From: Greg Kroah-Hartman Date: Mon, 16 Sep 2024 19:06:36 +0000 (+0200) Subject: drop some patches on request X-Git-Tag: v6.1.111~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4be8fa5bcd2be5f6cbdc75a342cf47386103f5bf;p=thirdparty%2Fkernel%2Fstable-queue.git drop some patches on request --- diff --git a/queue-6.1/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch b/queue-6.1/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch deleted file mode 100644 index e1e8aeab696..00000000000 --- a/queue-6.1/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 51e5b780d2d54efc8b3b92908c9789622a1e9603 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 7 Sep 2024 16:07:49 +0200 -Subject: netfilter: nft_socket: make cgroupsv2 matching work with namespaces - -From: Florian Westphal - -[ Upstream commit 7f3287db654395f9c5ddd246325ff7889f550286 ] - -When running in container environmment, /sys/fs/cgroup/ might not be -the real root node of the sk-attached cgroup. - -Example: - -In container: -% stat /sys//fs/cgroup/ -Device: 0,21 Inode: 2214 .. -% stat /sys/fs/cgroup/foo -Device: 0,21 Inode: 2264 .. - -The expectation would be for: - - nft add rule .. socket cgroupv2 level 1 "foo" counter - -to match traffic from a process that got added to "foo" via -"echo $pid > /sys/fs/cgroup/foo/cgroup.procs". - -However, 'level 3' is needed to make this work. - -Seen from initial namespace, the complete hierarchy is: - -% stat /sys/fs/cgroup/system.slice/docker-.../foo - Device: 0,21 Inode: 2264 .. - -i.e. hierarchy is -0 1 2 3 -/ -> system.slice -> docker-1... -> foo - -... but the container doesn't know that its "/" is the "docker-1.." -cgroup. Current code will retrieve the 'system.slice' cgroup node -and store its kn->id in the destination register, so compare with -2264 ("foo" cgroup id) will not match. - -Fetch "/" cgroup from ->init() and add its level to the level we try to -extract. cgroup root-level is 0 for the init-namespace or the level -of the ancestor that is exposed as the cgroup root inside the container. - -In the above case, cgrp->level of "/" resolved in the container is 2 -(docker-1...scope/) and request for 'level 1' will get adjusted -to fetch the actual level (3). - -v2: use CONFIG_SOCK_CGROUP_DATA, eval function depends on it. - (kernel test robot) - -Cc: cgroups@vger.kernel.org -Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2") -Reported-by: Nadia Pinaeva -Signed-off-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin ---- - net/netfilter/nft_socket.c | 41 +++++++++++++++++++++++++++++++++++--- - 1 file changed, 38 insertions(+), 3 deletions(-) - -diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c -index 0f37738e4b26..8722f712c019 100644 ---- a/net/netfilter/nft_socket.c -+++ b/net/netfilter/nft_socket.c -@@ -9,7 +9,8 @@ - - struct nft_socket { - enum nft_socket_keys key:8; -- u8 level; -+ u8 level; /* cgroupv2 level to extract */ -+ u8 level_user; /* cgroupv2 level provided by userspace */ - u8 len; - union { - u8 dreg; -@@ -53,6 +54,28 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo - memcpy(dest, &cgid, sizeof(u64)); - return true; - } -+ -+/* process context only, uses current->nsproxy. */ -+static noinline int nft_socket_cgroup_subtree_level(void) -+{ -+ struct cgroup *cgrp = cgroup_get_from_path("/"); -+ int level; -+ -+ if (!cgrp) -+ return -ENOENT; -+ -+ level = cgrp->level; -+ -+ cgroup_put(cgrp); -+ -+ if (WARN_ON_ONCE(level > 255)) -+ return -ERANGE; -+ -+ if (WARN_ON_ONCE(level < 0)) -+ return -EINVAL; -+ -+ return level; -+} - #endif - - static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt) -@@ -174,9 +197,10 @@ static int nft_socket_init(const