From ac5e6de196bc202be3619c3ee2c52098db0556ac Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 27 Jul 2021 11:51:21 +0200 Subject: [PATCH] drop queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch --- ...-skbuff-allocated-from-skbuff_fclone.patch | 65 ------------------- queue-5.10/series | 1 - ...count-on-napi-stolen-or-re-used-skbs.patch | 2 +- ...e-after-free-in-bpf_xdp_link_release.patch | 13 ++-- 4 files changed, 5 insertions(+), 76 deletions(-) delete mode 100644 queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch diff --git a/queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch b/queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch deleted file mode 100644 index 8b30c718c74..00000000000 --- a/queue-5.10/net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch +++ /dev/null @@ -1,65 +0,0 @@ -From b6c2d6d20cdc81b9ec442bc0061a176915d05099 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 9 Jul 2021 18:16:09 +0200 -Subject: net: do not reuse skbuff allocated from skbuff_fclone_cache in the - skb cache - -From: Antoine Tenart - -[ Upstream commit 28b34f01a73435a754956ebae826e728c03ffa38 ] - -Some socket buffers allocated in the fclone cache (in __alloc_skb) can -end-up in the following path[1]: - -napi_skb_finish - __kfree_skb_defer - napi_skb_cache_put - -The issue is napi_skb_cache_put is not fclone friendly and will put -those skbuff in the skb cache to be reused later, although this cache -only expects skbuff allocated from skbuff_head_cache. When this happens -the skbuff is eventually freed using the wrong origin cache, and we can -see traces similar to: - -[ 1223.947534] cache_from_obj: Wrong slab cache. skbuff_head_cache but object is from skbuff_fclone_cache -[ 1223.948895] WARNING: CPU: 3 PID: 0 at mm/slab.h:442 kmem_cache_free+0x251/0x3e0 -[ 1223.950211] Modules linked in: -[ 1223.950680] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.13.0+ #474 -[ 1223.951587] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-3.fc34 04/01/2014 -[ 1223.953060] RIP: 0010:kmem_cache_free+0x251/0x3e0 - -Leading sometimes to other memory related issues. - -Fix this by using __kfree_skb for fclone skbuff, similar to what is done -the other place __kfree_skb_defer is called. - -[1] At least in setups using veth pairs and tunnels. Building a kernel - with KASAN we can for example see packets allocated in - sk_stream_alloc_skb hit the above path and later the issue arises - when the skbuff is reused. - -Fixes: 9243adfc311a ("skbuff: queue NAPI_MERGED_FREE skbs into NAPI cache instead of freeing") -Cc: Alexander Lobakin -Signed-off-by: Antoine Tenart -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/core/dev.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/core/dev.c b/net/core/dev.c -index 6b08de52bf0e..86a0fe0f4c02 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6100,6 +6100,8 @@ static gro_result_t napi_skb_finish(struct napi_struct *napi, - case GRO_MERGED_FREE: - if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) - napi_skb_free_stolen_head(skb); -+ else if (skb->fclone != SKB_FCLONE_UNAVAILABLE) -+ __kfree_skb(skb); - else - __kfree_skb(skb); - break; --- -2.30.2 - diff --git a/queue-5.10/series b/queue-5.10/series index caeb3168c77..38ac60c3c71 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -26,7 +26,6 @@ selftests-icmp_redirect-remove-from-checking-for-ipv.patch selftests-icmp_redirect-ipv6-pmtu-info-should-be-cle.patch pwm-sprd-ensure-configuring-period-and-duty_cycle-is.patch cxgb4-fix-irq-free-race-during-driver-unload.patch -net-do-not-reuse-skbuff-allocated-from-skbuff_fclone.patch mptcp-fix-warning-in-__skb_flow_dissect-when-do-syn-.patch nvme-pci-do-not-call-nvme_dev_remove_admin-from-nvme.patch kvm-x86-pmu-clear-anythread-deprecated-bit-when-0xa-.patch diff --git a/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch b/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch index 38784acd4d4..5bf5ec4da9f 100644 --- a/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch +++ b/queue-5.10/skbuff-release-nfct-refcount-on-napi-stolen-or-re-used-skbs.patch @@ -46,7 +46,7 @@ Signed-off-by: Greg Kroah-Hartman NAPI_GRO_CB(p)->same_flow = !diffs; } -@@ -6151,6 +6163,7 @@ static void napi_reuse_skb(struct napi_s +@@ -6149,6 +6161,7 @@ static void napi_reuse_skb(struct napi_s skb_shinfo(skb)->gso_type = 0; skb->truesize = SKB_TRUESIZE(skb_end_offset(skb)); skb_ext_reset(skb); diff --git a/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch b/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch index abc9468b7e5..0b9015ea3d1 100644 --- a/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch +++ b/queue-5.10/xdp-net-fix-use-after-free-in-bpf_xdp_link_release.patch @@ -102,14 +102,12 @@ Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20210710031635.41649-1-xuanzhuo@linux.alibaba.com Signed-off-by: Sasha Levin --- - net/core/dev.c | 14 ++++++++++---- + net/core/dev.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) -diff --git a/net/core/dev.c b/net/core/dev.c -index 86a0fe0f4c02..4935ca1e887f 100644 --- a/net/core/dev.c +++ b/net/core/dev.c -@@ -9401,14 +9401,17 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) +@@ -9399,14 +9399,17 @@ int bpf_xdp_link_attach(const union bpf_ struct net_device *dev; int err, fd; @@ -129,7 +127,7 @@ index 86a0fe0f4c02..4935ca1e887f 100644 } bpf_link_init(&link->link, BPF_LINK_TYPE_XDP, &bpf_xdp_link_lops, prog); -@@ -9418,14 +9421,14 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) +@@ -9416,14 +9419,14 @@ int bpf_xdp_link_attach(const union bpf_ err = bpf_link_prime(&link->link, &link_primer); if (err) { kfree(link); @@ -146,7 +144,7 @@ index 86a0fe0f4c02..4935ca1e887f 100644 bpf_link_cleanup(&link_primer); goto out_put_dev; } -@@ -9435,6 +9438,9 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) +@@ -9433,6 +9436,9 @@ int bpf_xdp_link_attach(const union bpf_ dev_put(dev); return fd; @@ -156,6 +154,3 @@ index 86a0fe0f4c02..4935ca1e887f 100644 out_put_dev: dev_put(dev); return err; --- -2.30.2 - -- 2.47.3