From 4af9df86fbf836094f52aaeddeece20a588a133c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 23 Apr 2023 15:56:49 +0200 Subject: [PATCH] 6.1-stable patches added patches: dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch --- ...net6_destroy_sock-via-sk-sk_destruct.patch | 117 ++++++++++++++++++ ...net6_destroy_sock-via-sk-sk_destruct.patch | 94 ++++++++++++++ queue-6.1/series | 2 + 3 files changed, 213 insertions(+) create mode 100644 queue-6.1/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch create mode 100644 queue-6.1/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch diff --git a/queue-6.1/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-6.1/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..1083f4d1691 --- /dev/null +++ b/queue-6.1/dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,117 @@ +From 1651951ebea54970e0bda60c638fc2eee7a6218f Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:00 -0700 +Subject: dccp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 1651951ebea54970e0bda60c638fc2eee7a6218f upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and +DCCPv6 socket shares it by calling the same init function via +dccp_v6_init_sock(). + +To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we +export it and set dccp_v6_sk_destruct() in the init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/dccp/dccp.h | 1 + + net/dccp/ipv6.c | 15 ++++++++------- + net/dccp/proto.c | 8 +++++++- + net/ipv6/af_inet6.c | 1 + + 4 files changed, 17 insertions(+), 8 deletions(-) + +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -278,6 +278,7 @@ int dccp_rcv_state_process(struct sock * + int dccp_rcv_established(struct sock *sk, struct sk_buff *skb, + const struct dccp_hdr *dh, const unsigned int len); + ++void dccp_destruct_common(struct sock *sk); + int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized); + void dccp_destroy_sock(struct sock *sk); + +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -1004,6 +1004,12 @@ static const struct inet_connection_sock + .sockaddr_len = sizeof(struct sockaddr_in6), + }; + ++static void dccp_v6_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ + /* NOTE: A lot of things set to zero explicitly by call to + * sk_alloc() so need not be done here. + */ +@@ -1016,17 +1022,12 @@ static int dccp_v6_init_sock(struct sock + if (unlikely(!dccp_v6_ctl_sock_initialized)) + dccp_v6_ctl_sock_initialized = 1; + inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops; ++ sk->sk_destruct = dccp_v6_sk_destruct; + } + + return err; + } + +-static void dccp_v6_destroy_sock(struct sock *sk) +-{ +- dccp_destroy_sock(sk); +- inet6_destroy_sock(sk); +-} +- + static struct timewait_sock_ops dccp6_timewait_sock_ops = { + .twsk_obj_size = sizeof(struct dccp6_timewait_sock), + }; +@@ -1049,7 +1050,7 @@ static struct proto dccp_v6_prot = { + .accept = inet_csk_accept, + .get_port = inet_csk_get_port, + .shutdown = dccp_shutdown, +- .destroy = dccp_v6_destroy_sock, ++ .destroy = dccp_destroy_sock, + .orphan_count = &dccp_orphan_count, + .max_header = MAX_DCCP_HEADER, + .obj_size = sizeof(struct dccp6_sock), +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -171,12 +171,18 @@ const char *dccp_packet_name(const int t + + EXPORT_SYMBOL_GPL(dccp_packet_name); + +-static void dccp_sk_destruct(struct sock *sk) ++void dccp_destruct_common(struct sock *sk) + { + struct dccp_sock *dp = dccp_sk(sk); + + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_tx_ccid = NULL; ++} ++EXPORT_SYMBOL_GPL(dccp_destruct_common); ++ ++static void dccp_sk_destruct(struct sock *sk) ++{ ++ dccp_destruct_common(sk); + inet_sock_destruct(sk); + } + +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -114,6 +114,7 @@ void inet6_sock_destruct(struct sock *sk + inet6_cleanup_sock(sk); + inet_sock_destruct(sk); + } ++EXPORT_SYMBOL_GPL(inet6_sock_destruct); + + static int inet6_create(struct net *net, struct socket *sock, int protocol, + int kern) diff --git a/queue-6.1/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch b/queue-6.1/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch new file mode 100644 index 00000000000..bdab36cf072 --- /dev/null +++ b/queue-6.1/sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch @@ -0,0 +1,94 @@ +From 6431b0f6ff1633ae598667e4cdd93830074a03e8 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Wed, 19 Oct 2022 15:36:01 -0700 +Subject: sctp: Call inet6_destroy_sock() via sk->sk_destruct(). + +From: Kuniyuki Iwashima + +commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream. + +After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() +in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in +sk->sk_destruct() by setting inet6_sock_destruct() to it to make +sure we do not leak inet6-specific resources. + +SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and +SCTPv6 socket reuses it as the init function. + +To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we +set sctp_v6_destruct_sock() in a new init function. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Ziyang Xuan +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -5102,13 +5102,17 @@ static void sctp_destroy_sock(struct soc + } + + /* Triggered when there are no references on the socket anymore */ +-static void sctp_destruct_sock(struct sock *sk) ++static void sctp_destruct_common(struct sock *sk) + { + struct sctp_sock *sp = sctp_sk(sk); + + /* Free up the HMAC transform. */ + crypto_free_shash(sp->hmac); ++} + ++static void sctp_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); + inet_sock_destruct(sk); + } + +@@ -9431,7 +9435,7 @@ void sctp_copy_sock(struct sock *newsk, + sctp_sk(newsk)->reuse = sp->reuse; + + newsk->sk_shutdown = sk->sk_shutdown; +- newsk->sk_destruct = sctp_destruct_sock; ++ newsk->sk_destruct = sk->sk_destruct; + newsk->sk_family = sk->sk_family; + newsk->sk_protocol = IPPROTO_SCTP; + newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv; +@@ -9666,11 +9670,20 @@ struct proto sctp_prot = { + + #if IS_ENABLED(CONFIG_IPV6) + +-#include +-static void sctp_v6_destroy_sock(struct sock *sk) ++static void sctp_v6_destruct_sock(struct sock *sk) ++{ ++ sctp_destruct_common(sk); ++ inet6_sock_destruct(sk); ++} ++ ++static int sctp_v6_init_sock(struct sock *sk) + { +- sctp_destroy_sock(sk); +- inet6_destroy_sock(sk); ++ int ret = sctp_init_sock(sk); ++ ++ if (!ret) ++ sk->sk_destruct = sctp_v6_destruct_sock; ++ ++ return ret; + } + + struct proto sctpv6_prot = { +@@ -9680,8 +9693,8 @@ struct proto sctpv6_prot = { + .disconnect = sctp_disconnect, + .accept = sctp_accept, + .ioctl = sctp_ioctl, +- .init = sctp_init_sock, +- .destroy = sctp_v6_destroy_sock, ++ .init = sctp_v6_init_sock, ++ .destroy = sctp_destroy_sock, + .shutdown = sctp_shutdown, + .setsockopt = sctp_setsockopt, + .getsockopt = sctp_getsockopt, diff --git a/queue-6.1/series b/queue-6.1/series index f9e9570b21e..5427ce7a373 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -85,3 +85,5 @@ mips-define-runtime_discard_exit-in-ld-script.patch fuse-always-revalidate-rename-target-dentry.patch purgatory-fix-disabling-debug-info.patch inet6-remove-inet6_destroy_sock-in-sk-sk_prot-destroy.patch +dccp-call-inet6_destroy_sock-via-sk-sk_destruct.patch +sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch -- 2.47.3