struct nft_ctx *ctx, - case NFT_SOCKET_MARK: - len = sizeof(u32); - break; --#ifdef CONFIG_CGROUPS -+#ifdef CONFIG_SOCK_CGROUP_DATA - case NFT_SOCKET_CGROUPV2: { - unsigned int level; -+ int err; - - if (!tb[NFTA_SOCKET_LEVEL]) - return -EINVAL; -@@ -185,6 +209,17 @@ static int nft_socket_init(const struct nft_ctx *ctx, - if (level > 255) - return -EOPNOTSUPP; - -+ err = nft_socket_cgroup_subtree_level(); -+ if (err < 0) -+ return err; -+ -+ priv->level_user = level; -+ -+ level += err; -+ /* Implies a giant cgroup tree */ -+ if (WARN_ON_ONCE(level > 255)) -+ return -EOPNOTSUPP; -+ - priv->level = level; - len = sizeof(u64); - break; -@@ -209,7 +244,7 @@ static int nft_socket_dump(struct sk_buff *skb, - if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg)) - return -1; - if (priv->key == NFT_SOCKET_CGROUPV2 && -- nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level))) -+ nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user))) - return -1; - return 0; - } --- -2.43.0 - diff --git a/queue-6.1/series b/queue-6.1/series index 59338491e5b..b6a094e5efe 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -49,7 +49,6 @@ octeontx2-af-set-xoff-on-other-child-transmit-schedu.patch octeontx2-af-modify-smq-flush-sequence-to-drop-packe.patch net-ftgmac100-enable-tx-interrupt-to-avoid-tx-timeou.patch netfilter-nft_socket-fix-sk-refcount-leaks.patch -netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch net-dpaa-pad-packets-to-eth_zlen.patch spi-nxp-fspi-fix-the-kasan-report-out-of-bounds-bug.patch soundwire-stream-revert-soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch diff --git a/queue-6.10/net-hsr-prevent-null-pointer-dereference-in-hsr_prox.patch b/queue-6.10/net-hsr-prevent-null-pointer-dereference-in-hsr_prox.patch index d16f5044590..ff154806342 100644 --- a/queue-6.10/net-hsr-prevent-null-pointer-dereference-in-hsr_prox.patch +++ b/queue-6.10/net-hsr-prevent-null-pointer-dereference-in-hsr_prox.patch @@ -25,14 +25,12 @@ Link: https://patch.msgid.link/20240907190341.162289-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- - net/hsr/hsr_device.c | 4 ++++ + net/hsr/hsr_device.c | 4 ++++ 1 file changed, 4 insertions(+) -diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c -index ac56784c327c..049e22bdaafb 100644 --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c -@@ -414,6 +414,9 @@ static void hsr_proxy_announce(struct timer_list *t) +@@ -427,6 +427,9 @@ static void hsr_proxy_announce(struct ti * of SAN nodes stored in ProxyNodeTable. */ interlink = hsr_port_get_hsr(hsr, HSR_PT_INTERLINK); @@ -42,7 +40,7 @@ index ac56784c327c..049e22bdaafb 100644 list_for_each_entry_rcu(node, &hsr->proxy_node_db, mac_list) { if (hsr_addr_is_redbox(hsr, node->macaddress_A)) continue; -@@ -428,6 +431,7 @@ static void hsr_proxy_announce(struct timer_list *t) +@@ -441,6 +444,7 @@ static void hsr_proxy_announce(struct ti mod_timer(&hsr->announce_proxy_timer, jiffies + interval); } @@ -50,6 +48,3 @@ index ac56784c327c..049e22bdaafb 100644 rcu_read_unlock(); } --- -2.43.0 - diff --git a/queue-6.10/net-hsr-remove-seqnr_lock.patch b/queue-6.10/net-hsr-remove-seqnr_lock.patch deleted file mode 100644 index cd7c5a6d913..00000000000 --- a/queue-6.10/net-hsr-remove-seqnr_lock.patch +++ /dev/null @@ -1,213 +0,0 @@ -From 2df9e4d98088c7ec91d973a55bb91ccaf4ac72c1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 4 Sep 2024 13:37:25 +0000 -Subject: net: hsr: remove seqnr_lock - -From: Eric Dumazet - -[ Upstream commit b3c9e65eb227269ed72a115ba22f4f51b4e62b4d ] - -syzbot found a new splat [1]. - -Instead of adding yet another spin_lock_bh(&hsr->seqnr_lock) / -spin_unlock_bh(&hsr->seqnr_lock) pair, remove