Pull networking fixes from Jakub Kicinski. "Including fixes from bpf and netfilter. Current release - regressions: - sock: fix parameter order in sock_setsockopt() Current release - new code bugs: - netfilter: nft_last: - fix incorrect arithmetic when restoring last used - honor NFTA_LAST_SET on restoration Previous releases - regressions: - udp: properly flush normal packet at GRO time - sfc: ensure correct number of XDP queues; don't allow enabling the feature if there isn't sufficient resources to Tx from any CPU - dsa: sja1105: fix address learning getting disabled on the CPU port - mptcp: addresses a rmem accounting issue that could keep packets in subflow receive buffers longer than necessary, delaying MPTCP-level ACKs - ip_tunnel: fix mtu calculation for ETHER tunnel devices - do not reuse skbs allocated from skbuff_fclone_cache in the napi skb cache, we'd try to return them to the wrong slab cache - tcp: consistently disable header prediction for mptcp Previous releases - always broken: - bpf: fix subprog poke descriptor tracking use-after-free - ipv6: - allocate enough headroom in ip6_finish_output2() in case iptables TEE is used - tcp: drop silly ICMPv6 packet too big messages to avoid expensive and pointless lookups (which may serve as a DDOS vector) - make sure fwmark is copied in SYNACK packets - fix 'disable_policy' for forwarded packets (align with IPv4) - netfilter: conntrack: - do not renew entry stuck in tcp SYN_SENT state - do not mark RST in the reply direction coming after SYN packet for an out-of-sync entry - mptcp: cleanly handle error conditions with MP_JOIN and syncookies - mptcp: fix double free when rejecting a join due to port mismatch - validate lwtstate->data before returning from skb_tunnel_info() - tcp: call sk_wmem_schedule before sk_mem_charge in zerocopy path - mt76: mt7921: continue to probe driver when fw already downloaded - bonding: fix multiple issues with offloading IPsec to (thru?) bond - stmmac: ptp: fix issues around Qbv support and setting time back - bcmgenet: always clear wake-up based on energy detection Misc: - sctp: move 198 addresses from unusable to private scope - ptp: support virtual clocks and timestamping - openvswitch: optimize operation for key comparison" * tag 'net-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (158 commits) net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave() sfc: add logs explaining XDP_TX/REDIRECT is not available sfc: ensure correct number of XDP queues sfc: fix lack of XDP TX queues - error XDP TX failed (-22) net: fddi: fix UAF in fza_probe net: dsa: sja1105: fix address learning getting disabled on the CPU port net: ocelot: fix switchdev objects synced for wrong netdev with LAG offload net: Use nlmsg_unicast() instead of netlink_unicast() octeontx2-pf: Fix uninitialized boolean variable pps ipv6: allocate enough headroom in ip6_finish_output2() net: hdlc: rename 'mod_init' & 'mod_exit' functions to be module-specific net: bridge: multicast: fix MRD advertisement router port marking race net: bridge: multicast: fix PIM hello router port marking race net: phy: marvell10g: fix differentiation of 88X3310 from 88X3340 dsa: fix for_each_child.cocci warnings virtio_net: check virtqueue_add_sgs() return value mptcp: properly account bulk freed memory selftests: mptcp: fix case multiple subflows limited by server mptcp: avoid processing packet if a subflow reset mptcp: fix syncookie process if mptcp can not_accept new subflow ...
