From: Sasha Levin Date: Fri, 15 Sep 2023 02:10:44 +0000 (-0400) Subject: Drop ip_tunnels-use-dev_stats_inc.patch X-Git-Tag: v5.10.195~53^2~1 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3eff1f7cf37b8dbe9e61694907c3cf772a2ee55f;p=thirdparty%2Fkernel%2Fstable-queue.git Drop ip_tunnels-use-dev_stats_inc.patch --- diff --git a/queue-4.14/ip_tunnels-use-dev_stats_inc.patch b/queue-4.14/ip_tunnels-use-dev_stats_inc.patch deleted file mode 100644 index 487280e10aa..00000000000 --- a/queue-4.14/ip_tunnels-use-dev_stats_inc.patch +++ /dev/null @@ -1,128 +0,0 @@ -From 4cb7f33912da15f44684f84b10c19213182b03eb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 5 Sep 2023 13:40:46 +0000 -Subject: ip_tunnels: use DEV_STATS_INC() - -From: Eric Dumazet - -[ Upstream commit 9b271ebaf9a2c5c566a54bc6cd915962e8241130 ] - -syzbot/KCSAN reported data-races in iptunnel_xmit_stats() [1] - -This can run from multiple cpus without mutual exclusion. - -Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. - -[1] -BUG: KCSAN: data-race in iptunnel_xmit / iptunnel_xmit - -read-write to 0xffff8881353df170 of 8 bytes by task 30263 on cpu 1: -iptunnel_xmit_stats include/net/ip_tunnels.h:493 [inline] -iptunnel_xmit+0x432/0x4a0 net/ipv4/ip_tunnel_core.c:87 -ip_tunnel_xmit+0x1477/0x1750 net/ipv4/ip_tunnel.c:831 -__gre_xmit net/ipv4/ip_gre.c:469 [inline] -ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:662 -__netdev_start_xmit include/linux/netdevice.h:4889 [inline] -netdev_start_xmit include/linux/netdevice.h:4903 [inline] -xmit_one net/core/dev.c:3544 [inline] -dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560 -__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340 -dev_queue_xmit include/linux/netdevice.h:3082 [inline] -__bpf_tx_skb net/core/filter.c:2129 [inline] -__bpf_redirect_no_mac net/core/filter.c:2159 [inline] -__bpf_redirect+0x723/0x9c0 net/core/filter.c:2182 -____bpf_clone_redirect net/core/filter.c:2453 [inline] -bpf_clone_redirect+0x16c/0x1d0 net/core/filter.c:2425 -___bpf_prog_run+0xd7d/0x41e0 kernel/bpf/core.c:1954 -__bpf_prog_run512+0x74/0xa0 kernel/bpf/core.c:2195 -bpf_dispatcher_nop_func include/linux/bpf.h:1181 [inline] -__bpf_prog_run include/linux/filter.h:609 [inline] -bpf_prog_run include/linux/filter.h:616 [inline] -bpf_test_run+0x15d/0x3d0 net/bpf/test_run.c:423 -bpf_prog_test_run_skb+0x77b/0xa00 net/bpf/test_run.c:1045 -bpf_prog_test_run+0x265/0x3d0 kernel/bpf/syscall.c:3996 -__sys_bpf+0x3af/0x780 kernel/bpf/syscall.c:5353 -__do_sys_bpf kernel/bpf/syscall.c:5439 [inline] -__se_sys_bpf kernel/bpf/syscall.c:5437 [inline] -__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5437 -do_syscall_x64 arch/x86/entry/common.c:50 [inline] -do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 -entry_SYSCALL_64_after_hwframe+0x63/0xcd - -read-write to 0xffff8881353df170 of 8 bytes by task 30249 on cpu 0: -iptunnel_xmit_stats include/net/ip_tunnels.h:493 [inline] -iptunnel_xmit+0x432/0x4a0 net/ipv4/ip_tunnel_core.c:87 -ip_tunnel_xmit+0x1477/0x1750 net/ipv4/ip_tunnel.c:831 -__gre_xmit net/ipv4/ip_gre.c:469 [inline] -ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:662 -__netdev_start_xmit include/linux/netdevice.h:4889 [inline] -netdev_start_xmit include/linux/netdevice.h:4903 [inline] -xmit_one net/core/dev.c:3544 [inline] -dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560 -__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340 -dev_queue_xmit include/linux/netdevice.h:3082 [inline] -__bpf_tx_skb net/core/filter.c:2129 [inline] -__bpf_redirect_no_mac net/core/filter.c:2159 [inline] -__bpf_redirect+0x723/0x9c0 net/core/filter.c:2182 -____bpf_clone_redirect net/core/filter.c:2453 [inline] -bpf_clone_redirect+0x16c/0x1d0 net/core/filter.c:2425 -___bpf_prog_run+0xd7d/0x41e0 kernel/bpf/core.c:1954 -__bpf_prog_run512+0x74/0xa0 kernel/bpf/core.c:2195 -bpf_dispatcher_nop_func include/linux/bpf.h:1181 [inline] -__bpf_prog_run include/linux/filter.h:609 [inline] -bpf_prog_run