seqnr_lock -and use atomic_t for hsr->sequence_nr and hsr->sup_sequence_nr. - -This also avoid a race in hsr_fill_info(). - -Also remove interlink_sequence_nr which is unused. - -[1] - WARNING: CPU: 1 PID: 9723 at net/hsr/hsr_forward.c:602 handle_std_frame+0x247/0x2c0 net/hsr/hsr_forward.c:602 -Modules linked in: -CPU: 1 UID: 0 PID: 9723 Comm: syz.0.1657 Not tainted 6.11.0-rc6-syzkaller-00026-g88fac17500f4 #0 -Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 - RIP: 0010:handle_std_frame+0x247/0x2c0 net/hsr/hsr_forward.c:602 -Code: 49 8d bd b0 01 00 00 be ff ff ff ff e8 e2 58 25 00 31 ff 89 c5 89 c6 e8 47 53 a8 f6 85 ed 0f 85 5a ff ff ff e8 fa 50 a8 f6 90 <0f> 0b 90 e9 4c ff ff ff e8 cc e7 06 f7 e9 8f fe ff ff e8 52 e8 06 -RSP: 0018:ffffc90000598598 EFLAGS: 00010246 -RAX: 0000000000000000 RBX: ffffc90000598670 RCX: ffffffff8ae2c919 -RDX: ffff888024e94880 RSI: ffffffff8ae2c926 RDI: 0000000000000005 -RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003 -R13: ffff8880627a8cc0 R14: 0000000000000000 R15: ffff888012b03c3a -FS: 0000000000000000(0000) GS:ffff88802b700000(0063) knlGS:00000000f5696b40 -CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 -CR2: 0000000020010000 CR3: 00000000768b4000 CR4: 0000000000350ef0 -DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -Call Trace: - - hsr_fill_frame_info+0x2c8/0x360 net/hsr/hsr_forward.c:630 - fill_frame_info net/hsr/hsr_forward.c:700 [inline] - hsr_forward_skb+0x7df/0x25c0 net/hsr/hsr_forward.c:715 - hsr_handle_frame+0x603/0x850 net/hsr/hsr_slave.c:70 - __netif_receive_skb_core.constprop.0+0xa3d/0x4330 net/core/dev.c:5555 - __netif_receive_skb_list_core+0x357/0x950 net/core/dev.c:5737 - __netif_receive_skb_list net/core/dev.c:5804 [inline] - netif_receive_skb_list_internal+0x753/0xda0 net/core/dev.c:5896 - gro_normal_list include/net/gro.h:515 [inline] - gro_normal_list include/net/gro.h:511 [inline] - napi_complete_done+0x23f/0x9a0 net/core/dev.c:6247 - gro_cell_poll+0x162/0x210 net/core/gro_cells.c:66 - __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6772 - napi_poll net/core/dev.c:6841 [inline] - net_rx_action+0xa92/0x1010 net/core/dev.c:6963 - handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 - do_softirq kernel/softirq.c:455 [inline] - do_softirq+0xb2/0xf0 kernel/softirq.c:442 - - - -Fixes: 06afd2c31d33 ("hsr: Synchronize sending frames to have always incremented outgoing seq nr.") -Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") -Reported-by: syzbot -Signed-off-by: Eric Dumazet -Cc: Sebastian Andrzej Siewior -Reviewed-by: Simon Horman -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/hsr/hsr_device.c | 35 ++++++++++------------------------- - net/hsr/hsr_forward.c | 4 +--- - net/hsr/hsr_main.h | 6 ++---- - net/hsr/hsr_netlink.c | 2 +- - 4 files changed, 14 insertions(+), 33 deletions(-) - -diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c -index e4cc6b78dcfc..ac56784c327c 100644 ---- a/net/hsr/hsr_device.c -+++ b/net/hsr/hsr_device.c -@@ -231,9 +231,7 @@ static netdev_tx_t hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev) - skb->dev = master->dev; - skb_reset_mac_header(skb); - skb_reset_mac_len(skb); -- spin_lock_bh(&hsr->seqnr_lock); - hsr_forward_skb(skb, master); -- spin_unlock_bh(&hsr->seqnr_lock); - } else { - dev_core_stats_tx_dropped_inc(dev); - dev_kfree_skb_any(skb); -@@ -314,14 +312,10 @@ static void send_hsr_supervision_frame(struct hsr_port *port, - set_hsr_stag_HSR_ver(hsr_stag, hsr->prot_version); - - /* From HSRv1 on we have separate supervision sequence numbers. */ -- spin_lock_bh(&hsr->seqnr_lock); -- if (hsr->prot_version > 0) { -- hsr_stag->sequence_nr = htons(hsr->sup_sequence_nr); -- hsr->sup_sequence_nr++; -- } else { -- hsr_stag->sequence_nr = htons(hsr->sequence_nr); -- hsr->sequence_nr++; -- } -+ if (hsr->prot_version > 0) -+ hsr_stag->sequence_nr = htons(atomic_inc_return(&hsr->sup_sequence_nr)); -+ else -+ hsr_stag->sequence_nr = htons(atomic_inc_return(&hsr->sequence_nr)); - - hsr_stag->tlv.HSR_TLV_type = type; - /* TODO: Why 12 in HSRv0? */ -@@ -343,13 +337,11 @@ static void send_hsr_supervision_frame(struct hsr_port *port, - ether_addr_copy(hsr_sp->macaddress_A, hsr->macaddress_redbox); - } - -- if (skb_put_padto(skb, ETH_ZLEN)) { -- spin_unlock_bh(&hsr->seqnr_lock); -+ if (skb_put_padto(skb, ETH_ZLEN)) - return; -- } - - hsr_forward_skb(skb, port); -- spin_unlock_bh(&hsr->seqnr_lock); -+ - return; - } - -@@ -374,9 +366,7 @@ static void send_prp_supervision_frame(struct hsr_port *master, - set_hsr_stag_HSR_ver(hsr_stag, (hsr->prot_version ? 1 : 0)); - - /* From HSRv1 on we have separate supervision sequence numbers. */ -- spin_lock_bh(&hsr->seqnr_lock); -- hsr_stag->sequence_nr = htons(hsr->sup_sequence_nr); -- hsr->sup_sequence_nr++; -+ hsr_stag->sequence_nr = htons(atomic_inc_return(&hsr->sup_sequence_nr)); - hsr_stag->tlv.HSR_TLV_type = PRP_TLV_LIFE_CHECK_DD; - hsr_stag->tlv.HSR_TLV_length = sizeof(struct hsr_sup_payload); - -@@ -384,13 +374,10 @@ static void send_prp_supervision_frame(struct hsr_port *master, - hsr_sp = skb_put(skb, sizeof(struct hsr_sup_payload)); - ether_addr_copy(hsr_sp->macaddress_A, master->dev->dev_addr); - -- if (skb_put_padto(skb, ETH_ZLEN)) { -- spin_unlock_bh(&hsr->seqnr_lock); -+ if (skb_put_padto(skb, ETH_ZLEN)) - return; -- } - - hsr_forward_skb(skb, master); -- spin_unlock_bh(&hsr->seqnr_lock); - } - - /* Announce (supervision frame) timer function -@@ -621,11 +608,9 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], - if (res < 0) - return res; - -- spin_lock_init(&hsr->seqnr_lock); - /* Overflow soon to find bugs easier: */ -- hsr->sequence_nr = HSR_SEQNR_START; -- hsr->sup_sequence_nr = HSR_SUP_SEQNR_START; -- hsr->interlink_sequence_nr = HSR_SEQNR_START; -+ atomic_set(&hsr->sequence_nr, HSR_SEQNR_START); -+ atomic_set(&hsr->sup_sequence_nr, HSR_SUP_SEQNR_START); - - timer_setup(&hsr->announce_timer, hsr_announce, 0); - timer_setup(&hsr->prune_timer, hsr_prune_nodes, 0); -diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c -index 960ef386bc3a..9254037e9436 100644 ---- a/net/hsr/hsr_forward.c -+++ b/net/hsr/hsr_forward.c -@@ -599,9 +599,7 @@ static void handle_std_frame(struct sk_buff *skb, - if (port->type == HSR_PT_MASTER || - port->type == HSR_PT_INTERLINK) { - /* Sequence nr for the master/interlink node */ -- lockdep_assert_held(&hsr->seqnr_lock); -- frame->sequence_nr = hsr->sequence_nr; -- hsr->sequence_nr++; -+ frame->sequence_nr = atomic_inc_return(&hsr->sequence_nr); - } - } - -diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h -index ab1f8d35d9dc..6f7bbf01f3e4 100644 ---- a/net/hsr/hsr_main.h -+++ b/net/hsr/hsr_main.h -@@ -202,11 +202,9 @@ struct hsr_priv { - struct timer_list prune_timer; - struct timer_list prune_proxy_timer; - int announce_count; -- u16 sequence_nr; -- u16 interlink_sequence_nr; /* Interlink port seq_nr */ -- u16 sup_sequence_nr; /* For HSRv1 separate seq_nr for supervision */ -+ atomic_t sequence_nr; -+ atomic_t sup_sequence_nr; /* For HSRv1 separate seq_nr for supervision */ - enum hsr_version prot_version; /* Indicate if HSRv0, HSRv1 or PRPv1 */ -- spinlock_t seqnr_lock; /* locking for sequence_nr */ - spinlock_t list_lock; /* locking for node list */ - struct hsr_proto_ops *proto_ops; - #define PRP_LAN_ID 0x5 /* 0x1010 for A and 0x1011 for B. Bit 0 is set -diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c -index f6ff0b61e08a..8aea4ff5f49e 100644 ---- a/net/hsr/hsr_netlink.c -+++ b/net/hsr/hsr_netlink.c -@@ -163,7 +163,7 @@ static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev) - - if (nla_put(skb, IFLA_HSR_SUPERVISION_ADDR, ETH_ALEN, - hsr->sup_multicast_addr) || -- nla_put_u16(skb, IFLA_HSR_SEQ_NR, hsr->sequence_nr)) -+ nla_put_u16(skb, IFLA_HSR_SEQ_NR, atomic_read(&hsr->sequence_nr))) - goto nla_put_failure; - if (hsr->prot_version == PRP_V1) - proto = HSR_PROTOCOL_PRP; --- -2.43.0 - diff --git a/queue-6.10/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch b/queue-6.10/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch deleted file mode 100644 index eef715c173b..00000000000 --- a/queue-6.10/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 3666ebb403366008bbbfaf723124e54828ea4d3b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 7 Sep 2024 16:07:49 +0200 -Subject: netfilter: nft_socket: make cgroupsv2 matching work with namespaces - -From: Florian Westphal - -[ Upstream commit 7f3287db654395f9c5ddd246325ff7889f550286 ] - -When running in container environmment, /sys/fs/cgroup/ might not be -the real root node of the sk-attached cgroup. - -Example: - -In container: -% stat /sys//fs/cgroup/ -Device: 0,21 Inode: 2214 .. -% stat /sys/fs/cgroup/foo -Device: 0,21 Inode: 2264 .. - -The expectation would be for: - - nft add rule .. socket cgroupv2 level 1 "foo" counter - -to match traffic from a process that got added to "foo" via -"echo $pid > /sys/fs/cgroup/foo/cgroup.procs". - -However, 'level 3' is needed to make this work. - -Seen from initial namespace, the complete hierarchy is: - -% stat /sys/fs/cgroup/system.slice/docker-.../foo - Device: 0,21 Inode: 2264 .. - -i.e. hierarchy is -0 1 2 3 -/ -> system.slice -> docker-1... -> foo - -... but the container doesn't know that its "/" is the "docker-1.." -cgroup. Current code will retrieve the 'system.slice' cgroup node -and store its kn->id in the destination register, so compare with -2264 ("foo" cgroup id) will not match. - -Fetch "/" cgroup from ->init() and add its level to the level we try to -extract. cgroup root-level is 0 for the init-namespace or the level -of the ancestor that is exposed as the cgroup root inside the container. - -In the above case, cgrp->level of "/" resolved in the container is 2 -(docker-1...scope/) and request for 'level 1' will get adjusted -to fetch the actual level (3). - -v2: use CONFIG_SOCK_CGROUP_DATA, eval function depends on it. - (kernel test robot) - -Cc: cgroups@vger.kernel.org -Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2") -Reported-by: Nadia Pinaeva -Signed-off-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin ---- - net/netfilter/nft_socket.c | 41 +++++++++++++++++++++++++++++++++++--- - 1 file changed, 38 insertions(+), 3 deletions(-) - -diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c -index 765ffd6e06bc..12cdff640492 100644 ---- a/net/netfilter/nft_socket.c -+++ b/net/netfilter/nft_socket.c -@@ -9,7 +9,8 @@ - - struct nft_socket { - enum nft_socket_keys key:8; -- u8 level; -+ u8 level; /* cgroupv2 level to extract */ -+ u8 level_user; /* cgroupv2 level provided by userspace */ - u8 len; - union { - u8 dreg; -@@ -53,6 +54,28 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo - memcpy(dest, &cgid, sizeof(u64)); - return true; - } -+ -+/* process context only, uses current->nsproxy. */ -+static noinline int nft_socket_cgroup_subtree_level(void) -+{ -+ struct cgroup *cgrp = cgroup_get_from_path("/"); -+ int level; -+ -+ if (!cgrp) -+ return -ENOENT; -+ -+ level = cgrp->level; -+ -+ cgroup_put(cgrp); -+ -+ if (WARN_ON_ONCE(level > 255)) -+ return -ERANGE; -+ -+ if (WARN_ON_ONCE(level < 0)) -+ return -EINVAL; -+ -+ return level; -+} - #endif - - static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt) -@@ -174,9 +197,10 @@ static int nft_socket_init(const struct nft_ctx *ctx, - case NFT_SOCKET_MARK: - len = sizeof(u32); - break; --#ifdef CONFIG_CGROUPS -+#ifdef CONFIG_SOCK_CGROUP_DATA - case NFT_SOCKET_CGROUPV2: { - unsigned int level; -+ int err; - - if (!tb[NFTA_SOCKET_LEVEL]) - return -EINVAL; -@@ -185,6 +209,17 @@ static int nft_socket_init(const struct nft_ctx *ctx, - if (level > 255) - return -EOPNOTSUPP; - -+ err = nft_socket_cgroup_subtree_level(); -+ if (err < 0) -+ return err; -+ -+ priv->level_user = level; -+ -+ level += err; -+ /* Implies a giant cgroup tree */ -+ if (WARN_ON_ONCE(level > 255)) -+ return -EOPNOTSUPP; -+ - priv->level = level; - len = sizeof(u64); - break; -@@ -209,7 +244,7 @@ static int nft_socket_dump(struct sk_buff *skb, - if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg)) - return -1; - if (priv->key == NFT_SOCKET_CGROUPV2 && -- nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level))) -+ nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user))) - return -1; - return 0; - } --- -2.43.0 - diff --git a/queue-6.10/series b/queue-6.10/series index a9f34492ea1..78d9b7e94fa 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -67,7 +67,6 @@ cxl-core-fix-incorrect-vendor-debug-uuid-define.patch cxl-restore-xor-d-position-bits-during-address-trans.patch selftests-bpf-support-sock_stream-in-unix_inet_redir.patch net-hsr-send-supervisory-frames-to-hsr-network-with-.patch -net-hsr-remove-seqnr_lock.patch hwmon-pmbus-conditionally-clear-individual-status-bi.patch ice-fix-lldp-packets-dropping-after-changing-the-num.patch ice-fix-accounting-for-filters-shared-by-multiple-vs.patch @@ -89,7 +88,6 @@ selftests-net-csum-fix-checksums-for-packets-with-no.patch drivers-perf-fix-smp_processor_id-use-in-preemptible.patch riscv-disable-preemption-while-handling-pr_riscv_ctx.patch netfilter-nft_socket-fix-sk-refcount-leaks.patch -netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch net-hsr-prevent-null-pointer-dereference-in-hsr_prox.patch net-dsa-felix-ignore-pending-status-of-tas-module-wh.patch net-dpaa-pad-packets-to-eth_zlen.patch diff --git a/queue-6.6/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch b/queue-6.6/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch deleted file mode 100644 index d8edd532104..00000000000 --- a/queue-6.6/netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 5dd0738faba0150678d02eb8e04277fa8c242a77 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 7 Sep 2024 16:07:49 +0200 -Subject: netfilter: nft_socket: make cgroupsv2 matching work with namespaces - -From: Florian Westphal - -[ Upstream commit 7f3287db654395f9c5ddd246325ff7889f550286 ] - -When running in container environmment, /sys/fs/cgroup/ might not be -the real root node of the sk-attached cgroup. - -Example: - -In container: -% stat /sys//fs/cgroup/ -Device: 0,21 Inode: 2214 .. -% stat /sys/fs/cgroup/foo -Device: 0,21 Inode: 2264 .. - -The expectation would be for: - - nft add rule .. socket cgroupv2 level 1 "foo" counter - -to match traffic from a process that got added to "foo" via -"echo $pid > /sys/fs/cgroup/foo/cgroup.procs". - -However, 'level 3' is needed to make this work. - -Seen from initial namespace, the complete hierarchy is: - -% stat /sys/fs/cgroup/system.slice/docker-.../foo - Device: 0,21 Inode: 2264 .. - -i.e. hierarchy is -0 1 2 3 -/ -> system.slice -> docker-1... -> foo - -... but the container