- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts. commit 2e7ef287f07c convert from timer to delayed work. Because this patch was not merged, we use GFP_ATOMIC flag] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9fb5077f8e9a..e0d5125de202 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1974,21 +1974,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -1999,20 +1999,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_ATOMIC); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2037,9 +2037,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[openeuler:OLK-6.6 2752/2752] include/linux/bitfield.h:165:3: error: call to '__bad_mask' declared with attribute error: bad bitfield mask
by kernel test robot 27 Aug '25

27 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 242365f71d0edaeff9d861d32b639f02170e075d commit: 9e76624e89d2d5210d25a33749d8989212945735 [2752/2752] [v8-28-43]arm64: RME: Allow checking SVE on VM instance config: arm64-randconfig-004-20250827 (https://download.01.org/0day-ci/archive/20250827/202508271638.WDlsxoDG-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250827/202508271638.WDlsxoDG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508271638.WDlsxoDG-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/include/asm/sysreg.h:1065, from arch/arm64/include/asm/percpu.h:13, from arch/arm64/include/asm/smp.h:28, from include/linux/smp.h:113, from include/linux/percpu.h:7, from include/linux/context_tracking_state.h:5, from include/linux/hardirq.h:5, from include/linux/kvm_host.h:7, from arch/arm64/kvm/rme.c:6: In function 'field_multiplier', inlined from 'u64_get_bits' at include/linux/bitfield.h:201:1, inlined from 'rme_has_feature' at arch/arm64/kvm/rme.c:38:11: >> include/linux/bitfield.h:165:3: error: call to '__bad_mask' declared with attribute error: bad bitfield mask 165 | __bad_mask(); | ^~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +/__bad_mask +165 include/linux/bitfield.h e2192de59e457a Johannes Berg 2023-01-18 119 e2192de59e457a Johannes Berg 2023-01-18 120 /** e2192de59e457a Johannes Berg 2023-01-18 121 * FIELD_PREP_CONST() - prepare a constant bitfield element e2192de59e457a Johannes Berg 2023-01-18 122 * @_mask: shifted mask defining the field's length and position e2192de59e457a Johannes Berg 2023-01-18 123 * @_val: value to put in the field e2192de59e457a Johannes Berg 2023-01-18 124 * e2192de59e457a Johannes Berg 2023-01-18 125 * FIELD_PREP_CONST() masks and shifts up the value. The result should e2192de59e457a Johannes Berg 2023-01-18 126 * be combined with other fields of the bitfield using logical OR. e2192de59e457a Johannes Berg 2023-01-18 127 * e2192de59e457a Johannes Berg 2023-01-18 128 * Unlike FIELD_PREP() this is a constant expression and can therefore e2192de59e457a Johannes Berg 2023-01-18 129 * be used in initializers. Error checking is less comfortable for this e2192de59e457a Johannes Berg 2023-01-18 130 * version, and non-constant masks cannot be used. e2192de59e457a Johannes Berg 2023-01-18 131 */ e2192de59e457a Johannes Berg 2023-01-18 132 #define FIELD_PREP_CONST(_mask, _val) \ e2192de59e457a Johannes Berg 2023-01-18 133 ( \ e2192de59e457a Johannes Berg 2023-01-18 134 /* mask must be non-zero */ \ e2192de59e457a Johannes Berg 2023-01-18 135 BUILD_BUG_ON_ZERO((_mask) == 0) + \ e2192de59e457a Johannes Berg 2023-01-18 136 /* check if value fits */ \ e2192de59e457a Johannes Berg 2023-01-18 137 BUILD_BUG_ON_ZERO(~((_mask) >> __bf_shf(_mask)) & (_val)) + \ e2192de59e457a Johannes Berg 2023-01-18 138 /* check if mask is contiguous */ \ e2192de59e457a Johannes Berg 2023-01-18 139 __BF_CHECK_POW2((_mask) + (1ULL << __bf_shf(_mask))) + \ e2192de59e457a Johannes Berg 2023-01-18 140 /* and create the value */ \ e2192de59e457a Johannes Berg 2023-01-18 141 (((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask)) \ e2192de59e457a Johannes Berg 2023-01-18 