From: Greg Kroah-Hartman Date: Sun, 23 Apr 2023 13:56:37 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.14.314~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5f73a17fe4103bc8bec1a69df1c733972b17350a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch --- diff --git a/queue-5.15/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-5.15/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..ce1e37d38de --- /dev/null +++ b/queue-5.15/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,117 @@ +From 1651951ebea54970e0bda60c638fc2eee7a6218f Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:00 -0700 +Subject: dccp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 1651951ebea54970e0bda60c638fc2eee7a6218f upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and +DCCPv6 socket shares it by calling the same init function via +dccp_v6_init_sock(). + +To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we +export it and set dccp_v6_sk_destruct() in the init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/dccp/dccp.h | 1 + + net/dccp/ipv6.c | 15 ++++++++------- + net/dccp/proto.c | 8 +++++++- + net/ipv6/af_inet6.c | 1 + + 4 files changed, 17 insertions(+), 8 deletions(-) + +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -283,6 +283,7 @@ int dccp_rcv_state_process(struct sock * + int dccp_rcv_established(struct sock *sk, struct sk_buff *skb, + const struct dccp_hdr *dh, const unsigned int len); + ++void dccp_destruct_common(struct sock *sk); + int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized); + void dccp_destroy_sock(struct sock *sk); + +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -1002,6 +1002,12 @@ static const struct inet_connection_sock + .sockaddr_len = sizeof(struct sockaddr_in6), + }; + ++static void dccp_v6_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ + /* NOTE: A lot of things set to zero explicitly by call to + * sk_alloc() so need not be done here. + */ +@@ -1014,17 +1020,12 @@ static int dccp_v6_init_sock(struct sock + if (unlikely(!dccp_v6_ctl_sock_initialized)) + dccp_v6_ctl_sock_initialized = 1; + inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops; ++ sk->sk_destruct = dccp_v6_sk_destruct; + } + + return err; + } + +-static void dccp_v6_destroy_sock(struct sock *sk) +-{ +- dccp_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + static struct timewait_sock_ops dccp6_timewait_sock_ops = { + .twsk_obj_size = sizeof(struct dccp6_timewait_sock), + }; +@@ -1047,7 +1048,7 @@ static struct proto dccp_v6_prot = { + .accept = inet_csk_accept, + .get_port = inet_csk_get_port, + .shutdown = dccp_shutdown, +- .destroy = dccp_v6_destroy_sock, ++ .destroy = dccp_destroy_sock, + .orphan_count = &dccp_orphan_count, + .max_header = MAX_DCCP_HEADER, + .obj_size = sizeof(struct dccp6_sock), +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -171,12 +171,18 @@ const char *dccp_packet_name(const int t + + EXPORT_SYMBOL_GPL(dccp_packet_name); + +-static void dccp_sk_destruct(struct sock *sk) ++void dccp_destruct_common(struct sock *sk) + { + struct dccp_sock *dp = dccp_sk(sk); + + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_tx_ccid = NULL; ++} ++EXPORT_SYMBOL_GPL(dccp_destruct_common); ++ ++static void dccp_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); + inet_sock_destruct(sk); + } + +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -113,6 +113,7 @@ void inet6_sock_destruct(struct sock *sk + inet6_cleanup_sock(sk); + inet_sock_destruct(sk); + } ++EXPORT_SYMBOL_GPL(inet6_sock_destruct); + + static int inet6_create(struct net *net, struct socket *sock, int protocol, + int kern) diff --git a/queue-5.15/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch b/queue-5.15/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch new file mode 100644 index 00000000000..c26fabf76b3 --- /dev/null +++ b/queue-5.15/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch @@ -0,0 +1,136 @@ +From b5fc29233d28be7a3322848ebe73ac327559cdb9 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:35:59 -0700 +Subject: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). + +From: Kuniyuki Iwashima + +commit b5fc29233d28be7a3322848ebe73ac327559cdb9 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +Now we can remove unnecessary inet6_destroy_sock() calls in +sk->sk_prot->destroy(). + +DCCP and SCTP have their own sk->sk_destruct() function, so we +change them separately in the following patches. + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Matthieu Baerts +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ping.c | 6 ------ + net/ipv6/raw.c | 2 -- + net/ipv6/tcp_ipv6.c | 8 +------- + net/ipv6/udp.c | 2 -- + net/l2tp/l2tp_ip6.c | 2 -- + net/mptcp/protocol.c | 7 ------- + 6 files changed, 1 insertion(+), 26 deletions(-) + +--- a/net/ipv6/ping.c ++++ b/net/ipv6/ping.c +@@ -22,11 +22,6 @@ + #include + #include + +-static void ping_v6_destroy(struct sock *sk) +-{ +- inet6_destroy_sock(sk); +-} +- + /* Compatibility glue so we can support IPv6 when it's compiled as a module */ + static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, + int *addr_len) +@@ -171,7 +166,6 @@ struct proto pingv6_prot = { + .owner = THIS_MODULE, + .init = ping_init_sock, + .close = ping_close, +- .destroy = ping_v6_destroy, + .connect = ip6_datagram_connect_v6_only, + .disconnect = __udp_disconnect, + .setsockopt = ipv6_setsockopt, +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -1211,8 +1211,6 @@ static void raw6_destroy(struct sock *sk + lock_sock(sk); + ip6_flush_pending_frames(sk); + release_sock(sk); +- +- inet6_destroy_sock(sk); + } + + static int rawv6_init_sk(struct sock *sk) +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1972,12 +1972,6 @@ static int tcp_v6_init_sock(struct sock + return 0; + } + +-static void tcp_v6_destroy_sock(struct sock *sk) +-{ +- tcp_v4_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + #ifdef CONFIG_PROC_FS + /* Proc filesystem TCPv6 sock list dumping. */ + static void get_openreq6(struct seq_file *seq, +@@ -2170,7 +2164,7 @@ struct proto tcpv6_prot = { + .accept = inet_csk_accept, + .ioctl = tcp_ioctl, + .init = tcp_v6_init_sock, +- .destroy = tcp_v6_destroy_sock, ++ .destroy = tcp_v4_destroy_sock, + .shutdown = tcp_shutdown, + .setsockopt = tcp_setsockopt, + .getsockopt = tcp_getsockopt, +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1649,8 +1649,6 @@ void udpv6_destroy_sock(struct sock *sk) + udp_encap_disable(); + } + } +- +- inet6_destroy_sock(sk); + } + + /* +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -255,8 +255,6 @@ static void l2tp_ip6_destroy_sock(struct + + if (tunnel) + l2tp_tunnel_delete(tunnel); +- +- inet6_destroy_sock(sk); + } + + static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -3621,12 +3621,6 @@ static const struct proto_ops mptcp_v6_s + + static struct proto mptcp_v6_prot; + +-static void mptcp_v6_destroy(struct sock *sk) +-{ +- mptcp_destroy(sk); +- inet6_destroy_sock(sk); +-} +- + static struct inet_protosw mptcp_v6_protosw = { + .type = SOCK_STREAM, + .protocol = IPPROTO_MPTCP, +@@ -3642,7 +3636,6 @@ int __init mptcp_proto_v6_init(void) + mptcp_v6_prot = mptcp_prot; + strcpy(mptcp_v6_prot.name, "MPTCPv6"); + mptcp_v6_prot.slab = NULL; +- mptcp_v6_prot.destroy = mptcp_v6_destroy; + mptcp_v6_prot.obj_size = sizeof(struct mptcp6_sock); + + err = proto_register(&mptcp_v6_prot, 1); diff --git a/queue-5.15/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-5.15/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..59c5b0a7923 --- /dev/null +++ b/queue-5.15/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,94 @@ +From 6431b0f6ff1633ae598667e4cdd93830074a03e8 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:01 -0700 +Subject: sctp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and +SCTPv6 socket reuses it as the init function. + +To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we +set sctp_v6_destruct_sock() in a new init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -5110,13 +5110,17 @@ static void sctp_destroy_sock(struct soc + } + + /* Triggered when there are no references on the socket anymore */ +-static void sctp_destruct_sock(struct sock *sk) ++static void sctp_destruct_common(struct sock *sk) + { + struct sctp_sock *sp = sctp_sk(sk); + + /* Free up the HMAC transform. */ + crypto_free_shash(sp->hmac); ++} + ++static void sctp_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); + inet_sock_destruct(sk); + } + +@@ -9443,7 +9447,7 @@ void sctp_copy_sock(struct sock *newsk, + sctp_sk(newsk)->reuse = sp->reuse; + + newsk->sk_shutdown = sk->sk_shutdown; +- newsk->sk_destruct = sctp_destruct_sock; ++ newsk->sk_destruct = sk->sk_destruct; + newsk->sk_family = sk->sk_family; + newsk->sk_protocol = IPPROTO_SCTP; + newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv; +@@ -9675,11 +9679,20 @@ struct proto sctp_prot = { + + #if IS_ENABLED(CONFIG_IPV6) + +-#include +-static void sctp_v6_destroy_sock(struct sock *sk) ++static void sctp_v6_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ ++static int sctp_v6_init_sock(struct sock *sk) + { +- sctp_destroy_sock(sk); +- inet6_destroy_sock(sk); ++ int ret = sctp_init_sock(sk); ++ ++ if (!ret) ++ sk->sk_destruct = sctp_v6_destruct_sock; ++ ++ return ret; + } + + struct proto sctpv6_prot = { +@@ -9689,8 +9702,8 @@ struct proto sctpv6_prot = { + .disconnect = sctp_disconnect, + .accept = sctp_accept, + .ioctl = sctp_ioctl, +- .init = sctp_init_sock, +- .destroy = sctp_v6_destroy_sock, ++ .init = sctp_v6_init_sock, ++ .destroy = sctp_destroy_sock, + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, diff --git a/queue-5.15/series b/queue-5.15/series index 3e130adfa6e..7b787dcd343 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -57,3 +57,6 @@ fuse-always-revalidate-rename-target-dentry.patch fuse-fix-deadlock-between-atomic-o_trunc-and-page-invalidation.patch udp-call-inet6_destroy_sock-in-setsockopt-ipv6_addrform.patch tcp-udp-call-inet6_destroy_sock-in-ipv6-sk-sk_destruct.patch +inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch +dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch +sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch