From a662939f16b515c5162e304e6a4cf95370e596e1 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 29 Nov 2025 15:56:49 -0500 Subject: [PATCH] Drop mptcp-fix-proto-fallback-detection-with-bpf.patch from older trees Signed-off-by: Sasha Levin --- ...ix-proto-fallback-detection-with-bpf.patch | 101 ------------------ queue-5.10/series | 1 - ...ix-proto-fallback-detection-with-bpf.patch | 101 ------------------ queue-5.15/series | 1 - ...ix-proto-fallback-detection-with-bpf.patch | 101 ------------------ queue-6.1/series | 1 - 6 files changed, 306 deletions(-) delete mode 100644 queue-5.10/mptcp-fix-proto-fallback-detection-with-bpf.patch delete mode 100644 queue-5.15/mptcp-fix-proto-fallback-detection-with-bpf.patch delete mode 100644 queue-6.1/mptcp-fix-proto-fallback-detection-with-bpf.patch diff --git a/queue-5.10/mptcp-fix-proto-fallback-detection-with-bpf.patch b/queue-5.10/mptcp-fix-proto-fallback-detection-with-bpf.patch deleted file mode 100644 index e164ebfab8..0000000000 --- a/queue-5.10/mptcp-fix-proto-fallback-detection-with-bpf.patch +++ /dev/null @@ -1,101 +0,0 @@ -From stable+bounces-196774-greg=kroah.com@vger.kernel.org Mon Nov 24 18:39:05 2025 -From: Sasha Levin -Date: Mon, 24 Nov 2025 12:38:21 -0500 -Subject: mptcp: Fix proto fallback detection with BPF -To: stable@vger.kernel.org -Cc: Jiayuan Chen , Martin KaFai Lau , Jakub Sitnicki , "Matthieu Baerts (NGI0)" , Sasha Levin -Message-ID: <20251124173821.4165452-1-sashal@kernel.org> - -From: Jiayuan Chen - -[ Upstream commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f ] - -The sockmap feature allows bpf syscall from userspace, or based -on bpf sockops, replacing the sk_prot of sockets during protocol stack -processing with sockmap's custom read/write interfaces. -''' -tcp_rcv_state_process() - syn_recv_sock()/subflow_syn_recv_sock() - tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) - bpf_skops_established <== sockops - bpf_sock_map_update(sk) <== call bpf helper - tcp_bpf_update_proto() <== update sk_prot -''' - -When the server has MPTCP enabled but the client sends a TCP SYN -without MPTCP, subflow_syn_recv_sock() performs a fallback on the -subflow, replacing the subflow sk's sk_prot with the native sk_prot. -''' -subflow_syn_recv_sock() - subflow_ulp_fallback() - subflow_drop_ctx() - mptcp_subflow_ops_undo_override() -''' - -Then, this subflow can be normally used by sockmap, which replaces the -native sk_prot with sockmap's custom sk_prot. The issue occurs when the -user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). -Here, it uses sk->sk_prot to compare with the native sk_prot, but this -is incorrect when sockmap is used, as we may incorrectly set -sk->sk_socket->ops. - -This fix uses the more generic sk_family for the comparison instead. - -Additionally, this also prevents a WARNING from occurring: - -result from ./scripts/decode_stacktrace.sh: -------------[ cut here ]------------ -WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ -(net/mptcp/protocol.c:4005) -Modules linked in: -... - -PKRU: 55555554 -Call Trace: - -do_accept (net/socket.c:1989) -__sys_accept4 (net/socket.c:2028 net/socket.c:2057) -__x64_sys_accept (net/socket.c:2067) -x64_sys_call (arch/x86/entry/syscall_64.c:41) -do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) -entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) -RIP: 0033:0x7f87ac92b83d - ----[ end trace 0000000000000000 ]--- - -Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash") -Signed-off-by: Jiayuan Chen -Signed-off-by: Martin KaFai Lau -Reviewed-by: Jakub Sitnicki -Reviewed-by: Matthieu Baerts (NGI0) -Cc: -Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev -[ applied fix to mptcp_is_tcpsk() instead of mptcp_fallback_tcp_ops() ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - net/mptcp/protocol.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -56,8 +56,9 @@ static struct socket *__mptcp_nmpc_socke - static bool mptcp_is_tcpsk(struct sock *sk) - { - struct socket *sock = sk->sk_socket; -+ unsigned short family = READ_ONCE(sk->sk_family); - -- if (unlikely(sk->sk_prot == &tcp_prot)) { -+ if (unlikely(family == AF_INET)) { - /* we are being invoked after mptcp_accept() has - * accepted a non-mp-capable flow: sk is a tcp_sk, - * not an mptcp one. -@@ -68,7 +69,7 @@ static bool mptcp_is_tcpsk(struct sock * - sock->ops = &inet_stream_ops; - return true; - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) { -+ } else if (unlikely(family == AF_INET6)) { - sock->ops = &inet6_stream_ops; - return true; - #endif diff --git a/queue-5.10/series b/queue-5.10/series index 