Showing the changes to kernel (3 of 191 files). Show all
Unified · Split
| @@ -2236,8 +2236,14 @@ static void bpf_prog_free_deferred(struct work_struct *work) · 2235 unmodified lines | ||
| 2236 | 2236 | #endif |
| 2237 | 2237 | if (aux->dst_trampoline) |
| 2238 | 2238 | bpf_trampoline_put(aux->dst_trampoline); |
| 2239 | − for (i = 0; i < aux->func_cnt; i++) | |
| 2239 | + for (i = 0; i < aux->func_cnt; i++) { | |
| 2240 | + /* We can just unlink the subprog poke descriptor table as | |
| 2241 | + * it was originally linked to the main program and is also | |
| 2242 | + * released along with it. | |
| 2243 | + */ | |
| 2244 | + aux->func[i]->aux->poke_tab = NULL; | |
| 2240 | 2245 | bpf_jit_free(aux->func[i]); |
| 2246 | + } | |
| 2241 | 2247 | if (aux->func_cnt) { |
| 2242 | 2248 | kfree(aux->func); |
| 2243 | 2249 | bpf_prog_unlock_free(aux->prog); |
| @@ -558,7 +558,8 @@ int dev_map_enqueue_multi(struct xdp_buff *xdp, struct net_device *dev_rx, · 557 unmodified lines | ||
| 558 | 558 | |
| 559 | 559 | if (map->map_type == BPF_MAP_TYPE_DEVMAP) { |
| 560 | 560 | for (i = 0; i < map->max_entries; i++) { |
| 561 | − dst = READ_ONCE(dtab->netdev_map[i]); | |
| 561 | + dst = rcu_dereference_check(dtab->netdev_map[i], | |
| 562 | + rcu_read_lock_bh_held()); | |
| 562 | 563 | if (!is_valid_dst(dst, xdp, exclude_ifindex)) |
| 563 | 564 | continue; |
| 564 | 565 | |
| @@ -654,7 +655,8 @@ int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb, · 89 unmodified lines | ||
| 654 | 655 | |
| 655 | 656 | if (map->map_type == BPF_MAP_TYPE_DEVMAP) { |
| 656 | 657 | for (i = 0; i < map->max_entries; i++) { |
| 657 | − dst = READ_ONCE(dtab->netdev_map[i]); | |
| 658 | + dst = rcu_dereference_check(dtab->netdev_map[i], | |
| 659 | + rcu_read_lock_bh_held()); | |
| 658 | 660 | if (!dst || dst->dev->ifindex == exclude_ifindex) |
| 659 | 661 | continue; |
| 660 | 662 | |
| @@ -12121,33 +12121,19 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 12120 unmodified lines | ||
| 12121 | 12121 | goto out_free; |
| 12122 | 12122 | func[i]->is_func = 1; |
| 12123 | 12123 | func[i]->aux->func_idx = i; |
| 12124 | − /* the btf and func_info will be freed only at prog->aux */ | |
| 12124 | + /* Below members will be freed only at prog->aux */ | |
| 12125 | 12125 | func[i]->aux->btf = prog->aux->btf; |
| 12126 | 12126 | func[i]->aux->func_info = prog->aux->func_info; |
| 12127 | + func[i]->aux->poke_tab = prog->aux->poke_tab; | |
| 12128 | + func[i]->aux->size_poke_tab = prog->aux->size_poke_tab; | |
| 12127 | 12129 | |
| 12128 | 12130 | for (j = 0; j < prog->aux->size_poke_tab; j++) { |
| 12129 | − u32 insn_idx = prog->aux->poke_tab[j].insn_idx; | |
| 12130 | − int ret; | |
| 12131 | + struct bpf_jit_poke_descriptor *poke; | |
| 12131 | 12132 | |
| 12132 | − if (!(insn_idx >= subprog_start && | |
| 12133 | − insn_idx <= subprog_end)) | |
| 12134 | − continue; | |
| 12135 | − | |
| 12136 | − ret = bpf_jit_add_poke_descriptor(func[i], | |
| 12137 | − &prog->aux->poke_tab[j]); | |
| 12138 | − if (ret < 0) { | |
| 12139 | − verbose(env, "adding tail call poke descriptor failed\n"); | |
| 12140 | − goto out_free; | |
| 12141 | − } | |
