468b7e5a24b2042ca5d2db7840872d68e0ca..0b9015ea3d1b9e8cb5c57b5a9ec2879e63e72df9 100644 (file)
--- a/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch
+++ b/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch
@@ -102,14 +102,12 @@ Acked-by: Andrii Nakryiko <andrii@kernel.org>
 Link: https://lore.kernel.org/bpf/20210710031635.41649-1-xuanzhuo@linux.alibaba.com
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- net/core/dev.c | 14 ++++++++++----
+ net/core/dev.c |   14 ++++++++++----
  1 file changed, 10 insertions(+), 4 deletions(-)
 
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 86a0fe0f4c02..4935ca1e887f 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -9401,14 +9401,17 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
+@@ -9399,14 +9399,17 @@ int bpf_xdp_link_attach(const union bpf_
        struct net_device *dev;
        int err, fd;
  
@@ -129,7 +127,7 @@ index 86a0fe0f4c02..4935ca1e887f 100644
        }
  
        bpf_link_init(&link->link, BPF_LINK_TYPE_XDP, &bpf_xdp_link_lops, prog);
-@@ -9418,14 +9421,14 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
+@@ -9416,14 +9419,14 @@ int bpf_xdp_link_attach(const union bpf_
        err = bpf_link_prime(&link->link, &link_primer);
        if (err) {
                kfree(link);
@@ -146,7 +144,7 @@ index 86a0fe0f4c02..4935ca1e887f 100644
                bpf_link_cleanup(&link_primer);
                goto out_put_dev;
        }
-@@ -9435,6 +9438,9 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
+@@ -9433,6 +9436,9 @@ int bpf_xdp_link_attach(const union bpf_
        dev_put(dev);
        return fd;
  
@@ -156,6 +154,3 @@ index 86a0fe0f4c02..4935ca1e887f 100644
  out_put_dev:
        dev_put(dev);
        return err;
--- 
-2.30.2
-