include/linux/filter.h:616 [inline] -bpf_test_run+0x15d/0x3d0 net/bpf/test_run.c:423 -bpf_prog_test_run_skb+0x77b/0xa00 net/bpf/test_run.c:1045 -bpf_prog_test_run+0x265/0x3d0 kernel/bpf/syscall.c:3996 -__sys_bpf+0x3af/0x780 kernel/bpf/syscall.c:5353 -__do_sys_bpf kernel/bpf/syscall.c:5439 [inline] -__se_sys_bpf kernel/bpf/syscall.c:5437 [inline] -__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5437 -do_syscall_x64 arch/x86/entry/common.c:50 [inline] -do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 -entry_SYSCALL_64_after_hwframe+0x63/0xcd - -value changed: 0x0000000000018830 -> 0x0000000000018831 - -Reported by Kernel Concurrency Sanitizer on: -CPU: 0 PID: 30249 Comm: syz-executor.4 Not tainted 6.5.0-syzkaller-11704-g3f86ed6ec0b3 #0 - -Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()") -Reported-by: syzbot -Signed-off-by: Eric Dumazet -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - include/net/ip_tunnels.h | 15 +++++++-------- - 1 file changed, 7 insertions(+), 8 deletions(-) - -diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h -index eb2321a135068..0dd2eb4c61f12 100644 ---- a/include/net/ip_tunnels.h -+++ b/include/net/ip_tunnels.h -@@ -409,15 +409,14 @@ static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len) - tstats->tx_packets++; - u64_stats_update_end(&tstats->syncp); - put_cpu_ptr(tstats); -+ return; -+ } -+ -+ if (pkt_len < 0) { -+ DEV_STATS_INC(dev, tx_errors); -+ DEV_STATS_INC(dev, tx_aborted_errors); - } else { -- struct net_device_stats *err_stats = &dev->stats; -- -- if (pkt_len < 0) { -- err_stats->tx_errors++; -- err_stats->tx_aborted_errors++; -- } else { -- err_stats->tx_dropped++; -- } -+ DEV_STATS_INC(dev, tx_dropped); - } - } - --- -2.40.1 - diff --git a/queue-4.14/series b/queue-4.14/series index 1f260e7ac1d..8a90497f5c5 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -139,4 +139,3 @@ net-sched-sch_qfq-fix-uaf-in-qfq_dequeue.patch kcm-destroy-mutex-in-kcm_exit_net.patch igbvf-change-igbvf_min-to-allow-set-rx-tx-value-betw.patch igb-change-igb_min-to-allow-set-rx-tx-value-between-.patch -ip_tunnels-use-dev_stats_inc.patch diff --git a/queue-4.19/ip_tunnels-use-dev_stats_inc.patch b/queue-4.19/ip_tunnels-use-dev_stats_inc.patch deleted file mode 100644 index 766cb5dffdf..00000000000 --- a/queue-4.19/ip_tunnels-use-dev_stats_inc.patch +++ /dev/null @@ -1,128 +0,0 @@ -From 7edcdbd724c9dd63f624fb736ba72cfcff8c5a19 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 5 Sep 2023 13:40:46 +0000 -Subject: ip_tunnels: use DEV_STATS_INC() - -From: Eric Dumazet - -[ Upstream commit 9b271ebaf9a2c5c566a54bc6cd915962e8241130 ] - -syzbot/KCSAN reported data-races in iptunnel_xmit_stats() [1] - -This can run from multiple cpus without mutual exclusion. - -Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. - -[1] -BUG: KCSAN: data-race in iptunnel_xmit / iptunnel_xmit - -read-write to 0xffff8881353df170 of 8 bytes by task 30263 on cpu 1: -iptunnel_xmit_stats include/net/ip_tunnels.h:493 [inline] -iptunnel_xmit+0x432/0x4a0 net/ipv4/ip_tunnel_core.c:87 -ip_tunnel_xmit+0x1477/0x1750 net/ipv4/ip_tunnel.c:831 -__gre_xmit net/ipv4/ip_gre.c:469 [inline] -ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:662 -__netdev_start_xmit include/linux/netdevice.h:4889 [inline] -netdev_start_xmit include/linux/netdevice.h:4903 [inline] -xmit_one net/core/dev.c:3544 [inline] -dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560 -__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340 -dev_queue_xmit include/linux/netdevice.h:3082 [inline] -__bpf_tx_skb net/core/filter.c:2129 [inline] -__bpf_redirect_no_mac net/core/filter.c:2159 [inline] -__bpf_redirect+0x723/0x9c0 net/core/filter.c:2182 -____bpf_clone_redirect net/core/filter.c:2453 [inline] -bpf_clone_redirect+0x16c/0x1d0 net/core/filter.c:2425 -___bpf_prog_run+0xd7d/0x41e0 kernel/bpf/core.c:1954 -__bpf_prog_run512+0x74/0xa0 kernel/bpf/core.c:2195 -bpf_dispatcher_nop_func include/linux/bpf.h:1181 [inline] -__bpf_prog_run include/linux/filter.h:609 [inline] -bpf_prog_run include/linux/filter.h:616 [inline] -bpf_test_run+0x15d/0x3d0 net/bpf/test_run.c:423 -bpf_prog_test_run_skb+0x77b/0xa00 net/bpf/test_run.c:1045 -bpf_prog_test_run+0x265/0x3d0 kernel/bpf/syscall.c:3996 -__sys_bpf+0x3af/0x780 kernel/bpf/syscall.c:5353 -__do_sys_bpf kernel/bpf/syscall.c:5439 [inline] -__se_sys_bpf kernel/bpf/syscall.c:5437 [inline] -__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5437 -do_syscall_x64 arch/x86/entry/common.c:50 [inline] -do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 -entry_SYSCALL_64_after_hwframe+0x63/0xcd - -read-write to 0xffff8881353df170 of 8 bytes by task 30249 on cpu 0: -iptunnel_xmit_stats include/net/ip_tunnels.h:493 [inline] -iptunnel_xmit+0x432/0x4a0 net/ipv4/ip_tunnel_core.c:87 -ip_tunnel_xmit+0x1477/0x1750 net/ipv4/ip_tunnel.c:831 -__gre_xmit net/ipv4/ip_gre.c:469 [inline] -ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:662 -__netdev_start_xmit include/linux/netdevice.h:4889 [inline] -netdev_start_xmit include/linux/netdevice.h:4903 [inline] -xmit_one net/core/dev.c:3544 [inline] -dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560 -__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340 -dev_queue_xmit include/linux/netdevice.h:3082 [inline] -__bpf_tx_skb net/core/filter.c:2129 [inline] -__bpf_redirect_no_mac net/core/filter.c:2159 [inline] -__bpf_redirect+0x723/0x9c0 net/core/filter.c:2182 -____bpf_clone_redirect net/core/filter.c:2453 [inline] -bpf_clone_redirect+0x16c/0x1d0 net/core/filter.c:2425 -___bpf_prog_run+0xd7d/0x41e0 kernel/bpf/core.c:1954 -__bpf_prog_run512+0x74/0xa0 kernel/bpf/core.c:2195 -bpf_dispatcher_nop_func include/linux/bpf.h:1181 [inline] -__bpf_prog_run include/linux/filter.h:609 [inline] -bpf_prog_run include/linux/filter.h:616 [inline] -bpf_test_run+0x15d/0x3d0 net/bpf/test_run.c:423 -bpf_prog_test_run_skb+0x77b/0xa00 net/bpf/test_run.c:1045 -bpf_prog_test_run+0x265/0x3d0 kernel/bpf/syscall.c:3996 -__sys_bpf+0x3af/0x780 kernel/bpf/syscall.c:5353 -__do_sys_bpf kernel/bpf/syscall.c:5439 [inline] -__se_sys_bpf kernel/bpf/syscall.c:5437 [inline] -__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5437 -do_syscall_x64 arch/x86/entry/common.c:50 [inline] -do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 -entry_SYSCALL_64_after_hwframe+0x63/0xcd - -value changed: 0x0000000000018830 -> 0x0000000000018831 - -Reported by Kernel Concurrency Sanitizer on: -CPU: 0 PID: 30249 Comm: syz-executor.4 Not tainted 6.5.0-syzkaller-11704-g3f86ed6ec0b3 #0 - -Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()") -Reported-by: syzbot -Signed-off-by: Eric Dumazet -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - include/net/ip_tunnels.h | 15 +++++++-------- - 1 file changed, 7 insertions(+), 8 deletions(-) - -diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h -index bc2ae8ce5bd45..c858dffe546cd 100644 ---- a/include/net/ip_tunnels.h -+++ b/include/net/ip_tunnels.h -@@ -462,15 +462,14 @@ static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len) - tstats->tx_packets++; - u64_stats_update_end(&tstats->syncp); - put_cpu_ptr(tstats); -+ return; -+ } -+ -+ if (pkt_len < 0) { -+ DEV_STATS_INC(dev, tx_errors); -+ DEV_STATS_INC(dev, tx_aborted_errors); - } else { -- struct net_device_stats *err_stats = &dev->stats; -- -- if (pkt_len < 0) { -- err_stats->tx_errors++; -- err_stats->tx_aborted_errors++; -- } else { -- err_stats->tx_dropped++; -- } -+ DEV_STATS_INC(dev, tx_dropped); - } - } - --- -2.40.1 - diff --git a/queue-4.19/series b/queue-4.19/series index 73099a304dd..7b933475d6c 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -218,5 +218,4 @@ kcm-destroy-mutex-in-kcm_exit_net.patch igbvf-change-igbvf_min-to-allow-set-rx-tx-value-betw.patch igb-change-igb_min-to-allow-set-rx-tx-value-between-.patch idr-fix-param-name-in-idr_alloc_cyclic-doc.patch -ip_tunnels-use-dev_stats_inc.patch netfilter-nfnetlink_osf-avoid-oob-read.patch