drop net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch...

diff --git a/queue-5.10/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch b/queue-5.10/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
deleted file mode 100644 (file)
index a126f18..0000000
--- a/queue-5.10/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 Mon Sep 17 00:00:00 2001
-From: Jakub Kicinski <kuba@kernel.org>
-Date: Thu, 15 Feb 2024 06:33:46 -0800
-Subject: net/sched: act_mirred: don't override retval if we already lost the skb
-
-From: Jakub Kicinski <kuba@kernel.org>
-
-commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 upstream.
-
-If we're redirecting the skb, and haven't called tcf_mirred_forward(),
-yet, we need to tell the core to drop the skb by setting the retcode
-to SHOT. If we have called tcf_mirred_forward(), however, the skb
-is out of our hands and returning SHOT will lead to UaF.
-
-Move the retval override to the error path which actually need it.
-
-Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
-Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible")
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-[Minor conflict resolved due to code context change.]
-Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
-Signed-off-by: He Zhe <zhe.he@windriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/sched/act_mirred.c |   20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
---- a/net/sched/act_mirred.c
-+++ b/net/sched/act_mirred.c
-@@ -260,13 +260,13 @@ static int tcf_mirred_act(struct sk_buff
-       dev = rcu_dereference_bh(m->tcfm_dev);
-       if (unlikely(!dev)) {
-               pr_notice_once("tc mirred: target device is gone\n");
--              goto out;
-+              goto err_cant_do;
-       }
- 
-       if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
-               net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
-                                      dev->name);
--              goto out;
-+              goto err_cant_do;
-       }
- 
-       /* we could easily avoid the clone only if called by ingress and clsact;
-@@ -280,7 +280,7 @@ static int tcf_mirred_act(struct sk_buff
-       if (!use_reinsert) {
-               skb2 = skb_clone(skb, GFP_ATOMIC);
-               if (!skb2)
--                      goto out;
-+                      goto err_cant_do;
-       }
- 
-       want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
-@@ -323,12 +323,16 @@ static int tcf_mirred_act(struct sk_buff
-       }
- 
-       err = tcf_mirred_forward(want_ingress, skb2);
--      if (err) {
--out:
-+      if (err)
-               tcf_action_inc_overlimit_qstats(&m->common);
--              if (tcf_mirred_is_act_redirect(m_eaction))
--                      retval = TC_ACT_SHOT;
--      }
-+      __this_cpu_dec(mirred_nest_level);
-+
-+      return retval;
-+
-+err_cant_do:
-+      if (is_redirect)
-+              retval = TC_ACT_SHOT;
-+      tcf_action_inc_overlimit_qstats(&m->common);
-       __this_cpu_dec(mirred_nest_level);
- 
-       return retval;

diff --git a/queue-5.10/series b/queue-5.10/series
index ccc4b0a0e4cb344c529e683cbea04f9816f5dc7e..6aec8ff76625123c43e958848abc24c1ae0576b8 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -188,5 +188,4 @@ mm-fix-apply_to_existing_page_range.patch
 drivers-staging-rtl8723bs-fix-deadlock-in-rtw_surveydone_event_callback.patch
 s390-dasd-fix-double-module-refcount-decrement.patch
 pmdomain-ti-add-a-null-pointer-check-to-the-omap_prm_domain_init.patch
-net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
 drivers-staging-rtl8723bs-fix-locking-in-rtw_scan_timeout_handler.patch

diff --git a/queue-5.15/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch b/queue-5.15/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
deleted file mode 100644 (file)
index 8b19d00..0000000
--- a/queue-5.15/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 Mon Sep 17 00:00:00 2001
-From: Jakub Kicinski <kuba@kernel.org>
-Date: Thu, 15 Feb 2024 06:33:46 -0800
-Subject: net/sched: act_mirred: don't override retval if we already lost the skb
-
-From: Jakub Kicinski <kuba@kernel.org>
-
-commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 upstream.
-
-If we're redirecting the skb, and haven't called tcf_mirred_forward(),
-yet, we need to tell the core to drop the skb by setting the retcode
-to SHOT. If we have called tcf_mirred_forward(), however, the skb
-is out of our hands and returning SHOT will lead to UaF.
-
-Move the retval override to the error path which actually need it.
-
-Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
-Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible")
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-[Minor conflict resolved due to code context change.]
-Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
-Signed-off-by: He Zhe <zhe.he@windriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/sched/act_mirred.c |   20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
---- a/net/sched/act_mirred.c
-+++ b/net/sched/act_mirred.c
-@@ -258,13 +258,13 @@ static int tcf_mirred_act(struct sk_buff
-       dev = rcu_dereference_bh(m->tcfm_dev);
-       if (unlikely(!dev)) {
-               pr_notice_once("tc mirred: target device is gone\n");
--              goto out;
-+              goto err_cant_do;
-       }
- 
-       if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
-               net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
-                                      dev->name);
--              goto out;
-+              goto err_cant_do;
-       }
- 
-       /* we could easily avoid the clone only if called by ingress and clsact;
-@@ -278,7 +278,7 @@ static int tcf_mirred_act(struct sk_buff
-       if (!use_reinsert) {
-               skb2 = skb_clone(skb, GFP_ATOMIC);
-               if (!skb2)
--                      goto out;
-+                      goto err_cant_do;
-       }
- 
-       want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
-@@ -321,12 +321,16 @@ static int tcf_mirred_act(struct sk_buff
-       }
- 
-       err = tcf_mirred_forward(want_ingress, skb2);
--      if (err) {
--out:
-+      if (err)
-               tcf_action_inc_overlimit_qstats(&m->common);
--              if (tcf_mirred_is_act_redirect(m_eaction))
--                      retval = TC_ACT_SHOT;
--      }
-+      __this_cpu_dec(mirred_nest_level);
-+
-+      return retval;
-+
-+err_cant_do:
-+      if (is_redirect)
-+              retval = TC_ACT_SHOT;
-+      tcf_action_inc_overlimit_qstats(&m->common);
-       __this_cpu_dec(mirred_nest_level);
- 
-       return retval;