142 ) e2192de59e457a Johannes Berg 2023-01-18 143 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 144 /** 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 145 * FIELD_GET() - extract a bitfield element 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 146 * @_mask: shifted mask defining the field's length and position 7240767450d6d8 Masahiro Yamada 2017-10-03 147 * @_reg: value of entire bitfield 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 148 * 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 149 * FIELD_GET() extracts the field specified by @_mask from the 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 150 * bitfield passed in as @_reg by masking and shifting it down. 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 151 */ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 152 #define FIELD_GET(_mask, _reg) \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 153 ({ \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 154 __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 155 (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 156 }) 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 157 e7d4a95da86e0b Johannes Berg 2018-06-20 158 extern void __compiletime_error("value doesn't fit into mask") 00b0c9b82663ac Al Viro 2017-12-14 159 __field_overflow(void); 00b0c9b82663ac Al Viro 2017-12-14 160 extern void __compiletime_error("bad bitfield mask") 00b0c9b82663ac Al Viro 2017-12-14 161 __bad_mask(void); 00b0c9b82663ac Al Viro 2017-12-14 162 static __always_inline u64 field_multiplier(u64 field) 00b0c9b82663ac Al Viro 2017-12-14 163 { 00b0c9b82663ac Al Viro 2017-12-14 164 if ((field | (field - 1)) & ((field | (field - 1)) + 1)) 00b0c9b82663ac Al Viro 2017-12-14 @165 __bad_mask(); 00b0c9b82663ac Al Viro 2017-12-14 166 return field & -field; 00b0c9b82663ac Al Viro 2017-12-14 167 } 00b0c9b82663ac Al Viro 2017-12-14 168 static __always_inline u64 field_mask(u64 field) 00b0c9b82663ac Al Viro 2017-12-14 169 { 00b0c9b82663ac Al Viro 2017-12-14 170 return field / field_multiplier(field); 00b0c9b82663ac Al Viro 2017-12-14 171 } e31a50162feb35 Alex Elder 2020-03-12 172 #define field_max(field) ((typeof(field))field_mask(field)) 00b0c9b82663ac Al Viro 2017-12-14 173 #define ____MAKE_OP(type,base,to,from) \ 00b0c9b82663ac Al Viro 2017-12-14 174 static __always_inline __##type type##_encode_bits(base v, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 175 { \ e7d4a95da86e0b Johannes Berg 2018-06-20 176 if (__builtin_constant_p(v) && (v & ~field_mask(field))) \ 00b0c9b82663ac Al Viro 2017-12-14 177 __field_overflow(); \ 00b0c9b82663ac Al Viro 2017-12-14 178 return to((v & field_mask(field)) * field_multiplier(field)); \ 00b0c9b82663ac Al Viro 2017-12-14 179 } \ 00b0c9b82663ac Al Viro 2017-12-14 180 static __always_inline __##type type##_replace_bits(__##type old, \ 00b0c9b82663ac Al Viro 2017-12-14 181 base val, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 182 { \ 00b0c9b82663ac Al Viro 2017-12-14 183 return (old & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac Al Viro 2017-12-14 184 } \ 00b0c9b82663ac Al Viro 2017-12-14 185 static __always_inline void type##p_replace_bits(__##type *p, \ 00b0c9b82663ac Al Viro 2017-12-14 186 base val, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 187 { \ 00b0c9b82663ac Al Viro 2017-12-14 188 *p = (*p & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac Al Viro 2017-12-14 189 } \ 00b0c9b82663ac Al Viro 2017-12-14 190 static __always_inline base type##_get_bits(__##type v, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 191 { \ 00b0c9b82663ac Al Viro 2017-12-14 192 return (from(v) & field)/field_multiplier(field); \ 00b0c9b82663ac Al Viro 2017-12-14 193 } 00b0c9b82663ac Al Viro 2017-12-14 194 #define __MAKE_OP(size) \ 00b0c9b82663ac Al Viro 2017-12-14 195 ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ 00b0c9b82663ac