7469d9d379..1b8876be75 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -243,7 +243,6 @@ net-netpoll-fix-incorrect-refcount-handling-causing-incorrect-cleanup.patch alsa-usb-audio-fix-potential-overflow-of-pcm-transfer-buffer.patch pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch -mptcp-fix-proto-fallback-detection-with-bpf.patch ata-libata-scsi-fix-system-suspend-for-a-security-locked-drive.patch mptcp-introduce-mptcp_schedule_work.patch mptcp-fix-race-condition-in-mptcp_schedule_work.patch diff --git a/queue-5.15/mptcp-fix-proto-fallback-detection-with-bpf.patch b/queue-5.15/mptcp-fix-proto-fallback-detection-with-bpf.patch deleted file mode 100644 index 936095005c..0000000000 --- a/queue-5.15/mptcp-fix-proto-fallback-detection-with-bpf.patch +++ /dev/null @@ -1,101 +0,0 @@ -From stable+bounces-196772-greg=kroah.com@vger.kernel.org Mon Nov 24 18:24:35 2025 -From: Sasha Levin -Date: Mon, 24 Nov 2025 12:24:26 -0500 -Subject: mptcp: Fix proto fallback detection with BPF -To: stable@vger.kernel.org -Cc: Jiayuan Chen , Martin KaFai Lau , Jakub Sitnicki , "Matthieu Baerts (NGI0)" , Sasha Levin -Message-ID: <20251124172426.4160679-1-sashal@kernel.org> - -From: Jiayuan Chen - -[ Upstream commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f ] - -The sockmap feature allows bpf syscall from userspace, or based -on bpf sockops, replacing the sk_prot of sockets during protocol stack -processing with sockmap's custom read/write interfaces. -''' -tcp_rcv_state_process() - syn_recv_sock()/subflow_syn_recv_sock() - tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) - bpf_skops_established <== sockops - bpf_sock_map_update(sk) <== call bpf helper - tcp_bpf_update_proto() <== update sk_prot -''' - -When the server has MPTCP enabled but the client sends a TCP SYN -without MPTCP, subflow_syn_recv_sock() performs a fallback on the -subflow, replacing the subflow sk's sk_prot with the native sk_prot. -''' -subflow_syn_recv_sock() - subflow_ulp_fallback() - subflow_drop_ctx() - mptcp_subflow_ops_undo_override() -''' - -Then, this subflow can be normally used by sockmap, which replaces the -native sk_prot with sockmap's custom sk_prot. The issue occurs when the -user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). -Here, it uses sk->sk_prot to compare with the native sk_prot, but this -is incorrect when sockmap is used, as we may incorrectly set -sk->sk_socket->ops. - -This fix uses the more generic sk_family for the comparison instead. - -Additionally, this also prevents a WARNING from occurring: - -result from ./scripts/decode_stacktrace.sh: -------------[ cut here ]------------ -WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ -(net/mptcp/protocol.c:4005) -Modules linked in: -... - -PKRU: 55555554 -Call Trace: - -do_accept (net/socket.c:1989) -__sys_accept4 (net/socket.c:2028 net/socket.c:2057) -__x64_sys_accept (net/socket.c:2067) -x64_sys_call (arch/x86/entry/syscall_64.c:41) -do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) -entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) -RIP: 0033:0x7f87ac92b83d - ----[ end trace 0000000000000000 ]--- - -Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash") -Signed-off-by: Jiayuan Chen -Signed-off-by: Martin KaFai Lau -Reviewed-by: Jakub Sitnicki -Reviewed-by: Matthieu Baerts (NGI0) -Cc: -Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev -[ applied fix to mptcp_is_tcpsk() instead of mptcp_fallback_tcp_ops() ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - net/mptcp/protocol.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -77,8 +77,9 @@ static u64 mptcp_wnd_end(const struct mp - static bool mptcp_is_tcpsk(struct sock *sk) - { - struct socket *sock = sk->sk_socket; -+ unsigned short family = READ_ONCE(sk->sk_family); - -- if (unlikely(sk->sk_prot == &tcp_prot)) { -+ if (unlikely(family == AF_INET)) { - /* we are being invoked after mptcp_accept() has - * accepted a non-mp-capable flow: sk is a tcp_sk, - * not an mptcp one. -@@ -89,7 +90,7 @@ static bool mptcp_is_tcpsk(struct sock * - sock->ops = &inet_stream_ops; - return true; - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) { -+ } else if (unlikely(family == AF_INET6)) { - sock->ops = &inet6_stream_ops; - return true; - #endif diff --git a/queue-5.15/series b/queue-5.15/series index 1dc0f362c7..f1ef3a4b81 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -323,7 +323,6 @@ pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch pmdomain-samsung-plug-potential-memleak-during-probe.patch selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch mptcp-disallow-mptcp-subflows-from-sockmap.patch -mptcp-fix-proto-fallback-detection-with-bpf.patch usb-deprecate-the-third-argument-of-usb_maxpacket.patch input-remove-third-argument-of-usb_maxpacket.patch input-pegasus-notetaker-fix-potential-out-of-bounds-access.patch diff --git a/queue-6.1/mptcp-fix-proto-fallback-detection-with-bpf.patch b/queue-6.1/mptcp-fix-proto-fallback-detection-with-bpf.patch deleted file mode 100644 index b177de651f..0000000000 --- a/queue-6.1/mptcp-fix-proto-fallback-detection-with-bpf.patch +++ /dev/null @@ -1,101 +0,0 @@ -From stable+bounces-196771-greg=kroah.com@vger.kernel.org Mon Nov 24 18:18:14 2025 -From: Sasha Levin -Date: Mon, 24 Nov 2025 12:18:02 -0500 -Subject: mptcp: Fix proto fallback detection with BPF -To: stable@vger.kernel.org -Cc: Jiayuan Chen , Martin KaFai Lau , Jakub Sitnicki , "Matthieu Baerts (NGI0)" , Sasha Levin -Message-ID: <20251124171802.4158681-1-sashal@kernel.org> - -From: Jiayuan Chen - -[ Upstream commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f ] - -The sockmap feature allows bpf syscall from userspace, or based -on bpf sockops, replacing the sk_prot of sockets during protocol stack -processing with sockmap's custom read/write interfaces. -''' -tcp_rcv_state_process() - syn_recv_sock()/subflow_syn_recv_sock() - tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) - bpf_skops_established <== sockops - bpf_sock_map_update(sk) <== call bpf helper - tcp_bpf_update_proto() <== update sk_prot -''' - -When the server has MPTCP enabled but the client sends a TCP SYN -without MPTCP, subflow_syn_recv_sock() performs a fallback on the -subflow, replacing the subflow sk's sk_prot with the native sk_prot. -''' -subflow_syn_recv_sock() - subflow_ulp_fallback() - subflow_drop_ctx() - mptcp_subflow_ops_undo_override() -''' - -Then, this subflow can be normally used by sockmap, which replaces the -native sk_prot with sockmap's custom sk_prot. The issue occurs when the -user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). -Here, it uses sk->sk_prot to compare with the native sk_prot, but this -is incorrect when sockmap is used, as we may incorrectly set -sk->sk_socket->ops. - -This fix uses the more generic sk_family for the comparison instead. - -Additionally, this also prevents a WARNING from occurring: - -result from ./scripts/decode_stacktrace.sh: -------------[ cut here ]------------ -WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ -(net/mptcp/protocol.c:4005) -Modules linked in: -... - -PKRU: 55555554 -Call Trace: - -do_accept (net/socket.c:1989) -__sys_accept4 (net/socket.c:2028 net/socket.c:2057) -__x64_sys_accept (net/socket.c:2067) -x64_sys_call (arch/x86/entry/syscall_64.c:41) -do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) -entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) -RIP: 0033:0x7f87ac92b83d - ----[ end trace 0000000000000000 ]--- - -Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash") -Signed-off-by: Jiayuan Chen -Signed-off-by: Martin KaFai Lau -Reviewed-by: Jakub Sitnicki -Reviewed-by: Matthieu Baerts (NGI0) -Cc: -Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev -[ applied fix to mptcp_is_tcpsk() instead of mptcp_fallback_tcp_ops() ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - net/mptcp/protocol.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -79,8 +79,9 @@ static u64 mptcp_wnd_end(const struct mp - static bool mptcp_is_tcpsk(struct sock *sk) - { - struct socket *sock = sk->sk_socket; -+ unsigned short family = READ_ONCE(sk->sk_family); - -- if (unlikely(sk->sk_prot == &tcp_prot)) { -+ if (unlikely(family == AF_INET)) { - /* we are being invoked after mptcp_accept() has - * accepted a non-mp-capable flow: sk is a tcp_sk, - * not an mptcp one. -@@ -91,7 +92,7 @@ static bool mptcp_is_tcpsk(struct sock * - sock->ops = &inet_stream_ops; - return true; - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) { -+ } else if (unlikely(family == AF_INET6)) { - sock->ops = &inet6_stream_ops; - return true; - #endif diff --git a/queue-6.1/series b/queue-6.1/series index 4a4f329f59..d476c9d324 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -485,7 +485,6 @@ mm-mempool-replace-kmap_atomic-with-kmap_local_page.patch mm-mempool-fix-poisoning-order-0-pages-with-highmem.patch dt-bindings-pinctrl-toshiba-visconti-fix-number-of-items-in-groups.patch ata-libata-scsi-fix-system-suspend-for-a-security-locked-drive.patch -mptcp-fix-proto-fallback-detection-with-bpf.patch hid-amd_sfh-stop-sensor-before-starting.patch selftests-mptcp-join-rm-set-backup-flag.patch selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch -- 2.47.3