diff --git a/queue-5.15/series b/queue-5.15/series
index 662fc8a0173ba49cb67be741371c759ab3a9e474..f74f123c4e9d171b0887de1cbc8a2a9b6ac3639e 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -249,6 +249,5 @@ fs-proc-do_task_stat-use-sig-stats_lock-to-gather-the-threads-children-stats.pat
 mm-fix-apply_to_existing_page_range.patch
 f2fs-check-validation-of-fault-attrs-in-f2fs_build_fault_attr.patch
 pmdomain-ti-add-a-null-pointer-check-to-the-omap_prm_domain_init.patch
-net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
 scsi-lpfc-fix-null-pointer-dereference-after-failing-to-issue-flogi-and-plogi.patch
 f2fs-add-inline-to-f2fs_build_fault_attr-stub.patch

diff --git a/queue-6.1/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch b/queue-6.1/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
deleted file mode 100644 (file)
index 51f8739..0000000
--- a/queue-6.1/net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 Mon Sep 17 00:00:00 2001
-From: Jakub Kicinski <kuba@kernel.org>
-Date: Thu, 15 Feb 2024 06:33:46 -0800
-Subject: net/sched: act_mirred: don't override retval if we already lost the skb
-
-From: Jakub Kicinski <kuba@kernel.org>
-
-commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 upstream.
-
-If we're redirecting the skb, and haven't called tcf_mirred_forward(),
-yet, we need to tell the core to drop the skb by setting the retcode
-to SHOT. If we have called tcf_mirred_forward(), however, the skb
-is out of our hands and returning SHOT will lead to UaF.
-
-Move the retval override to the error path which actually need it.
-
-Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
-Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible")
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-[Minor conflict resolved due to code context change.]
-Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
-Signed-off-by: He Zhe <zhe.he@windriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/sched/act_mirred.c |   20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
---- a/net/sched/act_mirred.c
-+++ b/net/sched/act_mirred.c
-@@ -259,13 +259,13 @@ static int tcf_mirred_act(struct sk_buff
-       dev = rcu_dereference_bh(m->tcfm_dev);
-       if (unlikely(!dev)) {
-               pr_notice_once("tc mirred: target device is gone\n");
--              goto out;
-+              goto err_cant_do;
-       }
- 
-       if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
-               net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
-                                      dev->name);
--              goto out;
-+              goto err_cant_do;
-       }
- 
-       /* we could easily avoid the clone only if called by ingress and clsact;
-@@ -279,7 +279,7 @@ static int tcf_mirred_act(struct sk_buff
-       if (!use_reinsert) {
-               skb2 = skb_clone(skb, GFP_ATOMIC);
-               if (!skb2)
--                      goto out;
-+                      goto err_cant_do;
-       }
- 
-       want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
-@@ -321,12 +321,16 @@ static int tcf_mirred_act(struct sk_buff
-       }
- 
-       err = tcf_mirred_forward(want_ingress, skb2);
--      if (err) {
--out:
-+      if (err)
-               tcf_action_inc_overlimit_qstats(&m->common);
--              if (tcf_mirred_is_act_redirect(m_eaction))
--                      retval = TC_ACT_SHOT;
--      }
-+      __this_cpu_dec(mirred_nest_level);
-+
-+      return retval;
-+
-+err_cant_do:
-+      if (is_redirect)
-+              retval = TC_ACT_SHOT;
-+      tcf_action_inc_overlimit_qstats(&m->common);
-       __this_cpu_dec(mirred_nest_level);
- 
-       return retval;

diff --git a/queue-6.1/series b/queue-6.1/series
index b5b9f2d6f49e0782d0fb0281a9c9e1b0a4d92a7b..330fab9480fbc4ba9054d2a44222870017132e0a 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -276,7 +276,6 @@ revert-loongarch-bpf-fix-off-by-one-error-in-build_prologue.patch
 nvmet-fc-remove-unused-functions.patch
 smb-server-fix-potential-null-ptr-deref-of-lease_ctx_info-in-smb2_open.patch
 cifs-use-origin-fullpath-for-automounts.patch
-net-sched-act_mirred-don-t-override-retval-if-we-already-lost-the-skb.patch
 btrfs-fix-the-length-of-reserved-qgroup-to-free.patch
 bpf-avoid-holding-freeze_mutex-during-mmap-operation.patch
 bpf-prevent-tail-call-between-progs-attached-to-different-hooks.patch