Al Viro 2017-12-14 196 ____MAKE_OP(be##size,u##size,cpu_to_be##size,be##size##_to_cpu) \ 00b0c9b82663ac Al Viro 2017-12-14 197 ____MAKE_OP(u##size,u##size,,) 37a3862e123826 Johannes Berg 2018-06-20 198 ____MAKE_OP(u8,u8,,) 00b0c9b82663ac Al Viro 2017-12-14 199 __MAKE_OP(16) 00b0c9b82663ac Al Viro 2017-12-14 200 __MAKE_OP(32) 00b0c9b82663ac Al Viro 2017-12-14 201 __MAKE_OP(64) 00b0c9b82663ac Al Viro 2017-12-14 202 #undef __MAKE_OP 00b0c9b82663ac Al Viro 2017-12-14 203 #undef ____MAKE_OP 00b0c9b82663ac Al Viro 2017-12-14 204 :::::: The code at line 165 was first introduced by commit :::::: 00b0c9b82663ac42e5a09f58ce960f81f29d64ee Add primitives for manipulating bitfields both in host- and fixed-endian. :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2753/2753] drivers/i2c/busses/i2c-zhaoxin.c:176:5: warning: no previous prototype for function 'zxi2c_fifo_irq_xfer'
by kernel test robot 27 Aug '25

27 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 71bbca0322aee9dfe26f2a23ab54f5cfca1dd85c commit: 07a6747f952bd8a1ee87d6f5d74448c64fbb152e [2753/2753] i2c: zhaoxin: Add support for Zhaoxin I2C controller config: x86_64-buildonly-randconfig-001-20250827 (https://download.01.org/0day-ci/archive/20250827/202508271625.s6br6gQM-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250827/202508271625.s6br6gQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508271625.s6br6gQM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/i2c/busses/i2c-zhaoxin.c:12: In file included from include/linux/i2c.h:19: In file included from include/linux/regulator/consumer.h:35: In file included from include/linux/suspend.h:5: In file included from include/linux/swap.h:9: In file included from include/linux/memcontrol.h:20: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/i2c/busses/i2c-zhaoxin.c:176:5: warning: no previous prototype for function 'zxi2c_fifo_irq_xfer' [-Wmissing-prototypes] 176 | int zxi2c_fifo_irq_xfer(struct zxi2c *i2c, bool irq) | ^ drivers/i2c/busses/i2c-zhaoxin.c:176:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 176 | int zxi2c_fifo_irq_xfer(struct zxi2c *i2c, bool irq) | ^ | static >> drivers/i2c/busses/i2c-zhaoxin.c:314:5: warning: no previous prototype for function 'zxi2c_xfer' [-Wmissing-prototypes] 314 | int zxi2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) | ^ drivers/i2c/busses/i2c-zhaoxin.c:314:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 314 | int zxi2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) | ^ | static 3 warnings generated. vim +/zxi2c_fifo_irq_xfer +176 drivers/i2c/busses/i2c-zhaoxin.c 174 175 /* 'irq == true' means in interrupt context */ > 176 int zxi2c_fifo_irq_xfer(struct zxi2c *i2c, bool irq) 177 { 178 u16 i; 179 u8 tmp; 180 struct i2c_msg *msg = i2c->msg; 181 void __iomem *base = i2c->base; 182 bool read = !!(msg->flags & I2C_M_RD); 183 184 if (irq) { 185 /* get the received data */ 186 if (read) 187 for (i = 0; i < i2c->xfer_len; i++) 188 msg->buf[i2c->xfered_len + i] = ioread8(base + ZXI2C_REG_HRDR); 189 190 i2c->xfered_len += i2c->xfer_len; 191 if (i2c->xfered_len == msg->len) 192 return 1; 193 } 194 195 /* reset fifo buffer */ 196 tmp = ioread8(base + ZXI2C_REG_HCR); 197 iowrite8(tmp | ZXI2C_HCR_RST_FIFO, base + ZXI2C_REG_HCR); 198 199 /* set xfer len */ 200 i2c->xfer_len = min_t(u16, msg->len - i2c->xfered_len, ZXI2C_FIFO_SIZE); 201 if (read) { 202 iowrite8(i2c->xfer_len - 1, base + ZXI2C_REG_HRLR); 203 } else { 204 iowrite8(i2c->xfer_len - 1, base + ZXI2C_REG_HTLR); 205 /* set write data */ 206 for (i = 0; i < i2c->xfer_len; i++) 207 iowrite8(msg->buf[i2c->xfered_len + i], base + ZXI2C_REG_HTDR); 208 } 209 210 /* prepare to stop transmission */ 211 if (i2c->hrv && msg->len == (i2c->xfered_len + i2c->xfer_len)) { 212 tmp = ioread8(base + ZXI2C_REG_CR); 213 tmp |= read ? ZXI2C_CR_RX_END : ZXI2C_CR_TX_END; 214 iowrite8(tmp, base + ZXI2C_REG_CR); 215 } 216 217 if (irq) { 218 /* continue transmission */ 219 tmp = ioread8(base + ZXI2C_REG_CR); 220 iowrite8(tmp |= ZXI2C_CR_CPU_RDY, base + ZXI2C_REG_CR); 221 } else { 222 u16 tcr_val = i2c->tcr; 223 224 /* start transmission */ 225 tcr_val |= read ? ZXI2C_TCR_READ : 0; 226 writew(tcr_val | msg->addr, base + ZXI2C_REG_TCR); 227 } 228 229 return 0; 230 } 231 232 static irqreturn_t zxi2c_isr(int irq, void *data) 233 { 234 struct zxi2c *i2c = data; 235 void __iomem *base = i2c->base; 236 u8 status; 237 238 /* save the status and write-clear it */ 239 status = readw(base + ZXI2C_REG_ISR); 240 if (!status) 241 return IRQ_NONE; 242 243 writew(status, base + ZXI2C_REG_ISR); 244 245 i2c->ret = 0; 246 if (status & ZXI2C_ISR_NACK_ADDR) 247 i2c->ret = -EIO; 248 249 if (!i2c->ret) { 250 if (i2c->mode == ZXI2C_BYTE_MODE) 251 i2c->ret = zxi2c_irq_xfer(i2c); 252 else 253 i2c->ret = zxi2c_fifo_irq_xfer(i2c, true); 254 } 255 256 if (i2c->ret) 257 complete(&i2c->complete); 258 259 return IRQ_HANDLED; 260 } 261 262 static int zxi2c_write(struct zxi2c *i2c, struct i2c_msg *msg, int last) 263 { 264 u16 tcr_val = i2c->tcr; 265 void __iomem *base = i2c->base; 266 267 i2c->last = last; 268 269 writew(msg->buf[0] & 0xFF, base + ZXI2C_REG_CDR); 270 271 reinit_completion(&i2c->complete); 272 273 tcr_val |= msg->addr & 0x7f; 274 275 writew(tcr_val, base + ZXI2C_REG_TCR); 276 277 if (!wait_for_completion_timeout(&i2c->complete, ZXI2C_TIMEOUT)) 278 return -ETIMEDOUT; 279 280 return i2c->ret; 281 } 282 283 static int zxi2c_read(struct zxi2c *i2c, struct i2c_msg *msg, bool first) 284 { 285 u16 val, tcr_val = i2c->tcr; 286 void __iomem *base = i2c->base; 287 288 val = readw(base + ZXI2C_REG_CR); 289 val &= ~(ZXI2C_CR_TX_END | ZXI2C_CR_RX_END); 290 291 if (msg->len == 1) 292 val |= ZXI2C_CR_RX_END; 293 294 writew(val, base + ZXI2C_REG_CR); 295 296 reinit_completion(&i2c->complete); 297 298 tcr_val |= ZXI2C_TCR_READ | (msg->addr & 0x7f); 299 300 writew(tcr_val, base + ZXI2C_REG_TCR); 301 302 if (!first) { 303 val = readw(base + ZXI2C_REG_CR); 304 val |= ZXI2C_CR_CPU_RDY; 305 writew(val, base + ZXI2C_REG_CR); 306 } 307 308 if (!wait_for_completion_timeout(&i2c->complete, ZXI2C_TIMEOUT)) 309 return -ETIMEDOUT; 310 311 return i2c->ret; 312 } 313 > 314 int zxi2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) 315 { 316 struct i2c_msg *msg; 317 int i; 318 int ret = 0; 319 struct zxi2c *i2c = i2c_get_adapdata(adap); 320 321 i2c->mode = ZXI2C_BYTE_MODE; 322 for (i = 0; ret >= 0 && i < num; i++) { 323 i2c->msg = msg = &msgs[i]; 324 i2c->xfered_len = 0; 325 if (msg->len == 0) 326 return -EIO; 327 328 if (msg->flags & I2C_M_RD) 329 ret = zxi2c_read(i2c, msg, i == 0); 330 else 331 ret = zxi2c_write(i2c, msg, (i + 1) == num); 332 } 333 334 return (ret < 0) ? ret : i; 335 } 336 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] page_pool: Fix use-after-free in page_pool_recycle_in_ring
by Dong Chenchen 27 Aug '25

27 Aug '25

mainline inclusion from mainline-v6.16-rc1 commit 271683bb2cf32e5126c592b5d5e6a756fa374fd9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUI9J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------- syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Link: https://lore.kernel.org/netdev/20250513083123.3514193-1-dongchenchen2@huawe… Fixes: ff7d6b27f894 ("page_pool: refurbish version of page_pool code") Reported-by: syzbot+204a4382fcb3311f3858(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=204a4382fcb3311f3858 Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Reviewed-by: Mina Almasry <almasrymina(a)google.com> Link: https://patch.msgid.link/20250527114152.3119109-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/page_pool.c [commit 4dec64c52e24 and 7aee8429eedd are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/page_pool.