From: Greg Kroah-Hartman Date: Sun, 23 Apr 2023 13:56:05 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.14.314~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6630d46019e816184142aef440e83d6f1c08acf5;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch --- diff --git a/queue-4.19/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-4.19/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..9e6ce4e5325 --- /dev/null +++ b/queue-4.19/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,117 @@ +From 1651951ebea54970e0bda60c638fc2eee7a6218f Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:00 -0700 +Subject: dccp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 1651951ebea54970e0bda60c638fc2eee7a6218f upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and +DCCPv6 socket shares it by calling the same init function via +dccp_v6_init_sock(). + +To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we +export it and set dccp_v6_sk_destruct() in the init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/dccp/dccp.h | 1 + + net/dccp/ipv6.c | 15 ++++++++------- + net/dccp/proto.c | 8 +++++++- + net/ipv6/af_inet6.c | 1 + + 4 files changed, 17 insertions(+), 8 deletions(-) + +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -291,6 +291,7 @@ int dccp_rcv_state_process(struct sock * + int dccp_rcv_established(struct sock *sk, struct sk_buff *skb, + const struct dccp_hdr *dh, const unsigned int len); + ++void dccp_destruct_common(struct sock *sk); + int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized); + void dccp_destroy_sock(struct sock *sk); + +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -1000,6 +1000,12 @@ static const struct inet_connection_sock + #endif + }; + ++static void dccp_v6_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ + /* NOTE: A lot of things set to zero explicitly by call to + * sk_alloc() so need not be done here. + */ +@@ -1012,17 +1018,12 @@ static int dccp_v6_init_sock(struct sock + if (unlikely(!dccp_v6_ctl_sock_initialized)) + dccp_v6_ctl_sock_initialized = 1; + inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops; ++ sk->sk_destruct = dccp_v6_sk_destruct; + } + + return err; + } + +-static void dccp_v6_destroy_sock(struct sock *sk) +-{ +- dccp_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + static struct timewait_sock_ops dccp6_timewait_sock_ops = { + .twsk_obj_size = sizeof(struct dccp6_timewait_sock), + }; +@@ -1045,7 +1046,7 @@ static struct proto dccp_v6_prot = { + .accept = inet_csk_accept, + .get_port = inet_csk_get_port, + .shutdown = dccp_shutdown, +- .destroy = dccp_v6_destroy_sock, ++ .destroy = dccp_destroy_sock, + .orphan_count = &dccp_orphan_count, + .max_header = MAX_DCCP_HEADER, + .obj_size = sizeof(struct dccp6_sock), +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -174,12 +174,18 @@ const char *dccp_packet_name(const int t + + EXPORT_SYMBOL_GPL(dccp_packet_name); + +-static void dccp_sk_destruct(struct sock *sk) ++void dccp_destruct_common(struct sock *sk) + { + struct dccp_sock *dp = dccp_sk(sk); + + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_tx_ccid = NULL; ++} ++EXPORT_SYMBOL_GPL(dccp_destruct_common); ++ ++static void dccp_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); + inet_sock_destruct(sk); + } + +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -112,6 +112,7 @@ void inet6_sock_destruct(struct sock *sk + inet6_cleanup_sock(sk); + inet_sock_destruct(sk); + } ++EXPORT_SYMBOL_GPL(inet6_sock_destruct); + + static int inet6_create(struct net *net, struct socket *sock, int protocol, + int kern) diff --git a/queue-4.19/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch b/queue-4.19/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch new file mode 100644 index 00000000000..57ea555a33a --- /dev/null +++ b/queue-4.19/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch @@ -0,0 +1,112 @@ +From b5fc29233d28be7a3322848ebe73ac327559cdb9 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:35:59 -0700 +Subject: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). + +From: Kuniyuki Iwashima + +commit b5fc29233d28be7a3322848ebe73ac327559cdb9 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +Now we can remove unnecessary inet6_destroy_sock() calls in +sk->sk_prot->destroy(). + +DCCP and SCTP have their own sk->sk_destruct() function, so we +change them separately in the following patches. + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Matthieu Baerts +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ping.c | 6 ------ + net/ipv6/raw.c | 2 -- + net/ipv6/tcp_ipv6.c | 8 +------- + net/ipv6/udp.c | 2 -- + net/l2tp/l2tp_ip6.c | 2 -- + 5 files changed, 1 insertion(+), 19 deletions(-) + +--- a/net/ipv6/ping.c ++++ b/net/ipv6/ping.c +@@ -27,11 +27,6 @@ + #include + #include + +-static void ping_v6_destroy(struct sock *sk) +-{ +- inet6_destroy_sock(sk); +-} +- + /* Compatibility glue so we can support IPv6 when it's compiled as a module */ + static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, + int *addr_len) +@@ -175,7 +170,6 @@ struct proto pingv6_prot = { + .owner = THIS_MODULE, + .init = ping_init_sock, + .close = ping_close, +- .destroy = ping_v6_destroy, + .connect = ip6_datagram_connect_v6_only, + .disconnect = __udp_disconnect, + .setsockopt = ipv6_setsockopt, +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -1259,8 +1259,6 @@ static void raw6_destroy(struct sock *sk + lock_sock(sk); + ip6_flush_pending_frames(sk); + release_sock(sk); +- +- inet6_destroy_sock(sk); + } + + static int rawv6_init_sk(struct sock *sk) +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1792,12 +1792,6 @@ static int tcp_v6_init_sock(struct sock + return 0; + } + +-static void tcp_v6_destroy_sock(struct sock *sk) +-{ +- tcp_v4_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + #ifdef CONFIG_PROC_FS + /* Proc filesystem TCPv6 sock list dumping. */ + static void get_openreq6(struct seq_file *seq, +@@ -1990,7 +1984,7 @@ struct proto tcpv6_prot = { + .accept = inet_csk_accept, + .ioctl = tcp_ioctl, + .init = tcp_v6_init_sock, +- .destroy = tcp_v6_destroy_sock, ++ .destroy = tcp_v4_destroy_sock, + .shutdown = tcp_shutdown, + .setsockopt = tcp_setsockopt, + .getsockopt = tcp_getsockopt, +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1503,8 +1503,6 @@ void udpv6_destroy_sock(struct sock *sk) + if (encap_destroy) + encap_destroy(sk); + } +- +- inet6_destroy_sock(sk); + } + + /* +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -272,8 +272,6 @@ static void l2tp_ip6_destroy_sock(struct + + if (tunnel) + l2tp_tunnel_delete(tunnel); +- +- inet6_destroy_sock(sk); + } + + static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) diff --git a/queue-4.19/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-4.19/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..822fddc78cf --- /dev/null +++ b/queue-4.19/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,94 @@ +From 6431b0f6ff1633ae598667e4cdd93830074a03e8 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:01 -0700 +Subject: sctp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and +SCTPv6 socket reuses it as the init function. + +To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we +set sctp_v6_destruct_sock() in a new init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4828,13 +4828,17 @@ static void sctp_destroy_sock(struct soc + } + + /* Triggered when there are no references on the socket anymore */ +-static void sctp_destruct_sock(struct sock *sk) ++static void sctp_destruct_common(struct sock *sk) + { + struct sctp_sock *sp = sctp_sk(sk); + + /* Free up the HMAC transform. */ + crypto_free_shash(sp->hmac); ++} + ++static void sctp_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); + inet_sock_destruct(sk); + } + +@@ -8764,7 +8768,7 @@ void sctp_copy_sock(struct sock *newsk, + sctp_sk(newsk)->reuse = sp->reuse; + + newsk->sk_shutdown = sk->sk_shutdown; +- newsk->sk_destruct = sctp_destruct_sock; ++ newsk->sk_destruct = sk->sk_destruct; + newsk->sk_family = sk->sk_family; + newsk->sk_protocol = IPPROTO_SCTP; + newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv; +@@ -8984,11 +8988,20 @@ struct proto sctp_prot = { + + #if IS_ENABLED(CONFIG_IPV6) + +-#include +-static void sctp_v6_destroy_sock(struct sock *sk) ++static void sctp_v6_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ ++static int sctp_v6_init_sock(struct sock *sk) + { +- sctp_destroy_sock(sk); +- inet6_destroy_sock(sk); ++ int ret = sctp_init_sock(sk); ++ ++ if (!ret) ++ sk->sk_destruct = sctp_v6_destruct_sock; ++ ++ return ret; + } + + struct proto sctpv6_prot = { +@@ -8998,8 +9011,8 @@ struct proto sctpv6_prot = { + .disconnect = sctp_disconnect, + .accept = sctp_accept, + .ioctl = sctp_ioctl, +- .init = sctp_init_sock, +- .destroy = sctp_v6_destroy_sock, ++ .init = sctp_v6_init_sock, ++ .destroy = sctp_destroy_sock, + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, diff --git a/queue-4.19/series b/queue-4.19/series index c640b470155..acaea5568f0 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,6 @@ ext4-remove-duplicate-definition-of-ext4_xattr_ibody_inline_set.patch ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch udp-call-inet6_destroy_sock-in-setsockopt-ipv6_addrform.patch tcp-udp-call-inet6_destroy_sock-in-ipv6-sk-sk_destruct.patch +inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch +dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch +sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch