Pull networking fixes from Jakub Kicinski. "Including fixes from bpf and netfilter. Current release - regressions: - sock: fix parameter order in sock_setsockopt() Current release - new code bugs: - netfilter: nft_last: - fix incorrect arithmetic when restoring last used - honor NFTA_LAST_SET on restoration Previous releases - regressions: - udp: properly flush normal packet at GRO time - sfc: ensure correct number of XDP queues; don't allow enabling the feature if there isn't sufficient resources to Tx from any CPU - dsa: sja1105: fix address learning getting disabled on the CPU port - mptcp: addresses a rmem accounting issue that could keep packets in subflow receive buffers longer than necessary, delaying MPTCP-level ACKs - ip_tunnel: fix mtu calculation for ETHER tunnel devices - do not reuse skbs allocated from skbuff_fclone_cache in the napi skb cache, we'd try to return them to the wrong slab cache - tcp: consistently disable header prediction for mptcp Previous releases - always broken: - bpf: fix subprog poke descriptor tracking use-after-free - ipv6: - allocate enough headroom in ip6_finish_output2() in case iptables TEE is used - tcp: drop silly ICMPv6 packet too big messages to avoid expensive and pointless lookups (which may serve as a DDOS vector) - make sure fwmark is copied in SYNACK packets - fix 'disable_policy' for forwarded packets (align with IPv4) - netfilter: conntrack: - do not renew entry stuck in tcp SYN_SENT state - do not mark RST in the reply direction coming after SYN packet for an out-of-sync entry - mptcp: cleanly handle error conditions with MP_JOIN and syncookies - mptcp: fix double free when rejecting a join due to port mismatch - validate lwtstate->data before returning from skb_tunnel_info() - tcp: call sk_wmem_schedule before sk_mem_charge in zerocopy path - mt76: mt7921: continue to probe driver when fw already downloaded - bonding: fix multiple issues with offloading IPsec to (thru?) bond - stmmac: ptp: fix issues around Qbv support and setting time back - bcmgenet: always clear wake-up based on energy detection Misc: - sctp: move 198 addresses from unusable to private scope - ptp: support virtual clocks and timestamping - openvswitch: optimize operation for key comparison" * tag 'net-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (158 commits) net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave() sfc: add logs explaining XDP_TX/REDIRECT is not available sfc: ensure correct number of XDP queues sfc: fix lack of XDP TX queues - error XDP TX failed (-22) net: fddi: fix UAF in fza_probe net: dsa: sja1105: fix address learning getting disabled on the CPU port net: ocelot: fix switchdev objects synced for wrong netdev with LAG offload net: Use nlmsg_unicast() instead of netlink_unicast() octeontx2-pf: Fix uninitialized boolean variable pps ipv6: allocate enough headroom in ip6_finish_output2() net: hdlc: rename 'mod_init' & 'mod_exit' functions to be module-specific net: bridge: multicast: fix MRD advertisement router port marking race net: bridge: multicast: fix PIM hello router port marking race net: phy: marvell10g: fix differentiation of 88X3310 from 88X3340 dsa: fix for_each_child.cocci warnings virtio_net: check virtqueue_add_sgs() return value mptcp: properly account bulk freed memory selftests: mptcp: fix case multiple subflows limited by server mptcp: avoid processing packet if a subflow reset mptcp: fix syncookie process if mptcp can not_accept new subflow ...
Showing the changes to kernel (3 of 191 files). Show all
Unified · Split
| @@ -2236,8 +2236,14 @@ static void bpf_prog_free_deferred(struct work_struct *work) · 2235 unmodified lines | |||
| 2236 | #endif | 2236 | #endif |
| 2237 | if (aux->dst_trampoline) | 2237 | if (aux->dst_trampoline) |
| 2238 | bpf_trampoline_put(aux->dst_trampoline); | 2238 | bpf_trampoline_put(aux->dst_trampoline); |
| 2239 | for (i = 0; i < aux->func_cnt; i++) | 2239 | for (i = 0; i < aux->func_cnt; i++) { |
| 2240 | /* We can just unlink the subprog poke descriptor table as | ||
| 2241 | * it was originally linked to the main program and is also | ||
| 2242 | * released along with it. | ||
| 2243 | */ | ||
| 2244 | aux->func[i]->aux->poke_tab = NULL; | ||
| 2240 | bpf_jit_free(aux->func[i]); | 2245 | bpf_jit_free(aux->func[i]); |
| 2246 | } | ||
| 2241 | if (aux->func_cnt) { | 2247 | if (aux->func_cnt) { |
| 2242 | kfree(aux->func); | 2248 | kfree(aux->func); |
| 2243 | bpf_prog_unlock_free(aux->prog); | 2249 | bpf_prog_unlock_free(aux->prog); |
| @@ -558,7 +558,8 @@ int dev_map_enqueue_multi(struct xdp_buff *xdp, struct net_device *dev_rx, · 557 unmodified lines | |||
| 558 | 558 | ||
| 559 | if (map->map_type == BPF_MAP_TYPE_DEVMAP) { | 559 | if (map->map_type == BPF_MAP_TYPE_DEVMAP) { |
| 560 | for (i = 0; i < map->max_entries; i++) { | 560 | for (i = 0; i < map->max_entries; i++) { |
| 561 | dst = READ_ONCE(dtab->netdev_map[i]); | 561 | dst = rcu_dereference_check(dtab->netdev_map[i], |
| 562 | rcu_read_lock_bh_held()); | ||
| 562 | if (!is_valid_dst(dst, xdp, exclude_ifindex)) | 563 | if (!is_valid_dst(dst, xdp, exclude_ifindex)) |
| 563 | continue; | 564 | continue; |
| 564 | 565 | ||
| @@ -654,7 +655,8 @@ int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb, · 89 unmodified lines | |||
| 654 | 655 | ||
| 655 | if (map->map_type == BPF_MAP_TYPE_DEVMAP) { | 656 | if (map->map_type == BPF_MAP_TYPE_DEVMAP) { |
| 656 | for (i = 0; i < map->max_entries; i++) { | 657 | for (i = 0; i < map->max_entries; i++) { |
| 657 | dst = READ_ONCE(dtab->netdev_map[i]); | 658 | dst = rcu_dereference_check(dtab->netdev_map[i], |
| 659 | rcu_read_lock_bh_held()); | ||
| 658 | if (!dst || dst->dev->ifindex == exclude_ifindex) | 660 | if (!dst || dst->dev->ifindex == exclude_ifindex) |
| 659 | continue; | 661 | continue; |
| 660 | 662 | ||
| @@ -12121,33 +12121,19 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 12120 unmodified lines | |||
| 12121 | goto out_free; | 12121 | goto out_free; |
| 12122 | func[i]->is_func = 1; | 12122 | func[i]->is_func = 1; |
| 12123 | func[i]->aux->func_idx = i; | 12123 | func[i]->aux->func_idx = i; |
| 12124 | /* the btf and func_info will be freed only at prog->aux */ | 12124 | /* Below members will be freed only at prog->aux */ |
| 12125 | func[i]->aux->btf = prog->aux->btf; | 12125 | func[i]->aux->btf = prog->aux->btf; |
| 12126 | func[i]->aux->func_info = prog->aux->func_info; | 12126 | func[i]->aux->func_info = prog->aux->func_info; |
| 12127 | func[i]->aux->poke_tab = prog->aux->poke_tab; | ||
| 12128 | func[i]->aux->size_poke_tab = prog->aux->size_poke_tab; | ||
| 12127 | 12129 | ||
| 12128 | for (j = 0; j < prog->aux->size_poke_tab; j++) { | 12130 | for (j = 0; j < prog->aux->size_poke_tab; j++) { |
| 12129 | u32 insn_idx = prog->aux->poke_tab[j].insn_idx; | 12131 | struct bpf_jit_poke_descriptor *poke; |
| 12130 | int ret; | ||
| 12131 | 12132 | ||
| 12132 | if (!(insn_idx >= subprog_start && | 12133 | poke = &prog->aux->poke_tab[j]; |
| 12133 | insn_idx <= subprog_end)) | 12134 | if (poke->insn_idx < subprog_end && |
| 12134 | continue; | 12135 | poke->insn_idx >= subprog_start) |