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/net/core/page_pool.c b/net/core/page_pool.c index 2f2f63c8cf4b..cb7238043a33 100644 --- a/net/core/page_pool.c +++ b/net/core/page_pool.c @@ -140,9 +140,9 @@ u64 *page_pool_ethtool_stats_get(u64 *data, void *stats) EXPORT_SYMBOL(page_pool_ethtool_stats_get); #else -#define alloc_stat_inc(pool, __stat) -#define recycle_stat_inc(pool, __stat) -#define recycle_stat_add(pool, __stat, val) +#define alloc_stat_inc(...) do { } while (0) +#define recycle_stat_inc(...) do { } while (0) +#define recycle_stat_add(...) do { } while (0) #endif static bool page_pool_producer_lock(struct page_pool *pool) @@ -547,19 +547,16 @@ static void page_pool_return_page(struct page_pool *pool, struct page *page) static bool page_pool_recycle_in_ring(struct page_pool *pool, struct page *page) { - int ret; - /* BH protection not needed if current is softirq */ - if (in_softirq()) - ret = ptr_ring_produce(&pool->ring, page); - else - ret = ptr_ring_produce_bh(&pool->ring, page); + bool in_softirq, ret; - if (!ret) { + /* BH protection not needed if current is softirq */ + in_softirq = page_pool_producer_lock(pool); + ret = !__ptr_ring_produce(&pool->ring, page); + if (ret) recycle_stat_inc(pool, ring); - return true; - } + page_pool_producer_unlock(pool, in_softirq); - return false; + return ret; } /* Only allow direct recycling in special circumstances, into the @@ -848,10 +845,14 @@ static void page_pool_scrub(struct page_pool *pool) static int page_pool_release(struct page_pool *pool) { + bool in_softirq; int inflight; page_pool_scrub(pool); inflight = page_pool_inflight(pool); + /* Acquire producer lock to make sure producers have exited. */ + in_softirq = page_pool_producer_lock(pool); + page_pool_producer_unlock(pool, in_softirq); if (!inflight) page_pool_free(pool); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] bpf, sockmap: Fix CVE-2025-38154
by Dong Chenchen 27 Aug '25

27 Aug '25

Fix CVE-2025-38154 Jiayuan Chen (2): bpf, sockmap: fix duplicated data transmission bpf, sockmap: Avoid using sk_socket after free when sending net/core/skmsg.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.16-rc1 commit b85e3367a5716ed3662a4fe266525190d2af76df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4OD CVE: CVE-2025-38201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. Similar to: b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX") Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_pipapo.c [commit 07ace0bbe03b and 9f439bd6ef4f are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 4274831b6e67..ebd0f704c863 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -667,6 +667,11 @@ static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules) } mt: + if (rules > (INT_MAX / sizeof(*new_mt))) { + kvfree(new_lt); + return -ENOMEM; + } + new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL); if (!new_mt) { kvfree(new_lt); @@ -1359,6 +1364,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL); if (!dst->mt) goto out_mt; -- 2.25.1

2 1

[PATCH OLK-6.6] net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> stable inclusion from stable-v6.6.95 commit 66bba1fd5bad548c03f7e42669a59f3f4d8211cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4NT CVE: CVE-2025-38183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e353b0854d3a1a31cb061df8d022fbfea53a0f24 ] Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTP_INT_STS) specifications. However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index: lan743x_ptp_io_event_clock_get(..., u8 channel,...) { ... /* Update Local timestamp */ extts = &ptp->extts[channel]; extts->ts.tv_sec = sec; ... } To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743X_PTP_N_EXTTS to 8. Detected using the static analysis tool - Svace. Fixes: 60942c397af6 ("net: lan743x: Add support for PTP-IO Event Input External Timestamp (extts)") Signed-off-by: Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Acked-by: Rengarajan S <rengarajan.s(a)microchip.com> Link: https://patch.msgid.link/20250616113743.36284-1-aleksei.kodanev@bell-sw.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/microchip/lan743x_ptp.h [commit b1de3c0df7ab is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/microchip/lan743x_ptp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/microchip/lan743x_ptp.h b/drivers/net/ethernet/microchip/lan743x_ptp.h index e26d4eff7133..b7f2d425427d 100644 --- a/drivers/net/ethernet/microchip/lan743x_ptp.h +++ b/drivers/net/ethernet/microchip/lan743x_ptp.h @@ -18,9 +18,9 @@ */ #define LAN743X_PTP_N_EVENT_CHAN 2 #define LAN743X_PTP_N_PEROUT LAN743X_PTP_N_EVENT_CHAN -#define LAN743X_PTP_N_EXTTS 4 -#define LAN743X_PTP_N_PPS 0 #define PCI11X1X_PTP_IO_MAX_CHANNELS 8 +#define LAN743X_PTP_N_EXTTS PCI11X1X_PTP_IO_MAX_CHANNELS +#define LAN743X_PTP_N_PPS 0 struct lan743x_adapter; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] net: xfrm: Fix CVE-2025-38097
by Dong Chenchen 27 Aug '25

27 Aug '25

Fix CVE-2025-38097 Dong Chenchen (1): net: xfrm: Fix kabi breakage of struct xfrm_state Sabrina Dubroca (1): espintcp: remove encap socket caching to avoid reference leak net/ipv4/esp4.c | 49 ++++--------------------------------------- net/ipv6/esp6.c | 49 ++++--------------------------------------- net/xfrm/xfrm_state.c | 3 --- 3 files changed, 8 insertions(+), 93 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] bpf: fix ktls panic with sockmap
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Jiayuan Chen <jiayuan.chen(a)linux.dev> stable inclusion from stable-v6.6.94 commit 2e36a81d388ec9c3f78b6223f7eda2088cd40adb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT51 CVE: CVE-2025-38166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 54a3ecaeeeae8176da8badbd7d72af1017032c39 ] [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] <TASK> [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.946031] ? iov_iter_revert+0x178/0x180 [ 2172.946267] ? do_error_trap+0x7d/0x110 [ 2172.946499] ? iov_iter_revert+0x178/0x180 [ 2172.946736] ? exc_invalid_op+0x50/0x70 [ 2172.946961] ? iov_iter_revert+0x178/0x180 [ 2172.947197] ? asm_exc_invalid_op+0x1a/0x20 [ 2172.947446] ? iov_iter_revert+0x178/0x180 [ 2172.947683] ? iov_iter_revert+0x5c/0x180 [ 2172.947913] tls_sw_sendmsg_locked.isra.0+0x794/0x840 [ 2172.948206] tls_sw_sendmsg+0x52/0x80 [ 2172.948420] ? inet_sendmsg+0x1f/0x70 [ 2172.948634] __sys_sendto+0x1cd/0x200 [ 2172.948848] ? find_held_lock+0x2b/0x80 [ 2172.949072] ? syscall_trace_enter+0x140/0x270 [ 2172.949330] ? __lock_release.isra.0+0x5e/0x170 [ 2172.949595] ? find_held_lock+0x2b/0x80 [ 2172.949817] ? syscall_trace_enter+0x140/0x270 [ 2172.950211] ? lockdep_hardirqs_on_prepare+0xda/0x190 [ 2172.950632] ? ktime_get_coarse_real_ts64+0xc2/0xd0 [ 2172.951036] __x64_sys_sendto+0x24/0x30 [ 2172.951382] do_syscall_64+0x90/0x170 ...... After calling bpf_exec_tx_verdict(), the size of msg_pl->sg may increase, e.g., when the BPF program executes bpf_msg_push_data(). If the BPF program sets cork_bytes and sg.size is smaller than cork_bytes, it will return -ENOSPC and attempt to roll back to the non-zero copy logic. However, during rollback, msg->msg_iter is reset, but since msg_pl->sg.size has been increased, subsequent executions will exceed the actual size of msg_iter. ''' iov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size); ''' The changes in this commit are based on the following considerations: 1. When cork_bytes is set, rolling back to non-zero copy logic is pointless and can directly go to zero-copy logic. 2. We can not calculate the correct number of bytes to revert msg_iter. Assume the original data is "abcdefgh" (8 bytes), and after 3 pushes by the BPF program, it becomes 11-byte data: "abc?de?fgh?". Then, we set cork_bytes to 6, which means the first 6 bytes have been processed, and the remaining 5 bytes "?fgh?" will be cached until the length meets the cork_bytes requirement. However, some data in "?fgh?" is not within 'sg->msg_iter' (but in msg_pl instead), especially the data "?" we pushed. So it doesn't seem as simple as just reverting through an offset of msg_iter. 3. For non-TLS sockets in tcp_bpf_sendmsg, when a "cork" situation occurs, the user-space send() doesn't return an error, and the returned length is the same as the input length parameter, even if some data is cached. Additionally, I saw that the current non-zero-copy logic for handling corking is written as: ''' line 1177 else if (ret != -EAGAIN) { if (ret == -ENOSPC) ret = 0; goto send_end; ''' So it's ok to just return 'copied' without error when a "cork" situation occurs. Fixes: fcb14cb1bdac ("new iov_iter flavour - ITER_UBUF") Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Signed-off-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/r/20250219052015.274405-2-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/tls/tls_sw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 6e30fe879d53..bf445a518883 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1120,9 +1120,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, num_async++; else if (ret == -ENOMEM) goto wait_for_memory; - else if (ctx->open_rec && ret == -ENOSPC) + else if (ctx->open_rec && ret == -ENOSPC) { + if (msg_pl->cork_bytes) { + ret = 0; + goto send_end; + } goto rollback_iter; - else if (ret != -EAGAIN) + } else if (ret != -EAGAIN) goto send_end; } continue; -- 2.25.1

2 1

[PATCH OLK-6.6] bpf, sockmap: Fix panic when calling skb_linearize
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Jiayuan Chen <jiayuan.chen(a)linux.dev> mainline inclusion from mainline-v6.14 commit 5ca2e29f6834c64c0e5a9ccf1278c21fb49b827e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT9B CVE: CVE-2025-38165 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 Then a kernel panic was captured: ''' [ 657.460555] kernel BUG at net/core/skbuff.c:2178! [ 657.462680] Tainted: [W]=WARN [ 657.463287] Workqueue: events sk_psock_backlog ... [ 657.469610] <TASK> [ 657.469738] ? die+0x36/0x90 [ 657.469916] ? do_trap+0x1d0/0x270 [ 657.470118] ? pskb_expand_head+0x612/0xf40 [ 657.470376] ? pskb_expand_head+0x612/0xf40 [ 657.470620] ? do_error_trap+0xa3/0x170 [ 657.470846] ? pskb_expand_head+0x612/0xf40 [ 657.471092] ? handle_invalid_op+0x2c/0x40 [ 657.471335] ? pskb_expand_head+0x612/0xf40 [ 657.471579] ? exc_invalid_op+0x2d/0x40 [ 657.471805] ? asm_exc_invalid_op+0x1a/0x20 [ 657.472052] ? pskb_expand_head+0xd1/0xf40 [ 657.472292] ? pskb_expand_head+0x612/0xf40 [ 657.472540] ? lock_acquire+0x18f/0x4e0 [ 657.472766] ? find_held_lock+0x2d/0x110 [ 657.472999] ? __pfx_pskb_expand_head+0x10/0x10 [ 657.473263] ? __kmalloc_cache_noprof+0x5b/0x470 [ 657.473537] ? __pfx___lock_release.isra.0+0x10/0x10 [ 657.473826] __pskb_pull_tail+0xfd/0x1d20 [ 657.474062] ? __kasan_slab_alloc+0x4e/0x90 [ 657.474707] sk_psock_skb_ingress_enqueue+0x3bf/0x510 [ 657.475392] ? __kasan_kmalloc+0xaa/0xb0 [ 657.476010] sk_psock_backlog+0x5cf/0xd70 [ 657.476637] process_one_work+0x858/0x1a20 ''' The panic originates from the assertion BUG_ON(skb_shared(skb)) in skb_linearize(). A previous commit(see Fixes tag) introduced skb_get() to avoid race conditions between skb operations in the backlog and skb release in the recvmsg path. However, this caused the panic to always occur when skb_linearize is executed. The "--rx-strp 100000" parameter forces the RX path to use the strparser module which aggregates data until it reaches 100KB before calling sockmap logic. The 100KB payload exceeds MAX_MSG_FRAGS, triggering skb_linearize. To fix this issue, just move skb_get into sk_psock_skb_ingress_enqueue. ''' sk_psock_backlog: sk_psock_handle_skb skb_get(skb) <== we move it into 'sk_psock_skb_ingress_enqueue' sk_psock_skb_ingress____________ ↓ | | → sk_psock_skb_ingress_self | sk_psock_skb_ingress_enqueue sk_psock_verdict_apply_________________↑ skb_linearize ''' Note that for verdict_apply path, the skb_get operation is unnecessary so we add 'take_ref' param to control it's behavior. Fixes: a454d84ee20b ("bpf, sockmap: Fix skb refcnt race after locking changes") Signed-off-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Link: https://lore.kernel.org/r/20250407142234.47591-4-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/skmsg.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 5e77b9344d66..1463117e4858 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -531,16 +531,22 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, u32 off, u32 len, struct sk_psock *psock, struct sock *sk, - struct sk_msg *msg) + struct sk_msg *msg, + bool take_ref) { int num_sge, copied; + /* skb_to_sgvec will fail when the total number of fragments in + * frag_list and frags exceeds MAX_MSG_FRAGS. For example, the + * caller may aggregate multiple skbs. + */ num_sge = skb_to_sgvec(skb, msg->sg.data, off, len); if (num_sge < 0) { /* skb linearize may fail with ENOMEM, but lets simply try again * later if this happens. Under memory pressure we don't want to * drop the skb. We need to linearize the skb so that the mapping * in skb_to_sgvec can not error. + * Note that skb_linearize requires the skb not to be shared. */ if (skb_linearize(skb)) return -EAGAIN; @@ -554,7 +560,7 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, msg->sg.start = 0; msg->sg.size = copied; msg->sg.end = num_sge; - msg->skb = skb; + msg->skb = take_ref ? skb_get(skb) : skb; sk_psock_queue_msg(psock, msg); sk_psock_data_ready(sk, psock); @@ -562,7 +568,7 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, } static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len); + u32 off, u32 len, bool take_ref); static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, u32 off, u32 len) @@ -576,7 +582,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, * correctly. */ if (unlikely(skb->sk == sk)) - return sk_psock_skb_ingress_self(psock, skb, off, len); + return sk_psock_skb_ingress_self(psock, skb, off, len, true); msg = sk_psock_create_ingress_msg(sk, skb); if (!msg) return -EAGAIN; @@ -588,7 +594,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, * into user buffers. */ skb_set_owner_r(skb, sk); - err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg); + err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, true); if (err < 0) kfree(msg); return err; @@ -599,7 +605,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, * because the skb is already accounted for here. */ static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len) + u32 off, u32 len, bool take_ref) { struct sk_msg *msg = alloc_sk_msg(GFP_ATOMIC); struct sock *sk = psock->sk; @@ -608,7 +614,7 @@ static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb if (unlikely(!msg)) return -EAGAIN; skb_set_owner_r(skb, sk); - err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg); + err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, take_ref); if (err < 0) kfree(msg); return err; @@ -617,18 +623,13 @@ static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb, u32 off, u32 len, bool ingress) { - int err = 0; - if (!ingress) { if (!sock_writeable(psock->sk)) return -EAGAIN; return skb_send_sock(psock->sk, skb, off, len); } - skb_get(skb); - err = sk_psock_skb_ingress(psock, skb, off, len); - if (err < 0) - kfree_skb(skb); - return err; + + return sk_psock_skb_ingress(psock, skb, off, len); } static void sk_psock_skb_state(struct sk_psock *psock, @@ -1014,7 +1015,7 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb, off = stm->offset; len = stm->full_len; } - err = sk_psock_skb_ingress_self(psock, skb, off, len); + err = sk_psock_skb_ingress_self(psock, skb, off, len, false); } if (err < 0) { spin_lock_bh(&psock->ingress_lock); -- 2.25.1

2 1