doesn't know that its "/" is the "docker-1.." -cgroup. Current code will retrieve the 'system.slice' cgroup node -and store its kn->id in the destination register, so compare with -2264 ("foo" cgroup id) will not match. - -Fetch "/" cgroup from ->init() and add its level to the level we try to -extract. cgroup root-level is 0 for the init-namespace or the level -of the ancestor that is exposed as the cgroup root inside the container. - -In the above case, cgrp->level of "/" resolved in the container is 2 -(docker-1...scope/) and request for 'level 1' will get adjusted -to fetch the actual level (3). - -v2: use CONFIG_SOCK_CGROUP_DATA, eval function depends on it. - (kernel test robot) - -Cc: cgroups@vger.kernel.org -Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2") -Reported-by: Nadia Pinaeva -Signed-off-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin ---- - net/netfilter/nft_socket.c | 41 +++++++++++++++++++++++++++++++++++--- - 1 file changed, 38 insertions(+), 3 deletions(-) - -diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c -index 765ffd6e06bc..12cdff640492 100644 ---- a/net/netfilter/nft_socket.c -+++ b/net/netfilter/nft_socket.c -@@ -9,7 +9,8 @@ - - struct nft_socket { - enum nft_socket_keys key:8; -- u8 level; -+ u8 level; /* cgroupv2 level to extract */ -+ u8 level_user; /* cgroupv2 level provided by userspace */ - u8 len; - union { - u8 dreg; -@@ -53,6 +54,28 @@ nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo - memcpy(dest, &cgid, sizeof(u64)); - return true; - } -+ -+/* process context only, uses current->nsproxy. */ -+static noinline int nft_socket_cgroup_subtree_level(void) -+{ -+ struct cgroup *cgrp = cgroup_get_from_path("/"); -+ int level; -+ -+ if (!cgrp) -+ return -ENOENT; -+ -+ level = cgrp->level; -+ -+ cgroup_put(cgrp); -+ -+ if (WARN_ON_ONCE(level > 255)) -+ return -ERANGE; -+ -+ if (WARN_ON_ONCE(level < 0)) -+ return -EINVAL; -+ -+ return level; -+} - #endif - - static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt) -@@ -174,9 +197,10 @@ static int nft_socket_init(const struct nft_ctx *ctx, - case NFT_SOCKET_MARK: - len = sizeof(u32); - break; --#ifdef CONFIG_CGROUPS -+#ifdef CONFIG_SOCK_CGROUP_DATA - case NFT_SOCKET_CGROUPV2: { - unsigned int level; -+ int err; - - if (!tb[NFTA_SOCKET_LEVEL]) - return -EINVAL; -@@ -185,6 +209,17 @@ static int nft_socket_init(const struct nft_ctx *ctx, - if (level > 255) - return -EOPNOTSUPP; - -+ err = nft_socket_cgroup_subtree_level(); -+ if (err < 0) -+ return err; -+ -+ priv->level_user = level; -+ -+ level += err; -+ /* Implies a giant cgroup tree */ -+ if (WARN_ON_ONCE(level > 255)) -+ return -EOPNOTSUPP; -+ - priv->level = level; - len = sizeof(u64); - break; -@@ -209,7 +244,7 @@ static int nft_socket_dump(struct sk_buff *skb, - if (nft_dump_register(skb, NFTA_SOCKET_DREG, priv->dreg)) - return -1; - if (priv->key == NFT_SOCKET_CGROUPV2 && -- nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level))) -+ nla_put_be32(skb, NFTA_SOCKET_LEVEL, htonl(priv->level_user))) - return -1; - return 0; - } --- -2.43.0 - diff --git a/queue-6.6/series b/queue-6.6/series index dc692c9a61f..7a4a107b71a 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -70,7 +70,6 @@ octeontx2-af-modify-smq-flush-sequence-to-drop-packe.patch net-ftgmac100-enable-tx-interrupt-to-avoid-tx-timeou.patch selftests-net-csum-fix-checksums-for-packets-with-no.patch netfilter-nft_socket-fix-sk-refcount-leaks.patch -netfilter-nft_socket-make-cgroupsv2-matching-work-wi.patch net-dsa-felix-ignore-pending-status-of-tas-module-wh.patch net-dpaa-pad-packets-to-eth_zlen.patch tracing-osnoise-fix-build-when-timerlat-is-not-enabled.patch