| 12135 | 12136 | poke->aux = func[i]->aux; | |
| 12136 | ret = bpf_jit_add_poke_descriptor(func[i], | ||
| 12137 | &prog->aux->poke_tab[j]); | ||
| 12138 | if (ret < 0) { | ||
| 12139 | verbose(env, "adding tail call poke descriptor failed\n"); | ||
| 12140 | goto out_free; | ||
| 12141 | } | ||
| 12142 | |||
| 12143 | func[i]->insnsi[insn_idx - subprog_start].imm = ret + 1; | ||
| 12144 | |||
| 12145 | map_ptr = func[i]->aux->poke_tab[ret].tail_call.map; | ||
| 12146 | ret = map_ptr->ops->map_poke_track(map_ptr, func[i]->aux); | ||
| 12147 | if (ret < 0) { | ||
| 12148 | verbose(env, "tracking tail call prog failed\n"); | ||
| 12149 | goto out_free; | ||
| 12150 | } | ||
| 12151 | } | 12137 | } |
| 12152 | 12138 | ||
| 12153 | /* Use bpf_prog_F_tag to indicate functions in stack traces. | 12139 | /* Use bpf_prog_F_tag to indicate functions in stack traces. |
| @@ -12178,18 +12164,6 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 24 unmodified lines | |||
| 12178 | cond_resched(); | 12164 | cond_resched(); |
| 12179 | } | 12165 | } |
| 12180 | 12166 | ||
| 12181 | /* Untrack main program's aux structs so that during map_poke_run() | ||
| 12182 | * we will not stumble upon the unfilled poke descriptors; each | ||
| 12183 | * of the main program's poke descs got distributed across subprogs | ||
| 12184 | * and got tracked onto map, so we are sure that none of them will | ||
| 12185 | * be missed after the operation below | ||
| 12186 | */ | ||
| 12187 | for (i = 0; i < prog->aux->size_poke_tab; i++) { | ||
| 12188 | map_ptr = prog->aux->poke_tab[i].tail_call.map; | ||
| 12189 | |||
| 12190 | map_ptr->ops->map_poke_untrack(map_ptr, prog->aux); | ||
| 12191 | } | ||
| 12192 | |||
| 12193 | /* at this point all bpf functions were successfully JITed | 12167 | /* at this point all bpf functions were successfully JITed |
| 12194 | * now populate all bpf_calls with correct addresses and | 12168 | * now populate all bpf_calls with correct addresses and |
| 12195 | * run last pass of JIT | 12169 | * run last pass of JIT |
| @@ -12267,14 +12241,22 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 71 unmodified lines | |||
| 12267 | bpf_prog_jit_attempt_done(prog); | 12241 | bpf_prog_jit_attempt_done(prog); |
| 12268 | return 0; | 12242 | return 0; |
| 12269 | out_free: | 12243 | out_free: |
| 12244 | /* We failed JIT'ing, so at this point we need to unregister poke | ||
| 12245 | * descriptors from subprogs, so that kernel is not attempting to | ||
| 12246 | * patch it anymore as we're freeing the subprog JIT memory. | ||
| 12247 | */ | ||
| 12248 | for (i = 0; i < prog->aux->size_poke_tab; i++) { | ||
| 12249 | map_ptr = prog->aux->poke_tab[i].tail_call.map; | ||
| 12250 | map_ptr->ops->map_poke_untrack(map_ptr, prog->aux); | ||
| 12251 | } | ||
| 12252 | /* At this point we're guaranteed that poke descriptors are not | ||
| 12253 | * live anymore. We can just unlink its descriptor table as it's | ||
| 12254 | * released with the main prog. | ||
| 12255 | */ | ||
| 12270 | for (i = 0; i < env->subprog_cnt; i++) { | 12256 | for (i = 0; i < env->subprog_cnt; i++) { |
| 12271 | if (!func[i]) | 12257 | if (!func[i]) |
| 12272 | continue; | 12258 | continue; |
| 12273 | 12259 | func[i]->aux->poke_tab = NULL; | |
| 12274 | for (j = 0; j < func[i]->aux->size_poke_tab; j++) { | ||
| 12275 | map_ptr = func[i]->aux->poke_tab[j].tail_call.map; | ||
| 12276 | map_ptr->ops->map_poke_untrack(map_ptr, func[i]->aux); | ||
| 12277 | } | ||
| 12278 | bpf_jit_free(func[i]); | 12260 | bpf_jit_free(func[i]); |
| 12279 | } | 12261 | } |
| 12280 | kfree(func); | 12262 | kfree(func); |