From: Greg Kroah-Hartman Date: Sun, 23 Apr 2023 13:55:50 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.314~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=893f6bac8930cbee1b6d4e354c73cb3a710b6271;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch --- diff --git a/queue-4.14/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-4.14/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..f15d95d2d1c --- /dev/null +++ b/queue-4.14/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,117 @@ +From 1651951ebea54970e0bda60c638fc2eee7a6218f Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:00 -0700 +Subject: dccp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 1651951ebea54970e0bda60c638fc2eee7a6218f upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and +DCCPv6 socket shares it by calling the same init function via +dccp_v6_init_sock(). + +To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we +export it and set dccp_v6_sk_destruct() in the init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/dccp/dccp.h | 1 + + net/dccp/ipv6.c | 15 ++++++++------- + net/dccp/proto.c | 8 +++++++- + net/ipv6/af_inet6.c | 1 + + 4 files changed, 17 insertions(+), 8 deletions(-) + +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -291,6 +291,7 @@ int dccp_rcv_state_process(struct sock * + int dccp_rcv_established(struct sock *sk, struct sk_buff *skb, + const struct dccp_hdr *dh, const unsigned int len); + ++void dccp_destruct_common(struct sock *sk); + int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized); + void dccp_destroy_sock(struct sock *sk); + +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -1000,6 +1000,12 @@ static const struct inet_connection_sock + #endif + }; + ++static void dccp_v6_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ + /* NOTE: A lot of things set to zero explicitly by call to + * sk_alloc() so need not be done here. + */ +@@ -1012,17 +1018,12 @@ static int dccp_v6_init_sock(struct sock + if (unlikely(!dccp_v6_ctl_sock_initialized)) + dccp_v6_ctl_sock_initialized = 1; + inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops; ++ sk->sk_destruct = dccp_v6_sk_destruct; + } + + return err; + } + +-static void dccp_v6_destroy_sock(struct sock *sk) +-{ +- dccp_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + static struct timewait_sock_ops dccp6_timewait_sock_ops = { + .twsk_obj_size = sizeof(struct dccp6_timewait_sock), + }; +@@ -1045,7 +1046,7 @@ static struct proto dccp_v6_prot = { + .accept = inet_csk_accept, + .get_port = inet_csk_get_port, + .shutdown = dccp_shutdown, +- .destroy = dccp_v6_destroy_sock, ++ .destroy = dccp_destroy_sock, + .orphan_count = &dccp_orphan_count, + .max_header = MAX_DCCP_HEADER, + .obj_size = sizeof(struct dccp6_sock), +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -171,12 +171,18 @@ const char *dccp_packet_name(const int t + + EXPORT_SYMBOL_GPL(dccp_packet_name); + +-static void dccp_sk_destruct(struct sock *sk) ++void dccp_destruct_common(struct sock *sk) + { + struct dccp_sock *dp = dccp_sk(sk); + + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_tx_ccid = NULL; ++} ++EXPORT_SYMBOL_GPL(dccp_destruct_common); ++ ++static void dccp_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); + inet_sock_destruct(sk); + } + +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -112,6 +112,7 @@ void inet6_sock_destruct(struct sock *sk + inet6_cleanup_sock(sk); + inet_sock_destruct(sk); + } ++EXPORT_SYMBOL_GPL(inet6_sock_destruct); + + static int inet6_create(struct net *net, struct socket *sock, int protocol, + int kern) diff --git a/queue-4.14/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch b/queue-4.14/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch new file mode 100644 index 00000000000..f956f662153 --- /dev/null +++ b/queue-4.14/inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch @@ -0,0 +1,112 @@ +From b5fc29233d28be7a3322848ebe73ac327559cdb9 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:35:59 -0700 +Subject: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). + +From: Kuniyuki Iwashima + +commit b5fc29233d28be7a3322848ebe73ac327559cdb9 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +Now we can remove unnecessary inet6_destroy_sock() calls in +sk->sk_prot->destroy(). + +DCCP and SCTP have their own sk->sk_destruct() function, so we +change them separately in the following patches. + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Matthieu Baerts +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ping.c | 6 ------ + net/ipv6/raw.c | 2 -- + net/ipv6/tcp_ipv6.c | 8 +------- + net/ipv6/udp.c | 2 -- + net/l2tp/l2tp_ip6.c | 2 -- + 5 files changed, 1 insertion(+), 19 deletions(-) + +--- a/net/ipv6/ping.c ++++ b/net/ipv6/ping.c +@@ -26,11 +26,6 @@ + #include + #include + +-static void ping_v6_destroy(struct sock *sk) +-{ +- inet6_destroy_sock(sk); +-} +- + /* Compatibility glue so we can support IPv6 when it's compiled as a module */ + static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, + int *addr_len) +@@ -178,7 +173,6 @@ struct proto pingv6_prot = { + .owner = THIS_MODULE, + .init = ping_init_sock, + .close = ping_close, +- .destroy = ping_v6_destroy, + .connect = ip6_datagram_connect_v6_only, + .disconnect = __udp_disconnect, + .setsockopt = ipv6_setsockopt, +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -1258,8 +1258,6 @@ static void raw6_destroy(struct sock *sk + lock_sock(sk); + ip6_flush_pending_frames(sk); + release_sock(sk); +- +- inet6_destroy_sock(sk); + } + + static int rawv6_init_sk(struct sock *sk) +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1754,12 +1754,6 @@ static int tcp_v6_init_sock(struct sock + return 0; + } + +-static void tcp_v6_destroy_sock(struct sock *sk) +-{ +- tcp_v4_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + #ifdef CONFIG_PROC_FS + /* Proc filesystem TCPv6 sock list dumping. */ + static void get_openreq6(struct seq_file *seq, +@@ -1953,7 +1947,7 @@ struct proto tcpv6_prot = { + .accept = inet_csk_accept, + .ioctl = tcp_ioctl, + .init = tcp_v6_init_sock, +- .destroy = tcp_v6_destroy_sock, ++ .destroy = tcp_v4_destroy_sock, + .shutdown = tcp_shutdown, + .setsockopt = tcp_setsockopt, + .getsockopt = tcp_getsockopt, +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1459,8 +1459,6 @@ void udpv6_destroy_sock(struct sock *sk) + if (encap_destroy) + encap_destroy(sk); + } +- +- inet6_destroy_sock(sk); + } + + /* +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -277,8 +277,6 @@ static void l2tp_ip6_destroy_sock(struct + l2tp_tunnel_closeall(tunnel); + sock_put(sk); + } +- +- inet6_destroy_sock(sk); + } + + static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) diff --git a/queue-4.14/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-4.14/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..449e6c06bdb --- /dev/null +++ b/queue-4.14/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,94 @@ +From 6431b0f6ff1633ae598667e4cdd93830074a03e8 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:01 -0700 +Subject: sctp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and +SCTPv6 socket reuses it as the init function. + +To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we +set sctp_v6_destruct_sock() in a new init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4497,13 +4497,17 @@ static void sctp_destroy_sock(struct soc + } + + /* Triggered when there are no references on the socket anymore */ +-static void sctp_destruct_sock(struct sock *sk) ++static void sctp_destruct_common(struct sock *sk) + { + struct sctp_sock *sp = sctp_sk(sk); + + /* Free up the HMAC transform. */ + crypto_free_shash(sp->hmac); ++} + ++static void sctp_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); + inet_sock_destruct(sk); + } + +@@ -8134,7 +8138,7 @@ void sctp_copy_sock(struct sock *newsk, + newsk->sk_reuse = sk->sk_reuse; + + newsk->sk_shutdown = sk->sk_shutdown; +- newsk->sk_destruct = sctp_destruct_sock; ++ newsk->sk_destruct = sk->sk_destruct; + newsk->sk_family = sk->sk_family; + newsk->sk_protocol = IPPROTO_SCTP; + newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv; +@@ -8351,11 +8355,20 @@ struct proto sctp_prot = { + + #if IS_ENABLED(CONFIG_IPV6) + +-#include +-static void sctp_v6_destroy_sock(struct sock *sk) ++static void sctp_v6_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ ++static int sctp_v6_init_sock(struct sock *sk) + { +- sctp_destroy_sock(sk); +- inet6_destroy_sock(sk); ++ int ret = sctp_init_sock(sk); ++ ++ if (!ret) ++ sk->sk_destruct = sctp_v6_destruct_sock; ++ ++ return ret; + } + + struct proto sctpv6_prot = { +@@ -8365,8 +8378,8 @@ struct proto sctpv6_prot = { + .disconnect = sctp_disconnect, + .accept = sctp_accept, + .ioctl = sctp_ioctl, +- .init = sctp_init_sock, +- .destroy = sctp_v6_destroy_sock, ++ .init = sctp_v6_init_sock, ++ .destroy = sctp_destroy_sock, + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, diff --git a/queue-4.14/series b/queue-4.14/series index 412c5f62552..aa2445a43d9 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -20,3 +20,6 @@ ext4-remove-duplicate-definition-of-ext4_xattr_ibody_inline_set.patch ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch udp-call-inet6_destroy_sock-in-setsockopt-ipv6_addrform.patch tcp-udp-call-inet6_destroy_sock-in-ipv6-sk-sk_destruct.patch +inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch +dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch +sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch