From: Greg Kroah-Hartman Date: Sat, 9 Dec 2023 12:38:09 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v6.6.6~28 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=df27943e778ad55e424ce9c8d16c8570f821b8a3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: packet-move-reference-count-in-packet_sock-to-atomic_long_t.patch --- diff --git a/queue-5.4/packet-move-reference-count-in-packet_sock-to-atomic_long_t.patch b/queue-5.4/packet-move-reference-count-in-packet_sock-to-atomic_long_t.patch new file mode 100644 index 00000000000..96c53fd51d6 --- /dev/null +++ b/queue-5.4/packet-move-reference-count-in-packet_sock-to-atomic_long_t.patch @@ -0,0 +1,109 @@ +From db3fadacaf0c817b222090290d06ca2a338422d0 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 1 Dec 2023 14:10:21 +0100 +Subject: packet: Move reference count in packet_sock to atomic_long_t + +From: Daniel Borkmann + +commit db3fadacaf0c817b222090290d06ca2a338422d0 upstream. + +In some potential instances the reference count on struct packet_sock +could be saturated and cause overflows which gets the kernel a bit +confused. To prevent this, move to a 64-bit atomic reference count on +64-bit architectures to prevent the possibility of this type to overflow. + +Because we can not handle saturation, using refcount_t is not possible +in this place. Maybe someday in the future if it changes it could be +used. Also, instead of using plain atomic64_t, use atomic_long_t instead. +32-bit machines tend to be memory-limited (i.e. anything that increases +a reference uses so much memory that you can't actually get to 2**32 +references). 32-bit architectures also tend to have serious problems +with 64-bit atomics. Hence, atomic_long_t is the more natural solution. + +Reported-by: "The UK's National Cyber Security Centre (NCSC)" +Co-developed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Daniel Borkmann +Cc: Linus Torvalds +Cc: stable@kernel.org +Reviewed-by: Willem de Bruijn +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20231201131021.19999-1-daniel@iogearbox.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 16 ++++++++-------- + net/packet/internal.h | 2 +- + 2 files changed, 9 insertions(+), 9 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -4240,7 +4240,7 @@ static void packet_mm_open(struct vm_are + struct sock *sk = sock->sk; + + if (sk) +- atomic_inc(&pkt_sk(sk)->mapped); ++ atomic_long_inc(&pkt_sk(sk)->mapped); + } + + static void packet_mm_close(struct vm_area_struct *vma) +@@ -4250,7 +4250,7 @@ static void packet_mm_close(struct vm_ar + struct sock *sk = sock->sk; + + if (sk) +- atomic_dec(&pkt_sk(sk)->mapped); ++ atomic_long_dec(&pkt_sk(sk)->mapped); + } + + static const struct vm_operations_struct packet_mmap_ops = { +@@ -4345,7 +4345,7 @@ static int packet_set_ring(struct sock * + + err = -EBUSY; + if (!closing) { +- if (atomic_read(&po->mapped)) ++ if (atomic_long_read(&po->mapped)) + goto out; + if (packet_read_pending(rb)) + goto out; +@@ -4448,7 +4448,7 @@ static int packet_set_ring(struct sock * + + err = -EBUSY; + mutex_lock(&po->pg_vec_lock); +- if (closing || atomic_read(&po->mapped) == 0) { ++ if (closing || atomic_long_read(&po->mapped) == 0) { + err = 0; + spin_lock_bh(&rb_queue->lock); + swap(rb->pg_vec, pg_vec); +@@ -4466,9 +4466,9 @@ static int packet_set_ring(struct sock * + po->prot_hook.func = (po->rx_ring.pg_vec) ? + tpacket_rcv : packet_rcv; + skb_queue_purge(rb_queue); +- if (atomic_read(&po->mapped)) +- pr_err("packet_mmap: vma is busy: %d\n", +- atomic_read(&po->mapped)); ++ if (atomic_long_read(&po->mapped)) ++ pr_err("packet_mmap: vma is busy: %ld\n", ++ atomic_long_read(&po->mapped)); + } + mutex_unlock(&po->pg_vec_lock); + +@@ -4546,7 +4546,7 @@ static int packet_mmap(struct file *file + } + } + +- atomic_inc(&po->mapped); ++ atomic_long_inc(&po->mapped); + vma->vm_ops = &packet_mmap_ops; + err = 0; + +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -125,7 +125,7 @@ struct packet_sock { + __be16 num; + struct packet_rollover *rollover; + struct packet_mclist *mclist; +- atomic_t mapped; ++ atomic_long_t mapped; + enum tpacket_versions tp_version; + unsigned int tp_hdrlen; + unsigned int tp_reserve; diff --git a/queue-5.4/series b/queue-5.4/series index 808be92de67..b4d1dcf7c4a 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -38,3 +38,4 @@ nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage.patch tracing-always-update-snapshot-buffer-size.patch tracing-fix-incomplete-locking-when-disabling-buffered-events.patch tracing-fix-a-possible-race-when-disabling-buffered-events.patch +packet-move-reference-count-in-packet_sock-to-atomic_long_t.patch