| 12142 | − | |
| 12143 | − func[i]->insnsi[insn_idx - subprog_start].imm = ret + 1; | |
| 12144 | − | |
| 12145 | − map_ptr = func[i]->aux->poke_tab[ret].tail_call.map; | |
| 12146 | − ret = map_ptr->ops->map_poke_track(map_ptr, func[i]->aux); | |
| 12147 | − if (ret < 0) { | |
| 12148 | − verbose(env, "tracking tail call prog failed\n"); | |
| 12149 | − goto out_free; | |
| 12150 | − } | |
| 12133 | + poke = &prog->aux->poke_tab[j]; | |
| 12134 | + if (poke->insn_idx < subprog_end && | |
| 12135 | + poke->insn_idx >= subprog_start) | |
| 12136 | + poke->aux = func[i]->aux; | |
| 12151 | 12137 | } |
| 12152 | 12138 | |
| 12153 | 12139 | /* Use bpf_prog_F_tag to indicate functions in stack traces. |
| @@ -12178,18 +12164,6 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 24 unmodified lines | ||
| 12178 | 12164 | cond_resched(); |
| 12179 | 12165 | } |
| 12180 | 12166 | |
| 12181 | − /* Untrack main program's aux structs so that during map_poke_run() | |
| 12182 | − * we will not stumble upon the unfilled poke descriptors; each | |
| 12183 | − * of the main program's poke descs got distributed across subprogs | |
| 12184 | − * and got tracked onto map, so we are sure that none of them will | |
| 12185 | − * be missed after the operation below | |
| 12186 | − */ | |
| 12187 | − for (i = 0; i < prog->aux->size_poke_tab; i++) { | |
| 12188 | − map_ptr = prog->aux->poke_tab[i].tail_call.map; | |
| 12189 | − | |
| 12190 | − map_ptr->ops->map_poke_untrack(map_ptr, prog->aux); | |
| 12191 | − } | |
| 12192 | − | |
| 12193 | 12167 | /* at this point all bpf functions were successfully JITed |
| 12194 | 12168 | * now populate all bpf_calls with correct addresses and |
| 12195 | 12169 | * run last pass of JIT |
| @@ -12267,14 +12241,22 @@ static int jit_subprogs(struct bpf_verifier_env *env) · 71 unmodified lines | ||
| 12267 | 12241 | bpf_prog_jit_attempt_done(prog); |
| 12268 | 12242 | return 0; |
| 12269 | 12243 | out_free: |
| 12244 | + /* We failed JIT'ing, so at this point we need to unregister poke | |
| 12245 | + * descriptors from subprogs, so that kernel is not attempting to | |
| 12246 | + * patch it anymore as we're freeing the subprog JIT memory. | |
| 12247 | + */ | |
| 12248 | + for (i = 0; i < prog->aux->size_poke_tab; i++) { | |
| 12249 | + map_ptr = prog->aux->poke_tab[i].tail_call.map; | |
| 12250 | + map_ptr->ops->map_poke_untrack(map_ptr, prog->aux); | |
| 12251 | + } | |
| 12252 | + /* At this point we're guaranteed that poke descriptors are not | |
| 12253 | + * live anymore. We can just unlink its descriptor table as it's | |
| 12254 | + * released with the main prog. | |
| 12255 | + */ | |
| 12270 | 12256 | for (i = 0; i < env->subprog_cnt; i++) { |
| 12271 | 12257 | if (!func[i]) |
| 12272 | 12258 | continue; |
| 12273 | − | |
| 12274 | − for (j = 0; j < func[i]->aux->size_poke_tab; j++) { | |
| 12275 | − map_ptr = func[i]->aux->poke_tab[j].tail_call.map; | |
| 12276 | − map_ptr->ops->map_poke_untrack(map_ptr, func[i]->aux); | |
| 12277 | − } | |
| 12259 | + func[i]->aux->poke_tab = NULL; | |
| 12278 | 12260 | bpf_jit_free(func[i]); |
| 12279 | 12261 | } |
| 12280 | 12262 | kfree(func); |