mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
master
10994
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Linus Torvalds
|
55fbedcec6 |
Merge tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Pull bpf updates from Alexei Starovoitov:
"Major changes:
- Introduce scalar evolution (SCEV) analysis in the verifier.
It infers how registers and stack slots change in a loop and lets
the verifier check bounded loops with induction variables as ranges
instead of walking every iteration. The number of processed insns
drops ten fold in programs with loops (Eduard Zingerman)
- Add 'callx' instruction: indirect call of a static BPF subprogram.
The address is taken with ld_imm64 or loaded from read-only data.
Supported by x86-64, arm64 and riscv64 JITs (Alexei Starovoitov, Pu
Lehui)
- Add unwind_goto and unwind_exit instructions, so that Rust panic or
C++ exception can run destructors of every frame it passes through.
The normal path is free of unwind code. Supported by x86-64 and
arm64 JITs (Alexei Starovoitov)
- Support programs compiled by rust-bpf: treat load and store through
a number as arena access with BPF_F_ARENA_SCALAR, accept rust names
in BTF (Alexei Starovoitov)
- Raise BPF program stack size from 512 bytes to 2 KiB on x86-64 and
arm64 (Kumar Kartikeya Dwivedi)
- Support struct, union and __int128 up to 16 bytes passed and
returned by value in BPF subprograms and kfuncs, and fix x86-64 and
arm64 trampolines for such arguments (Yonghong Song)
- Introduce a common way to attach struct_ops to a cgroup via
bpf_link. bpf_tcp_ops is the first user and mirrors TCP sock_ops
callbacks (Martin KaFai Lau, Amery Hung)
- Describe inlined functions in BTF. New kinds tell where the inline
sites are and how to fetch the arguments there.
CONFIG_DEBUG_INFO_BTF_INLINE keeps it apart from the main BTF in
.BTF.inline section or in btf_vmlinux_inline.ko (Alan Maguire)
- Fix many memory safety, lifetime and locking bugs in BPF core,
verifier, iterators, local storage, dynptr, devmap, cpumap and
seg6local (Josef Bacik, Alexei Starovoitov)
- Diff stat is dominated by selftests and by removal of
lib/test_bpf.c. Its 16k lines of instruction tests were converted
to BPF selftests that BPF CI runs on every architecture it covers
(Daniel Borkmann)
Other features and fixes:
- Add KASAN checks to memory accesses of JITed programs on x86-64
(Alexis Lothoré)
- Complete unification of helper, kfunc and subprog argument checks
in the verifier (Amery Hung)
- Add bpf_copy_from_user_mm[_str]() kfuncs (Anastasios Papagiannis)
- Various features and fixes (Daniel Borkmann):
- Add .bpf keyring for program signature verification, modelled
after dm-verity keyring, and support ML-DSA in signing tools
- Emit shorter and faster code in x86-64 JIT for patterns that
LLVM generates
- Fix various issues in gotox handling
- Let BPF LSM set xattrs at inode creation with bpf_inode_init_xattr()
(David Windsor, Daniel Borkmann)
- Use sleepable page allocation in sleepable arena paths. Fix races
between arena free, allocation and user page fault (Emil Tsalapatis)
- Switch BPF crypto from lskcipher to AES-CBC and AES-ECB libraries
(Eric Biggers)
- Add bpf_proactive_reclaim() kfunc (Hui Zhu)
- Render decl_tags in libbpf btf_dump and add tests for bpftool C
dump (Ihor Solodrai)
- Speed up tracing_multi attach on x86 (Jiri Olsa)
- Various features and fixes (Kumar Kartikeya Dwivedi):
- Add BPF_PROG_STREAM_OPEN command to read BPF streams through a
file descriptor with poll support
- Let kernel structs publish arena pointers with __arena type tag
- Fix __uninit kfunc output buffers and fastcall rewrite with
indirect stack accesses
- Refuse CO-RE relocations for signed programs
- Add enqueue_rcvq and dequeue_rcvq hooks to bpf_tcp_ops to adjust
sk_rcvlowat and avoid unnecessary wakeups (Kuniyuki Iwashima)
- Add bpf_ksock_sendto() kfunc and allow ksock connect and send from
bpf_wq (Mahe Tardy)
- Fix racy plt target update in arm64 bpf_arch_text_poke()
(Matthew Wood)
- Restructure BPF selftests Makefile as a layered build
(Mykola Lysenko)
- Speed up hash map lookups for u32 and u64 keys (Mykyta Yatsenko)
- Add signed div/mod, movsx, bswap and gotol to MIPS JITs, signed
div/mod to parisc JITs (Nicholas Dudar, Johan Almbladh)
- Fix stack overflow in build ID parser on 32-bit (Nickolai
Zeldovich)
- Add stack arguments, signed arena loads and gotox to riscv64 JIT.
Pu Lehui is now co-maintainer of riscv BPF JITs (Pu Lehui, Chen
Pei, Feng Jiang)
- Add bpf_call_rcu() and bpf_call_rcu_tasks_trace() kfuncs. Support
fetching and/or/xor atomics in arena on x86-64 (Puranjay Mohan)
- Fix flaky selftests, selftests with clang 23 and bpf-gcc
(Qiliang Yuan, KaFai Wan, Vineet Gupta)
- Fix builds broken by fatal resolve_btfids warnings, BTF generation
on ARC, and define arch_cmpxchg_local() on arc, hexagon and
openrisc (Sasha Levin)
- Reduce memory use of hash maps by up to 50% per element
(T.J. Mercier)
- Mark pointer fields of sched_ext ops arguments as trusted (Tejun
Heo)
- Remove legacy bpf_asm, bpf_dbg and bpf_jit_disasm tools (Xia Yan)
- Fix index overflow in queue and stack maps, arena range tree after
allocation failure, tail call loop after freplace detach, lost
signal in bpf_send_signal() (Yuan Chen)
- Many more fixes and cleanups"
* tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (660 commits)
selftests/bpf: Time tc_edt from its first packet with data
selftests/bpf: Test unwind_exit of an exception callback
selftests/bpf: Tests for 32-bit scalar evolution bounds computation
bpf: Reject unwind_goto and unwind_exit in offloaded progs
bpf: Support 32-bit linear scalar evolution
bpf: Make unwind_exit of an exception callback exit in JITs
selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach
selftests/bpf: Test ksock sendto()
bpf: Add bpf_ksock_sendto() kfunc
selftests/bpf: Test unwinding from R0: R2 subprog
selftests/bpf: Add a C++ prog with exceptions
selftests/bpf: Add tests for unwind_goto and unwind_exit
bpf, arm64: Support unwind_goto and unwind_exit
bpf, x86: Support unwind_goto and unwind_exit
bpf: Add unwind_goto and unwind_exit insns
tools/bpf: Remove legacy BPF tools
bpf: Annotate data races on bpf_lru_node type
selftests/bpf: Add arena allocation race tests
bpf: Fix arena race between page free and alloc leading to incoherency
bpf: Revalidate faulted arena pages before installing user mappings
...
|
||
|
Linus Torvalds
|
c0e8d30137 |
Merge tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
Pull module updates from Petr Pavlu: - Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. * tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: drivers: Replace __MODULE_STRING() with __stringify() module: Fix uninitialized count read of unloaded taint tracking record rust: module_param: Fix potentially incorrect access of `SetOnce<T>` module: Remove the error-injection.h include from linux/module.h drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION() drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION() syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION() net: Include error-injection.h for ALLOW_ERROR_INJECTION() block: Include error-injection.h for ALLOW_ERROR_INJECTION() module: Bring includes in linux/kmod.h up to date time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... umh, treewide: Explicitly include linux/umh.h where needed modules/kmod: Allocate argv with kmalloc_array() module/kallsyms: Ignore local labels and mapping symbols during module load module/kallsyms: Refactor current symbol filtering into is_core_symbol() module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol() |
||
|
Linus Torvalds
|
734bef548a |
Merge tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
Pull networking updates from Paolo Abeni:
"This includes a significant number of low-priority fixes - especially
in the NIC drivers area - that we deferred from the last few RCs in
the previous cycle, which can't be easily outlined in the synopsis
below.
Core & protocols:
- Continue the work on removing rtnl_lock dependencies:
- per-netns ARP and ND neighbour tables, with the default settings
now configurable per netns (inheritance from init_net is
controlled by the new net.core.neigh_inherit_init_net sysctl)
- RCU-protected configuration and rtnl_lock-less fill_info() for
hsr, netkit, sit, vlan and vxlan devices
- per-netns device unregistration for ip tunnel and gre devices
- use the netdev instance lock instead of rtnl_lock when reading
speed and duplex via sysfs
- batch the flushing of uncached routes at device unregistration
time, relieving rtnl_lock contention on netns dismantle.
- Add hardware pacing offload support, admin-controlled via a new
rtnetlink attribute, with sch_fq integration (implemented in idpf).
- Re-segment BIG TCP GSO packets into GSO packets fitting the egress
device limits instead of plain MSS-sized segments, improving
throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.
- Generate RSS keys that spread flows over all the RX queues; the
previous random keys could leave some queues unused.
- Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
fdb entries and consider only VLAN members when flooding, for ~10%
more Mpps in the fdb forwarding path.
- A few TCP/IP performance improvements aimed at efficient cache
usage and reducing contention.
- Add the TCP ROCCET congestion control, a CUBIC variant aimed at
avoiding bufferbloat in cellular networks.
- Continue the conversion of getsockopt callbacks to sockopt_t.
- Add an ethtool command to list the front-facing ports of an
interface, including SFP cages and modules, using the phy_port
representation.
- Enable BIG TCP support for bareudp tunnels.
- Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
transitions (listen() + shutdown() + connect() and connect() +
connect(AF_UNSPEC) + listen()).
- Remove most BUG_ON()s from core packet processing, replacing them
with error paths.
Wireless:
- Latency improvements, including lockless station get/dump and
beacon updates, plus RTNL reduction and locking cleanups.
- Infrastructure for non-station TX/RX with MLO.
- NAN (Wi-Fi Aware) Instant Communication support and other NAN
improvements.
- Control frame Integrity Protocol (CIP) and protected TWT support.
- Improvements for AP regulatory checks.
Netfilter:
- Disable br_netfilter in user namespaces and schedule it for removal
in 2027.
- Restrict the raw table in nft_compat to the specific family, hook
and priority.
- Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
versa).
- Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
integration with memcg.
- Allow discovering conntrack zone filtering support in ctnetlink
dumps, and fix nfnetlink_hook handling of large dumps.
Deletions:
- Move the LLC type 2 sockets out of tree. There are no known users
and the code attracts a never-ending stream of LLM-driven fixes.
Device drivers:
- New drivers:
- Meta Platforms NIC (mpnic), the second-generation NIC from Meta
- initial skeleton of the Nebula-matrix NICs driver (nbl)
- X-Powers AC200/AC300 Fast Ethernet PHYs
- Ethernet high-speed NICs:
- Intel:
- i40e: XDP metadata support for RX hash and VLAN tag
- ice: expose the E825 TSPLL state via the DPLL subsystem
- nVidia/Mellanox:
- move the data direct infrastructure from IB to core, in
preparation for netdev support.
- reduce the memory used per offloaded TC rule
- Meta (fbnic):
- support large io_uring zero-copy RX buffers
- Microsoft vNIC (mana):
- add BQL support
- Ethernet NICs consumer, and embedded:
- Airoha:
- LRO offload support
- Cadence (macb):
- context swapping for ringparam and MTU changes, avoiding
buffer loss under memory pressure
- Mucse (rnpgbe):
- TX/RX and link status support
- NXP (enetc):
- SR-IOV improvements and VF support for ENETC v4
- Qualcomm (ppe):
- IPQ5424 support
- Realtek PCI (r8169):
- phylink support
- RSS support for RTL8127
- Renesas (ravb):
- gPTP support for R-Car Gen4
- Synopsys (stmmac):
- XDP multi-buffer support on the TX side
- tc mqprio hw queue priority offload
- support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
DP1000 and Qualcomm sa8255p
- Ethernet switches:
- Mediatek (mt7530):
- fast age and change conduit support
- Microchip (ksz):
- support for KSZ8995XA/KS8995XA
- Microchip (lan966x):
- PCIe FDMA support, ~20x throughput increase in PCIe endpoint
- Microchip (sparx5):
- Time Aware Shaper (taprio) offload
- Motorcomm (yt921x):
- LED and SerDes PCS support
- Realtek (rtl8365mb):
- EEE support
- Ethernet PHYs:
- Broadcom:
- enable jumbo frames on BCM54xx
- Realtek:
- support for RTL8261CE_CG and RTL8261D_VM
- MDIO support for RTL838x and RTL839x
- WiFi drivers:
- Broadcom (brcmfmac):
- FT/OKC roaming offload
- Intel (iwlwifi):
- UHR sniffer support
- support for newer UEFI/BIOS tables
- MediaTek (mt76):
- mt7925 NAN improvements
- offchannel/scan improvements and MLO fixes
- Morse Micro (mm81x):
- monitor mode support
- Qualcomm (ath12k):
- IPQ5332 platform infrastructure
- Realtek (rtw88):
- RTL8723BS support
- SDIO TX performance improvements
- Realtek (rtw89):
- P2P_DEVICE support
- BT-coex updates for RTL8922D
- Bluetooth:
- move H:4 reassembly into the Bluetooth core
- add generic support for vendor packets
- MGMT: add security level changed event
- Bluetooth drivers:
- btusb: support Bulk Serialization Mode
- Intel: support Draco and Titan Lake, allow unsigned firmware
- Mediatek: MT7928 support
- Qualcomm: QCC2072 support
- Broadcom: Synaptics 4384 support"
* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
Bluetooth: btusb: disable by default Qualcomm multi-subsystem
tipc: fix broadcast sender hang on last acker departure
tipc: fix use-after-free of broadcast reception link at node release
r8169: clear TX LPI on RTL8168h at link up after phylink conversion
tun: Require CAP_NET_ADMIN to attach to an ownerless device
net/sched/sch_cake: drop dead nla_nest_end() error check
net/sched/sch_cake: widen buffer_used to u64
net/sched/sch_cake: reduce parent backlog when clearing a tin
net/sched/sch_cake: serialize reconfiguration with the datapath
tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
net/mlx5e: Stop asserting for RTNL when closing channels
net: shrink the payload-only part of skb dataref to one bit
net: wwan: iosm: validate msg_head before indexing msg_ring
net: bgmac: rate limit RX error messages
selftests: net: veth: test XDP_TX to a peer with GRO enabled
veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
pppoe: delete session hash entries by pointer match
net: lan969x: don't disable hardirqs in fdma tx clear
net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
net: lan969x: fix DSM calendar for empty taxis
...
|
||
|
Paolo Abeni
|
207dd12bc1 |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Merge in late fixes in preparation for the net-next PR. Conflicts: net/netfilter/nf_conntrack_netlink.c |
||
|
Mina Almasry
|
2620efb2ce |
netmem: rename get/put_netmem() to netmem_inc/dec_ref()
Follow the object_action() naming convention for netmem non-page_pool reference helpers by renaming get_netmem() and put_netmem() to netmem_inc_ref() and netmem_dec_ref(). Use netmem_inc_ref() and netmem_dec_ref() rather than netmem_ref() and netmem_unref() because netmem_ref is already a typedef (typedef unsigned long __bitwise netmem_ref). Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261021015558.4124825-3-almasrymina@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Mina Almasry
|
bbee999025 |
netmem: rename get/put_net_iov() to net_iov_inc/dec_ref()
Follow the object_action() naming convention for net_iov non-page_pool reference helpers by renaming get_net_iov() and put_net_iov() to net_iov_inc_ref() and net_iov_dec_ref(), and renaming net_devmem_get_net_iov() and net_devmem_put_net_iov() to net_devmem_net_iov_inc_ref() and net_devmem_net_iov_dec_ref(). Use *_inc_ref() and *_dec_ref() rather than *_ref() and *_unref() to pair symmetrically with netmem_inc_ref() and netmem_dec_ref() (since netmem_ref is already the typedef for the generic network memory handle). Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261021015558.4124825-2-almasrymina@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Maxime Chevallier
|
9fd93893b6 |
net: phy: phy_link_topology: Track ports in phy_link_topology
phy_port is aimed at representing the various physical interfaces of a net_device. They can be controlled by various components in the link, such as the Ethernet PHY, the Ethernet MAC, and SFP module, etc. Let's therefore make so we keep track of all the ports connected to a netdev in phy_link_topology. The only ports added for now are phy-driven ports. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Aleksei Sviridkin <f@lex.la> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Tested-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20261016133107.54054-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Linus Torvalds
|
aaf3d47e53 |
Merge tag 'timers-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer core updates from Thomas Gleixner:
"Updates for the core timekeeping and timers subsystem:
- Futher cleanups for the POSIX timer exit/exec related code to
simplify the code flow and to make it more robust against future
changes.
- Prevent tearing of timekeeper::ktime_sec which can be accessed
without the sequence count protection.
The timekeeper is updated by memcpy() with an uneven sequence count
to force readers into the retry path. On 64-bit machine the
ktime_sec member can be accessed atomically without the sequence
count protection. That is only correct when the update side
memcpy() guarantees atomicity at the 64-bit granularity. That's not
guaranteed due to debug options, compilers and instruction
availability. If the memcpy() does not provide the atomicity then
the unprotected readers can observe store tearing.
To prevent this write the ktime_sec member before the memcpy() so
that a non-atomic memcpy() will write the same data. A similar fix
has been done for the xtime_sec member, but the ktime_sec
equivalent was missed.
- Prevent time64_to_tm() day truncation on 32-bit kernels
The function receives a 64-bit seconds value but stores the
quotient of the computation in a long, which truncates the result
for large input values. Cure this by using div_s64_rem() which
stores the quotient in s64 and only leaves the seconds-within-day
reminder in a long, which is guaranteed to fit. This fix comes with
a corresponding kunit test to prevent further mishaps.
- Mark data-racy accesses to the hrtimer_sleeper::task member.
The recent updates to KCSAN flagged these benign races. Annotate
them with new helper functions, convert all existing usage sites
and mark the task member private after that so that future users
which fail to use the helpers can be detected automatically.
- Address similar benign KCSAN flagged issues in the hrtimer, timer
and timer migration code.
- Fixes for a few selftest issues"
* tag 'timers-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits)
selftests/timers: clocksource-switch: Fix unchecked open()/read()
selftests: timers: Measure the CPU timers on the clock they count
selftests: timers: Count what tick is worth in the drift estimate
time/kunit: Add time64_to_tm() case beyond 32-bit day count
time: Prevent time64_to_tm() day truncation on 32-bit
timekeeping: Use READ_ONCE/WRITE_ONCE() for ktime_sec to prevent tearing
timers/migration: Mark racy updates to tmigr_event::ignore field
timers: Mark racy updates to hlist_node::pprev field
hrtimer: Apply READ_ONCE() to lockless base->running loads
hrtimer: Mark the hrtimer_sleeper structure's ->task field __private
hrtimer: Update hrtimer_resolution only if value changes
futex: Use accessor for hrtimer_sleeper ->task field in requeue
rtmutex: Use accessor for hrtimer_sleeper ->task field
net: pktgen: Use accessor for hrtimer_sleeper ->task field
timers: Use accessor for hrtimer_sleeper ->task field in sleep_timeout.c
futex: Use accessor for hrtimer_sleeper ->task field in waitwake.c
io-uring/rw: Use accessor for hrtimer_sleeper ->task field
wait: Use accessor for hrtimer_sleeper ->task field
aio: Use accessor for hrtimer_sleeper ->task field
hrtimer: Mark data-racy accesses to hrtimer_sleeper ->task field
...
|
||
|
Yuyang Huang
|
ebff14be20 |
net: add AF_PACKET multicast dumps
RTM_GETMULTICAST dumps IPv4 and IPv6 multicast group memberships, but
the device multicast list (dev->mc) is only available through
/proc/net/dev_mcast, so "ip maddr show" still has to parse procfs for
its link-layer entries.
Handle RTM_GETMULTICAST dumps with ifa_family set to AF_PACKET next to
the dev->mc helpers in dev_addr_lists.c and report every entry of
dev->mc in the existing ifaddrmsg format:
- IFA_MULTICAST carries the raw link-layer address
- IFA_MC_USERS carries the entry reference count
- IFA_F_GLOBAL in IFA_FLAGS reports netdev_hw_addr::global_use, set
by dev_mc_add_global() (SIOCADDMULTI) and dev_mc_add_excl()
("bridge fdb add ... self"), i.e. entries added explicitly rather
than by a protocol join. This is the static column of
/proc/net/dev_mcast
- ifa_scope is RT_SCOPE_LINK
This covers every column of /proc/net/dev_mcast. AF_PACKET is the
family iproute2 already uses for link-layer addresses ("ip -0").
The default FDB dump also walks dev->mc, but only for Ethernet devices
and only if the driver uses it, vxlan for example does not, and it has
no users count or global_use bit. Extending it would change "bridge fdb
show" output and add NDA_* attributes.
Requests are always validated, there are no legacy users: prefixlen,
flags and scope must be zero, ifa_index selects one device and
IFA_TARGET_NETNSID is the only attribute accepted. The dump runs under
RCU and netif_addr_lock_bh() without RTNL. cb->seq is set from the
dev->mc generation counter and dev_base_seq before each round and
checked after it, so an entry added or removed since the previous
round sets NLM_F_DUMP_INTR. A round without a message skips the check
and cb->seq is set once more after the round, so the NLMSG_DONE check
reports a change made during the last round or before an empty one.
Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://patch.msgid.link/20261012011707.3378-5-sigefriedhyy@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||
|
Yuyang Huang
|
646cb8868b |
net: add a generation counter for dev->mc changes
A multi-part RTM_GETMULTICAST dump of dev->mc resumes by position, so entries added or removed between two dump rounds can be skipped or repeated. The IPv4 and IPv6 dumps report that with NLM_F_DUMP_INTR by stamping cb->seq from a per netns generation counter combined with dev_base_seq, see inet_base_seq(). Add the equivalent for the device multicast lists: a per netns counter bumped whenever an entry is added to or removed from any dev->mc. The list helpers do not know which device a list belongs to, so give netdev_hw_addr_list an mc_dev pointer, set for dev->mc only, and bump the counter of dev_net(mc_dev) from the count helpers. That covers the dev_mc_* helpers, both lists of a sync, the hardware sync helpers drivers call from their rx mode callbacks or their own workers and the reconciliation after an asynchronous rx mode update. It is atomic since the writers only hold the address lock of their own device. Used by the following patch for the AF_PACKET multicast dump. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Link: https://patch.msgid.link/20261012011707.3378-4-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Yuyang Huang
|
778a262a6c |
net: change netdev_hw_addr_list count through helpers
The count of a netdev_hw_addr_list is changed in several places of dev_addr_lists.c and a few drivers read it directly. The next patch needs to account every change of the count of dev->mc. Add __hw_addr_count_add(), __hw_addr_count_inc(), __hw_addr_count_dec() and __hw_addr_count_reset(), use them for every change of the count and rename the field to _count so that a direct write stands out. Readers keep using netdev_hw_addr_list_count() and the netdev_uc_count() and netdev_mc_count() helpers, the few that read the field directly are converted. No functional change. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Link: https://patch.msgid.link/20261012011707.3378-3-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Carolina Jubran
|
78d4bd22ec |
net: skbuff: don't copy alloc_cpu in skb header copies
Commit |
||
|
Mahe Tardy
|
74be619845 |
bpf: Add bpf_ksock_sendto() kfunc
The motivation is to plumb more of the socket API into ksock, thus supporting sendto() in addition to send() which makes a lot of sense in the context of UDP sockets which are the only type currently supported. This is useful when ksock is used to reply to specific addresses or send to multiple addresses. Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261020155848.75711-2-mahe.tardy@gmail.com |
||
|
Daniel Borkmann
|
e64bff85e3 |
net: Port skb_segment tests of the test_bpf module to KUnit
The old test_bpf module is going away, therefore port the two test cases which were added in |
||
|
Erfan Sharafzadeh
|
69ab87acc6 |
net: devmem: allow peer-to-peer dma-buf attach for bindings
net_devmem_bind_dmabuf() uses dma_buf_attach(), a static attachment with peer2peer false. Exporters must then keep the buffer reachable without P2P; amdgpu does so by placing it in GTT (system memory), so a device memory binding silently ends up in host memory. Use dma_buf_dynamic_attach() with allow_peer2peer set, so an exporter that can do P2P to the device keeps the buffer in device memory. Dynamic attachments are not pinned on map, and devmem cannot handle the buffer moving, so: - pin it with dma_buf_pin() before mapping, which keeps it in place for the lifetime of the binding, as before; - wait for the exporter's kernel fences after mapping, interruptibly, as the core does for static attachments. This follows the pinned RDMA umem path, including its limits: the binding cannot be revoked by the exporter, and once a P2P binding has pinned a buffer in device memory, a later attachment to the same buffer that cannot do P2P may fail to pin it. Exporters that cannot do P2P to the device place the buffer as before. RX and TX bindings both go through this function. Signed-off-by: Erfan Sharafzadeh <erfansh@meta.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20261013210954.2170175-1-erfansh@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Kuniyuki Iwashima
|
ccd0742641 |
neighbour: Floor neigh_periodic_work() interval at 1s.
neigh_periodic_work() reschedules tbl->gc_work with a delay of BASE_REACHABLE_TIME >> 1. neigh_table is now per-netns, and a user could hog CPU by setting BASE_REACHABLE_TIME to a small value. Unlike INTERVAL_PROBE_TIME_MS, BASE_REACHABLE_TIME is also used to compute reachable_time for NUD_REACHABLE entries. Let's floor only the GC interval at 1 second. Suggested-by: Ido Schimmel <idosch@nvidia.com> Link: https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261013205816.1642597-6-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Kuniyuki Iwashima
|
7a71343ba1 |
neighbour: Floor INTERVAL_PROBE_TIME_MS at 1000.
Previously, neigh_managed_work() was not rescheduled within 1s since commit |
||
|
Kuniyuki Iwashima
|
8854b0e247 |
neighbour: Schedule neigh_managed_work only when needed.
neigh_table is now per-netns. tbl->managed_work is scheduled when netns is created and runs periodically even though the netns does not have any NTF_MANAGED entries. Let's delay scheduling the work for the first NTF_MANAGED entry and stop rescheduling if tbl->managed_list is empty. Suggested-by: Ido Schimmel <idosch@nvidia.com> Link: https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261013205816.1642597-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Andrea Parri
|
ec636599b1 |
rtnetlink: comment the RCU waits in unregister paths
rtnl_unregister_all() and rtnl_af_unregister() wait for RCU readers
before tearing down what those readers use, but do not say which
readers they are waiting for.
A missing wait is then easy to overlook: rtnl_link_unregister() lacked
its synchronize_rcu() until commit
|
||
|
Xia Yan
|
b71326388a |
tools/bpf: Remove legacy BPF tools
Remove bpf_asm, bpf_dbg and bpf_jit_disasm, along with the assembler's lexer and parser, as suggested by Daniel. These tools are old classic BPF and these days there is no need to keep them in kernel anymore. Drop their build and install rules, feature checks and ignore entries. Remove the tool-specific documentation and update the PTP classifier and packet socket test comments. Keep the classic BPF instruction descriptions and assembly examples. Keep the bpftool and resolve_btfids build and clean targets, and the bpftool install target. Suggested-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/61f7315e-c835-425e-a99b-d2470ba9a875@iogearbox.net Link: https://lore.kernel.org/bpf/20261020095124.928021-1-yanxia@cmss.chinamobile.com |
||
|
Mina Almasry
|
2285346afc |
net: kunit: test netmem, page_pool, and skb frag refcounting
Verify that non-pp (page._refcount / binding->ref) and page_pool (pp_ref_count) references stay balanced without cross-counter leaks or underflows across regular pages, page_pool pages, non-pp net_iovs, and page_pool net_iovs with both pp_recycle=0 and pp_recycle=1. Cover get/put_net_iov(), get/put_netmem(), napi_pp_get/put_page(), skb_netmem_ref/unref(), skb_frag_ref/unref(), pskb_copy(), skb_zerocopy(), skb_shift(), skb_split(), skb_try_coalesce(), skb_release_data() (clones, unclone ordering, pskb_extract(), and skb_morph()), skb_segment(), and devmem tcp_recvmsg_dmabuf() / SO_DEVMEM_DONTNEED. Export skb_shift() via EXPORT_SYMBOL_IF_KUNIT() so the test links when built as a module (CONFIG_NET_TEST=m). Assisted-by: LLM Signed-off-by: Mina Almasry <almasrymina@google.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Link: https://patch.msgid.link/20261014173945.373295-7-almasrymina@google.com Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Mina Almasry
|
447f58db35 |
net: skbuff: use skb_frag_ref() in skb_try_coalesce()
skb_pp_frag_ref() was introduced solely to work around skb_frag_ref() ignoring skb->pp_recycle and incrementing the non-pp backing refcount. Now that skb_frag_ref() handles both pp_recycle=1 and pp_recycle=0 symmetrically, call skb_frag_ref() directly in skb_try_coalesce() and remove skb_pp_frag_ref(). Assisted-by: LLM Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261014173945.373295-6-almasrymina@google.com Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Mina Almasry
|
1f6f88105e |
net: skbuff: replace __skb_frag_ref() with symmetric skb_netmem_ref()
Previously, __skb_frag_ref() and skb_frag_ref() unconditionally
incremented the non-pp backing refcount via get_netmem(), while
skb_frag_unref() decremented pp_ref_count whenever skb->pp_recycle was
set. Ref-ing a page_pool fragment into a pp_recycle=1 SKB (or clearing
pp_recycle=0 on an uncloned SKB while clones still held pp_recycle=1)
leaked the backing non-pp refcount and underflowed pp_ref_count across
IP-TFS, skb_split(), skb_shift(), and cloned unclone paths.
Replace __skb_frag_ref() with skb_netmem_ref(netmem, recycle) as the
exact counterpart to skb_netmem_unref(netmem, recycle):
- Keep skb->pp_recycle intact in skb_release_data() so uncloning paths
(pskb_expand_head() and pskb_carve_inside_{header,nonlinear}()) keep
trading pp_ref_count references symmetrically across clones.
- Propagate pp_recycle and call skb_frag_ref() on the destination SKB in
__pskb_copy_fclone(), skb_zerocopy(), skb_split(), skb_shift(), and
skb_segment().
- Linearize an output segment's existing frags in skb_segment() before
attaching frags from a frag_list SKB with a different pp_recycle bit,
since each output segment carries a single pp_recycle bit.
- Use skb_frag_ref() in xfrm_iptfs, chcr_ktls, and cassini, and call
get_netmem() directly in veth and tls_device_fallback where callers
explicitly take a raw non-pp reference.
Found by code inspection while reviewing the IP-TFS pp_ref_count fix [1]
and confirmed with the KUnit tests added later in this series; not
observed in production. The xfrm_iptfs, chcr_ktls, cassini, veth, and
tls_device_fallback changes are compile-tested only.
Link: https://lore.kernel.org/netdev/xfrm-iptfs-pp_ref_count-underflow-v4-1-912fa72106f0@secunet.com/ [1]
Cc: Antony Antony <antony.antony@secunet.com>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Jesper Dangaard Brouer <hawk@kernel.org>
Cc: bpf@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Mina Almasry <almasrymina@google.com>
Tested-by: Antony Antony <antony.antony@secunet.com>
Link: https://patch.msgid.link/20261014173945.373295-5-almasrymina@google.com
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||
|
Mina Almasry
|
4d68808407 |
net: skbuff: replace skb_page_unref() and __skb_frag_unref() with skb_netmem_unref()
Unreferencing a page_pool fragment with recycle=false decrements the non-pp backing refcount instead of pp_ref_count, underflowing the page refcount when the fragment was owned via page_pool (as on mlx4's RX error path). Having both skb_page_unref() and __skb_frag_unref(frag, recycle) made it easy for callers to pass hardcoded recycle=false on SKB-owned fragments. Replace skb_page_unref() and __skb_frag_unref() with skb_netmem_unref(netmem, recycle), which dispatches to napi_pp_put_page() when recycle is true and put_netmem() otherwise: - Use skb_frag_unref(skb, ...) on SKB-owned fragments in mlx4, sky2, tls_strp, and skb_shift() so unrefs always match skb->pp_recycle. - Use put_netmem() directly in tls_device's destroy_record(), which releases raw non-pp page references outside an SKB. Found by code inspection and confirmed with the KUnit tests added later in this series; not observed in production. The mlx4, sky2, and TLS call-site changes are compile-tested only. Assisted-by: LLM Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261014173945.373295-4-almasrymina@google.com Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Mina Almasry
|
729a47b803 |
net: skbuff: add napi_pp_get_page() and use it in tcp_recvmsg_dmabuf()
While napi_pp_put_page() releases a page_pool pp_ref_count reference on a netmem, no symmetric helper existed to acquire one, forcing callers like tcp_recvmsg_dmabuf() to open-code atomic_long_inc() on niov->desc.pp_ref_count. Add napi_pp_get_page() to pair symmetrically with napi_pp_put_page(), and use WARN_ON_ONCE(!napi_pp_get_page(netmem)) in tcp_recvmsg_dmabuf() to match WARN_ON_ONCE(!napi_pp_put_page(netmem)) in tcp_release_user_frags(). Assisted-by: LLM Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261014173945.373295-3-almasrymina@google.com Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Mina Almasry
|
a868720467 |
netmem: rename __get/__put_netmem() to get/put_net_iov()
netmems carry both a non-pp backing refcount and a page_pool pp_ref_count. Make the non-pp layer explicit and symmetric across both netmem types: get/put_netmem() dispatches to get/put_page() for pages and get/put_net_iov() for net_iovs, always acquiring or releasing a non-pp reference regardless of page_pool membership. Warn via DEBUG_NET_WARN_ON_ONCE() for net_iov types that do not support non-pp references. Assisted-by: LLM Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261014173945.373295-2-almasrymina@google.com Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Sorah Fukumori
|
679f6929a6 |
net: gro: don't chain linear parts larger than gso_size into frag_list
skb_gro_receive() chains an skb into the frag_list of the held packet when its payload cannot be attached as page frags: when its head is not a page fragment and still holds payload, or when its head and frags would overflow the frags[] array of the last packet. Since commit |
||
|
Linus Torvalds
|
a6656aefd3 |
Merge tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfd updates from Christian Brauner: "This adds thread specific pidfds to af_unix sockets. SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group leader. A coredump server on the coredump socket can't get a handle on the thread that took the signal and is writing the dump, and anything doing per-thread authentication has the same problem. The sending and the connecting thread are recorded in addition to the thread-group leader and sk_peer_pid becomes an array indexed by pid type. SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an SCM_PIDFD_THREAD cmsg for the sending thread. Both options are independent so a receiver can ask for both. On SOCK_STREAM sockets recvmsg() only stops merging data at a thread boundary when the receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd for the thread that called connect(), listen() or socketpair(). pidfs records the coredump on the dumping thread's struct pid too so its pidfd reports it like the leader's does. Selftests for af_unix and the coredump socket are included" * tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/coredump: check the dumping thread's pidfd pidfs: record the coredump on the dumping thread's pid too selftests/net: SO_PEERPIDFD_THREAD net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd af_unix: record the pid of the connecting thread net: turn sk_peer_pid into an array indexed by pid type selftests/net: SO_PASSPIDFD_THREAD net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD af_unix: record the pid of the sending thread pid: add helpers to operate on a struct pid array |
||
|
Linus Torvalds
|
a1d4585be1 |
Merge tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull file table updates from Christian Brauner: "This annotates struct fdtable's fd array with __counted_by_ptr so KASAN and the fortified functions can bounds check it against max_fds and adds a KUnit suite for fdtable. A follow-up uses __struct_size() in the test since sparse doesn't know __builtin_dynamic_object_size(). FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on infrastructure that was never needed. The ACQUIRE machinery and CLASS_INIT() go away, the variable is declared with __cleanup() directly, struct fd_prepare loses its err field since the fd either holds the descriptor or the error, and callers get a const pointer to the guard behind a UNIQUE_ID() name so they can't shadow it. Code generation is identical" * tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: file: make struct fd_prepare const and kill its err field cleanup: remove CLASS_INIT() file: declare the FD_PREPARE() variable with __cleanup() directly file: simplify FD_PREPARE() vfs: use __struct_size() in the fdtable KUnit test vfs: Add KUnit tests for fdtable vfs: Annotate struct fdtable's fd field with __counted_by_ptr |
||
|
Sasha Levin
|
a81bd9262c |
bpf: Fix ksock build with BPF_LSM=y and SECURITY_NETWORK=n
bpf_ksock.c references bpf_lsm_socket_sendmsg() whenever CONFIG_BPF_LSM=y, but the socket LSM hooks, and with them the BPF LSM socket_sendmsg hook, only exist with CONFIG_SECURITY_NETWORK=y. Without it resolve_btfids warns: WARN: resolve_btfids: unresolved symbol bpf_lsm_socket_sendmsg and since commit |
||
|
Alexei Starovoitov
|
ab08863c58 |
bpf: Use memmove() to store bytes in an xdp_buff
bpf_dynptr_write() to the dynptr of an xdp_buff ends in
bpf_xdp_store_bytes(). The source can be a slice of the same xdp_buff which
overlaps the destination, and the helper itself takes such a slice as well.
memcpy() then reads bytes which it has overwritten already. On x86 with
FSRM
p = bpf_dynptr_slice_rdwr(&ptr, 0, NULL, 64);
bpf_dynptr_write(&ptr, 8, p, 64, 0);
repeats the first 8 bytes of the packet instead of moving 64.
A write that crosses from the linear part into a fragment is copied piece
by piece, where the first piece can overwrite what the second one has yet
to read. That is not dealt with here.
Fixes:
|
||
|
Josef Bacik
|
1db084f428 |
bpf: Use memmove() to store bytes in an skb
Through bpf_dynptr_write() and bpf_dynptr_copy() the source of
bpf_skb_store_bytes() can be a slice of the same skb which overlaps the
destination. memcpy() then reads bytes which it has overwritten already. On
x86 with FSRM it repeats the first bytes of the source instead of copying
it. Local, ringbuf and skb metadata dynptrs are written with memmove() for
that reason.
Fixes:
|
||
|
Josef Bacik
|
1c19f2b3b2 |
bpf: Follow the head if an skb is written from a slice
The source of bpf_dynptr_write() may be a slice of the skb which is written to, that is a pointer into its head. bpf_dynptr_copy() does it by itself for a copy inside of one skb, if the source is linear and the destination is not. __bpf_skb_store_bytes() and __bpf_skb_meta_store_bytes() make the skb writable first. If that reallocates the head, the source points to the old one, and freed memory is copied into the packet. The offsets in the head do not change when it is reallocated here. Move the source along with the head. Fixes: |
||
|
Josef Bacik
|
8d0358f6e8 |
bpf: Keep iterator programs off special map fields
The bpf_map_elem iterator, for all but the per-cpu maps, and the bpf_sk_storage_map iterator hand the live value of an element to the program as a writable buffer. The verifier does not know the map when it checks the program, so nothing keeps the program from writing over a bpf_spin_lock, a bpf_timer, a kptr or another special field, which neither a map update nor a pointer to a map value can touch. With CAP_BPF and CAP_PERFMON, or a BPF token, a program can so make the kernel follow a pointer of its choice: after a write over a bpf_timer the kernel crashes on the written value when the element is removed. Offsets into a buffer are constants. Let the verifier record the range of bytes that a program may write through a read-write buffer, and refuse the program with -EACCES, at attach and at a link update, if a special field of the map lies in that range. A program that only reads, or that writes beside the special fields, works as before. One that writes on both sides of a special field is refused, since the range covers the field. Fixes: |
||
|
Josef Bacik
|
45e912fb1d |
bpf: Check the new program of an iterator link update
The bpf_map_elem, bpf_sk_storage_map and sockmap iterators hand the key and the value of an element to the program as buffers. The verifier only records how far a program reaches into them, and ->attach_target() compares that with the key and value size of the map. bpf_iter_link_replace() does not. BPF_LINK_UPDATE installs a program that an attach refuses with -EACCES, and the program then reads, and for a value writes, behind every element that the iterator visits. It takes CAP_BPF and CAP_PERFMON, or a BPF token. Split the test out of the three ->attach_target() and ask it, as ->check_prog(), for the new program of an update as well. Targets without such a test take every program of their kind, as before. Fixes: |
||
|
Josef Bacik
|
070a96b2a9 |
bpf: Hold the socket in the sk_storage map iterator
The iterator over a sk_storage map passes the owner of an element to its
program as ctx->sk, without a reference. All that it holds is the RCU read
lock, which keeps the element and the storage, not the socket.
An element is unlinked by bpf_sk_storage_free(), which __sk_destruct()
calls right before it frees the socket. That is no better for a socket
with SOCK_RCU_FREE: the grace period comes in front of __sk_destruct(),
so a reader which starts behind call_rcu() still finds the element. The
program and the helpers it hands ctx->sk to, such as
bpf_sk_storage_get() or bpf_sk_storage_delete(), use a socket which is
being freed on another CPU. It takes nothing but reading the iterator
while sockets with an element in the map are closed, by whomever.
Take a reference for the time of the program, and skip the element if
there is none to be had. To look at the owner at all, do what
bpf_selem_unlink_nofail() does for bpf_local_storage_map_free(): as long
as the element is linked under the lock of the storage,
bpf_local_storage_destroy() has not got past it, unless it has given up
on the lock, and then it waits for owner_refcnt.
The last reference may now be dropped by the iterator. The end of a socket
may want process context: rfcomm_sock_destruct() takes a mutex. So only
drop the reference under RCU, and free a socket whose last one it was when
the RCU read lock has been released, which is at the end of a bucket and
of every read() at the latest.
Fixes:
|
||
|
Josef Bacik
|
6186c9711a |
bpf: Fix NULL deref in the sk_storage map iterator
bpf_sk_storage_map_seq_find_next() hands out an element only if its
local_storage pointer is set. __bpf_sk_storage_map_seq_show() then reads
the pointer a second time and dereferences it without a test.
Since bpf_local_storage_destroy() unlinks the elements with
bpf_selem_unlink_nofail(), the pointer is reset to NULL when the socket
which owns the element is destroyed, so it can change between the two
reads. Reading the iterator while sockets with an element in the map are
closed ends in a NULL pointer dereference. The sockets need not belong to
the reader: where a program gives every new socket an element, an
unprivileged user who opens and closes sockets is enough.
Skip such an element, as the TCP and UDP iterators skip a socket which
has been unhashed.
Fixes:
|
||
|
Alexei Starovoitov
|
22f100bd01 |
bpf: Clear sk_refcnt of a clone before its storage is linked
sk_clone() sets sk_refcnt of the new socket some lines behind
bpf_sk_storage_clone(). But the elements which that function copies are
linked to their maps at once, and an element leads to its owner: the
iterator over a sk_storage map hands the owner to its program.
bpf_sk_storage_get() with BPF_SK_STORAGE_GET_F_CREATE and
bpf_sk_storage_delete() rely on refcount_inc_not_zero() to tell whether
they may touch the socket.
sk_refcnt is in the part of struct sock which sock_copy() leaves out, and
sk_prot_alloc() does not clear a clone unless init_on_alloc is on. It is
zero in an object which has been a socket before, and anything in one
which has not. If it is not zero, a helper gets a reference which
refcount_set() wipes out, and the helper's sock_put() then drops one of
the two references of the new socket, which is freed too early:
IPv4: Attempt to release TCP socket in state 1
BUG: KASAN: slab-use-after-free in __raw_spin_lock_init+0x47/0x90
In the meantime the helper changes a storage which bpf_sk_storage_clone()
fills without taking its lock.
Nothing else can find the clone at this point. Say that it is not alive
yet, before the first element is linked. Sockets whose parent has no
storage are left alone.
Fixes:
|
||
|
Josef Bacik
|
427e751a23 |
bpf: Update the SRH state if End.B6 fails late
For SEG6_LOCAL_ACTION_END_B6 and END_B6_ENCAP bpf_lwt_seg6_action() looks
for the SRH again only if bpf_push_seg6_encap() has succeeded. That
function pushes the new header, for which the head of the skb is
reallocated if it has not got the room, and then looks up the route to the
first segment. If there is none, it returns an error, and the pointer to
the SRH in seg6_bpf_srh_states still points into the old head, which has
been freed.
The program goes on behind the error. bpf_lwt_seg6_store_bytes() and
bpf_lwt_seg6_adjust_srh() read the SRH through that pointer.
Look for the SRH whatever bpf_push_seg6_encap() says.
Fixes:
|
||
|
Josef Bacik
|
434324c611 |
bpf: Pull the inner header for End.DT6 in End.BPF
bpf_lwt_seg6_action(SEG6_LOCAL_ACTION_END_DT6) pulls the outer headers off
the packet and hands it to seg6_lookup_nexthop(), which reads the inner
IPv6 header at skb->data. Nothing says that this header is in the head of
the skb, or that there is one. If the head ends with the outer headers,
the route is looked up for whatever lies behind the head, and the packet
is dropped or leaves by the wrong route. If the program then pushes an SRH
with SEG6_LOCAL_ACTION_END_B6, seg6_do_srh_inline() pulls an IPv6 header
off a head which has none, and __skb_pull() hits its BUG(): the kernel
panics on a packet from the network.
GRO pulls the inner header of a plain IPv6 in IPv6 packet into the head. It
takes a packet which GRO does not look into that far, one with a fragment
header in front of the inner header for example, or a device without GRO,
and a driver which leaves the inner header in a fragment.
Make sure of the inner header together with the outer ones. The program
goes on behind an error of the helper, so do it before the packet is
changed. A pull which fails can still have moved the head, so look for the
SRH again.
Fixes:
|
||
|
Josef Bacik
|
e8b084646b |
bpf: Validate the SRH which End.DT6 uncovers in End.BPF
input_action_end_bpf() validates the SRH of a packet and pulls it into the
head before the program runs. If the program decapsulates the packet with
bpf_lwt_seg6_action(SEG6_LOCAL_ACTION_END_DT6), bpf_update_srh_state()
looks for a routing header in the inner packet and takes it for the new
SRH as it is.
Nobody has looked at that header, and whoever has sent the packet has
written it. ipv6_find_hdr() finds it in a fragment of the skb as well, but
hdrlen is then read at that offset from skb->data, past the end of the
head. The header need not be an SRH, and its hdrlen need not fit into the
packet, but it is marked as valid, and bpf_lwt_seg6_adjust_srh() and
bpf_lwt_seg6_store_bytes() check their offsets against it.
A program which then adds a TLV at the end of the SRH, where hdrlen has it,
makes bpf_lwt_seg6_adjust_srh() move and write memory behind the head of
the skb, as far as the sender likes within the 2 KB that hdrlen can say:
BUG: KASAN: slab-out-of-bounds in bpf_skb_net_hdr_push+0x185/0x240
Read of size 2088 at addr ffff888107d6f09e by task srh/102
BUG: KASAN: slab-out-of-bounds in bpf_skb_net_hdr_push+0x1b5/0x240
Write of size 8 at addr ffff888107d6f8be by task srh/102
Use seg6_get_srh(), which pulls and validates the header. Without a valid
SRH the state says that there is none, and the packet goes its way as
before. The pull can move the head, so compute the data pointers behind
it.
Fixes:
|
||
|
Josef Bacik
|
12d07c38e1 |
bpf: Don't let bpf_skb_adjust_room() use up the MSS
When bpf_skb_adjust_room() grows a TCP GSO packet without BPF_F_ADJ_ROOM_FIXED_GSO, gso_size is lowered by the number of bytes added. Nothing looks at how large it is. gso_size is the size of the segments the peer has sent if the packet comes out of GRO, and what the sender has written into the virtio header if it comes from a tun device or a packet socket. If it equals len_diff the result is 0, and a packet of up to 64 KB is no GSO packet any more. If it is smaller, the 16 bit value wraps around. One less than len_diff gives GSO_BY_FRAGS. skb_segment() then takes the length of each segment from the frag_list. A packet with more than 64 KB of payload gets that far, and one from a tun device has no frag_list: BUG: KASAN: null-ptr-deref in skb_segment+0xcf1/0x1a90 BUG: kernel NULL pointer dereference, address: 0000000000000070 tcp_gso_segment+0x1be/0x9f0 inet_gso_segment+0x288/0x740 inet_gso_segment+0x288/0x740 skb_mac_gso_segment+0x179/0x2e0 What is left must not be less than TCP_MIN_GSO_SIZE either. The stack relies on that for the number of segments to fit into gso_segs, see commit |
||
|
Jiayuan Chen
|
af873495cb |
bpf: Fix verifier WARN on narrow read of bpf_tcp_sock u64 fields
A BPF program can read the middle of a u64 field in struct bpf_tcp_sock:
tp = bpf_tcp_sock(listener);
/* +0x54 is in the middle of the u64 bytes_received */
unsigned hi = *(unsigned *)((char *)tp + 0x54);
bpf_tcp_sock_is_valid_access() allows this 4-byte read (the default case
only checks size == 4), but bpf_tcp_sock_convert_ctx_access() only knows
the field starts and has no idea how to handle such an offset. It emits
no instruction, cnt stays 0 and the fixup pass trips verifier_bug():
verifier bug: error during ctx access conversion (0)
Just disallow the narrower access by matching the whole u64 range of the
two fields, so it is turned down at check time:
invalid tcp_sock access off=84 size=4
Fixes:
|
||
|
Ido Schimmel
|
a25a51258a |
ipv4: Do not pass netns to fib_table_lookup()
Commit
|
||
|
Mahe Tardy
|
60bbe76a3f |
bpf: Allow ksock connect/send calls from wq
The initial ksock implementation, commit
|
||
|
Theodor Arsenij Larionov Trichkine
|
31b564f70d |
net: use the full socket in sk_mc_loop()
sk_mc_loop() is called from ip_mc_output() and ip6_finish_output2() with skb->sk, which is not always a full socket: - Since commit |
||
|
Josef Bacik
|
e6974aad4b |
net: skbuff: remove the BUG_ON()s from skb_shift()
skb_shift() has two BUG_ON()s. The first fires if the caller asks to shift more than @skb holds. Nothing has been touched yet, and returning 0 already means "shifted nothing", which the TCP callers handle by falling back. Return 0, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels. The second fires if the frags run out before @shiftlen does, but it only checks after the shift has been committed to both skbs, when there's nothing left to back out to. The loop that builds the new frag layout only writes @tgt's frag slots past its nr_frags, and the one branch that modifies @skb's frags also finishes the shift. So if the loop ends with bytes still left to shift, nothing visible has changed yet. That's the same state the MAX_SKB_FRAGS bail-out inside the loop returns 0 from. Move the check up to just before the commit and return 0 there the same way. Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-8-b9a5f732895b@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Josef Bacik
|
433380f5ab |
net: skbuff: don't BUG() on a missing head_frag in skb_zerocopy()
skb_zerocopy() BUG()s if @from has no head_frag and the caller passed hlen == 0, meaning the caller didn't ask for the head to be copied and the head can't be referenced as a page either. The check runs before anything is touched, and skb_zerocopy() already documents -EFAULT for bad skb geometry. Return that, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels. Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-7-b9a5f732895b@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Josef Bacik
|
417261779e |
net: skbuff: don't BUG() on leftover length in skb_copy_and_csum_bits()
skb_copy_and_csum_bits() has the same check as skb_checksum(): it BUG()s if it runs out of skb before it runs out of @len. This one gets hit: commit |
||
|
Josef Bacik
|
56453199d2 |
net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()
skb_copy_and_csum_dev() copies everything up to the checksum start out of the linear area, and BUG()s if the checksum start is past the end of the linear area. It misses the other direction: a CHECKSUM_PARTIAL skb that has been pulled past its csum_start gives a negative offset, which gets past the check and becomes a ~4GB copy. It also trusts csum_offset when it stores the folded checksum. So far skb_copy_and_csum_bits() BUG()ing on a short skb has covered for that, but once it returns instead, a bad csum_offset would write past the end of the caller's buffer. The function returns void and its callers are drivers copying a frame into a bounce buffer just before handing it to the hardware. There's nothing for them to back out of, so check both ends of csum_start and that the checksum field fits in the frame, and if not, copy the whole frame with skb_copy_bits() without filling in the checksum, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels. The frame goes out with a bad checksum and is dropped by the receiver. If even that copy fails, zero the buffer so the driver doesn't send stale bytes. Signed-off-by: Josef Bacik <josef@toxicpanda.com> Cc: stable? The trailers only have Assisted-by: and Signed-off-by:. No Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-5-b9a5f732895b@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |