Changes in ipv4.c

66034f78 - tcp/dccp: Remove inet_connection_sock_af_ops.addr2sockaddr().

Tue, 18 Mar 2025 06:01:07 +0000

tcp/dccp: Remove inet_connection_sock_af_ops.addr2sockaddr().inet_connection_sock_af_ops.addr2sockaddr() hasn't been used at allin the git era. $ git grep addr2sockaddr $(git rev-list HEAD | tail -n 1)Let's remove it.Note that there was a 4 bytes hole after sockaddr_len and now it's6 bytes, so the binary layout is not changed.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250318060112.3729-1-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

a3a128f6 - inet: consolidate inet_csk_clone_lock()

Wed, 12 Feb 2025 13:13:28 +0000

inet: consolidate inet_csk_clone_lock()Current inet_sock_set_state trace from inet_csk_clone_lock() is missingmany details :... sock:inet_sock_set_state: family=AF_INET6 protocol=IPPROTO_TCP \ sport=4901 dport=0 \ saddr=127.0.0.6 daddr=0.0.0.0 \ saddrv6=:: daddrv6=:: \ oldstate=TCP_LISTEN newstate=TCP_SYN_RECVOnly the sport gives the listener port, no other parts of the n-tuple are correct.In this patch, I initialize relevant fields of the new socket beforecalling inet_sk_set_state(newsk, TCP_SYN_RECV).We now have a trace including all the source/destination bits.... sock:inet_sock_set_state: family=AF_INET6 protocol=IPPROTO_TCP \ sport=4901 dport=47648 \ saddr=127.0.0.6 daddr=127.0.0.6 \ saddrv6=2002:a05:6830:1f85:: daddrv6=2001:4860:f803:65::3 \ oldstate=TCP_LISTEN newstate=TCP_SYN_RECVSigned-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250212131328.1514243-3-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

02673d58 - dccp: Prepare dccp_v4_route_skb() to .flowi4_tos conversion.

Thu, 16 Jan 2025 13:10:16 +0000

dccp: Prepare dccp_v4_route_skb() to .flowi4_tos conversion.Use inet_sk_dscp() to get the socket DSCP value as dscp_t, instead ofip_sock_rt_tos() which returns a __u8. This will ease the conversionof fl4->flowi4_tos to dscp_t, which now just becomes a matter ofdropping the inet_dscp_to_dsfield() call.Signed-off-by: Guillaume Nault Reviewed-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/208dc5ca28bb5595d7a545de026bba18b1d63bda.1737032802.git.gnault@redhat.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

ff46e3b4 - Fix race for duplicate reqsk on identical SYN

Fri, 21 Jun 2024 01:39:29 +0000

Fix race for duplicate reqsk on identical SYNWhen bonding is configured in BOND_MODE_BROADCAST mode, if two identicalSYN packets are received at the same time and processed on different CPUs,it can potentially create the same sk (sock) but two different reqsk(request_sock) in tcp_conn_request().These two different reqsk will respond with two SYNACK packets, and sincethe generation of the seq (ISN) incorporates a timestamp, the final twoSYNACK packets will have different seq values.The consequence is that when the Client receives and replies with an ACKto the earlier SYNACK packet, we will reset(RST) it.========================================================================This behavior is consistently reproducible in my local setup,which comprises: | NETA1 ------ NETB1 |PC_A --- bond --- | | --- bond --- PC_B | NETA2 ------ NETB2 |- PC_A is the Server and has two network cards, NETA1 and NETA2. I have bonded these two cards using BOND_MODE_BROADCAST mode and configured them to be handled by different CPU.- PC_B is the Client, also equipped with two network cards, NETB1 and NETB2, which are also bonded and configured in BOND_MODE_BROADCAST mode.If the client attempts a TCP connection to the server, it might encountera failure. Capturing packets from the server side reveals:10.10.10.10.45182 > localhost: Flags [S], seq 320236027,10.10.10.10.45182 > localhost: Flags [S], seq 320236027,localhost > 10.10.10.10.45182: Flags [S.], seq 2967855116,localhost > 10.10.10.10.45182: Flags [S.], seq 2967855123, <==10.10.10.10.45182 > localhost: Flags [.], ack 4294967290,10.10.10.10.45182 > localhost: Flags [.], ack 4294967290,localhost > 10.10.10.10.45182: Flags [R], seq 2967855117, <==localhost > 10.10.10.10.45182: Flags [R], seq 2967855117,Two SYNACKs with different seq numbers are sent by localhost,resulting in an anomaly.========================================================================The attempted solution is as follows:Add a return value to inet_csk_reqsk_queue_hash_add() to confirm if theehash insertion is successful (Up to now, the reason for unsuccessfulinsertion is that a reqsk for the same connection has already beeninserted). If the insertion fails, release the reqsk.Due to the refcnt, Kuniyuki suggests also adding a return value checkfor the DCCP module; if ehash insertion fails, indicating a successfulinsertion of the same connection, simply release the reqsk as well.Simultaneously, In the reqsk_queue_hash_req(), the start of thereq->rsk_timer is adjusted to be after successful insertion.Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")Signed-off-by: luoxuanqiang Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20240621013929.1386815-1-luoxuanqiang@kylinos.cnSigned-off-by: Paolo Abeni List of files: /linux-6.15/net/dccp/ipv4.c

6be49dea - rstreason: prepare for passive reset

Thu, 25 Apr 2024 03:13:35 +0000

rstreason: prepare for passive resetAdjust the parameter and support passing reason of reset whichis for now NOT_SPECIFIED. No functional changes.Signed-off-by: Jason Xing Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni List of files: /linux-6.15/net/dccp/ipv4.c

1eeb5043 - tcp/dccp: do not care about families in inet_twsk_purge()

Fri, 29 Mar 2024 15:32:03 +0000

tcp/dccp: do not care about families in inet_twsk_purge()We lost ability to unload ipv6 module a long time ago.Instead of calling expensive inet_twsk_purge() twice,we can handle all families in one round.Also remove an extra line added in my prior patch,per Kuniyuki Iwashima feedback.Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/netdev/20240327192934.6843-1-kuniyu@amazon.com/Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20240329153203.345203-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

fa2df45a - dccp: Call security_inet_conn_request() after setting IPv4 addresses.

Mon, 30 Oct 2023 20:10:41 +0000

dccp: Call security_inet_conn_request() after setting IPv4 addresses.Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of childsockets") introduced security_inet_conn_request() in some functionswhere reqsk is allocated. The hook is added just after the allocation,so reqsk's IPv4 remote address was not initialised then.However, SELinux/Smack started to read it in netlbl_req_setattr()after the cited commits.This bug was partially fixed by commit 284904aa7946 ("lsm: Relocatethe IPv4 security_inet_conn_request() hooks").This patch fixes the last bug in DCCPv4.Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")Fixes: 07feee8f812f ("netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections")Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Signed-off-by: Paolo Abeni List of files: /linux-6.15/net/dccp/ipv4.c

e08d0b3d - inet: implement lockless IP_TOS

Fri, 22 Sep 2023 03:42:16 +0000

inet: implement lockless IP_TOSSome reads of inet->tos are racy.Add needed READ_ONCE() annotations and convert IP_TOS option lockless.v2: missing changes in include/net/route.h (David Ahern)Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

6af28974 - dccp: fix dccp_v4_err()/dccp_v6_err() again

Fri, 15 Sep 2023 19:00:35 +0000

dccp: fix dccp_v4_err()/dccp_v6_err() againdh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr",not in the "byte 7" as Jann claimed.We need to make sure the ICMP messages are big enough,using more standard ways (no more assumptions).syzbot reported:BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline]BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline]BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94pskb_may_pull_reason include/linux/skbuff.h:2667 [inline]pskb_may_pull include/linux/skbuff.h:2681 [inline]dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867icmpv6_rcv+0x19d5/0x30d0ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438ip6_input_finish net/ipv6/ip6_input.c:483 [inline]NF_HOOK include/linux/netfilter.h:304 [inline]ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586dst_input include/net/dst.h:468 [inline]ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79NF_HOOK include/linux/netfilter.h:304 [inline]ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310__netif_receive_skb_one_core net/core/dev.c:5523 [inline]__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637netif_receive_skb_internal net/core/dev.c:5723 [inline]netif_receive_skb+0x58/0x660 net/core/dev.c:5782tun_rx_batched+0x83b/0x920tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048call_write_iter include/linux/fs.h:1985 [inline]new_sync_write fs/read_write.c:491 [inline]vfs_write+0x8ef/0x15c0 fs/read_write.c:584ksys_write+0x20f/0x4c0 fs/read_write.c:637__do_sys_write fs/read_write.c:649 [inline]__se_sys_write fs/read_write.c:646 [inline]__x64_sys_write+0x93/0xd0 fs/read_write.c:646do_syscall_x64 arch/x86/entry/common.c:50 [inline]do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80entry_SYSCALL_64_after_hwframe+0x63/0xcdUninit was created at:slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767slab_alloc_node mm/slub.c:3478 [inline]kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559__alloc_skb+0x318/0x740 net/core/skbuff.c:650alloc_skb include/linux/skbuff.h:1286 [inline]alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795tun_alloc_skb drivers/net/tun.c:1531 [inline]tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048call_write_iter include/linux/fs.h:1985 [inline]new_sync_write fs/read_write.c:491 [inline]vfs_write+0x8ef/0x15c0 fs/read_write.c:584ksys_write+0x20f/0x4c0 fs/read_write.c:637__do_sys_write fs/read_write.c:649 [inline]__se_sys_write fs/read_write.c:646 [inline]__x64_sys_write+0x93/0xd0 fs/read_write.c:646do_syscall_x64 arch/x86/entry/common.c:50 [inline]do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80entry_SYSCALL_64_after_hwframe+0x63/0xcdCPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023Fixes: 977ad86c2a1b ("dccp: Fix out of bounds access in DCCP error handler")Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Jann Horn Reviewed-by: Jann Horn Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

977ad86c - dccp: Fix out of bounds access in DCCP error handler

Fri, 25 Aug 2023 13:32:41 +0000

dccp: Fix out of bounds access in DCCP error handlerThere was a previous attempt to fix an out-of-bounds access in the DCCPerror handlers, but that fix assumed that the error handlers only wantto access the first 8 bytes of the DCCP header. Actually, they also lookat the DCCP sequence number, which is stored beyond 8 bytes, so anexplicit pskb_may_pull() is required.Fixes: 6706a97fec96 ("dccp: fix out of bound access in dccp_v4_err()")Fixes: 1aa9d1a0e7ee ("ipv6: dccp: fix out of bound access in dccp_v6_err()")Cc: stable@vger.kernel.orgSigned-off-by: Jann Horn Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

f866fbc8 - ipv4: fix data-races around inet->inet_id

Sat, 19 Aug 2023 03:17:07 +0000

ipv4: fix data-races around inet->inet_idUDP sendmsg() is lockless, so ip_select_ident_segs()can very well be run from multiple cpus [1]Convert inet->inet_id to an atomic_t, but implementa dedicated path for TCP, avoiding cost of a lockedinstruction (atomic_add_return())Note that this patch will cause a trivial merge conflictbecause we added inet->flags in net-next tree.v2: added missing change indrivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c(David Ahern)[1]BUG: KCSAN: data-race in __ip_make_skb / __ip_make_skbread-write to 0xffff888145af952a of 2 bytes by task 7803 on cpu 1:ip_select_ident_segs include/net/ip.h:542 [inline]ip_select_ident include/net/ip.h:556 [inline]__ip_make_skb+0x844/0xc70 net/ipv4/ip_output.c:1446ip_make_skb+0x233/0x2c0 net/ipv4/ip_output.c:1560udp_sendmsg+0x1199/0x1250 net/ipv4/udp.c:1260inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:830sock_sendmsg_nosec net/socket.c:725 [inline]sock_sendmsg net/socket.c:748 [inline]____sys_sendmsg+0x37c/0x4d0 net/socket.c:2494___sys_sendmsg net/socket.c:2548 [inline]__sys_sendmmsg+0x269/0x500 net/socket.c:2634__do_sys_sendmmsg net/socket.c:2663 [inline]__se_sys_sendmmsg net/socket.c:2660 [inline]__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2660do_syscall_x64 arch/x86/entry/common.c:50 [inline]do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80entry_SYSCALL_64_after_hwframe+0x63/0xcdread to 0xffff888145af952a of 2 bytes by task 7804 on cpu 0:ip_select_ident_segs include/net/ip.h:541 [inline]ip_select_ident include/net/ip.h:556 [inline]__ip_make_skb+0x817/0xc70 net/ipv4/ip_output.c:1446ip_make_skb+0x233/0x2c0 net/ipv4/ip_output.c:1560udp_sendmsg+0x1199/0x1250 net/ipv4/udp.c:1260inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:830sock_sendmsg_nosec net/socket.c:725 [inline]sock_sendmsg net/socket.c:748 [inline]____sys_sendmsg+0x37c/0x4d0 net/socket.c:2494___sys_sendmsg net/socket.c:2548 [inline]__sys_sendmmsg+0x269/0x500 net/socket.c:2634__do_sys_sendmmsg net/socket.c:2663 [inline]__se_sys_sendmmsg net/socket.c:2660 [inline]__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2660do_syscall_x64 arch/x86/entry/common.c:50 [inline]do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80entry_SYSCALL_64_after_hwframe+0x63/0xcdvalue changed: 0x184d -> 0x184eReported by Kernel Concurrency Sanitizer on:CPU: 0 PID: 7804 Comm: syz-executor.1 Not tainted 6.5.0-rc6-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023==================================================================Fixes: 23f57406b82d ("ipv4: avoid using shared IP generator for connected sockets")Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

6b5f43ea - inet: move inet->recverr to inet->inet_flags

Wed, 16 Aug 2023 08:15:35 +0000

inet: move inet->recverr to inet->inet_flagsIP_RECVERR socket option can now be set/get without locking the socket.This patch potentially avoid data-races around inet->recverr.Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Reviewed-by: Simon Horman Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

2d6c85ca - dccp: Set TOS and routing scope independently for fib lookups.

Mon, 17 Jul 2023 13:53:35 +0000

dccp: Set TOS and routing scope independently for fib lookups.There's no reason for setting the RTO_ONLINK flag in ->flowi4_tos asRT_CONN_FLAGS() does. We can easily set ->flowi4_scope properlyinstead. This makes the code more explicit and will allow to convert->flowi4_tos to dscp_t in the future.Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

dc97391e - sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)

Fri, 23 Jun 2023 22:55:12 +0000

sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)Remove ->sendpage() and ->sendpage_locked(). sendmsg() withMSG_SPLICE_PAGES should be used instead. This allows multiple pages andmultipage folios to be passed through.Signed-off-by: David Howells Acked-by: Marc Kleine-Budde # for net/cancc: Jens Axboe cc: Matthew Wilcox cc: linux-afs@lists.infradead.orgcc: mptcp@lists.linux.devcc: rds-devel@oss.oracle.comcc: tipc-discussion@lists.sourceforge.netcc: virtualization@lists.linux-foundation.orgLink: https://lore.kernel.org/r/20230623225513.2732256-16-dhowells@redhat.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

9a25f0cb - dccp: annotate lockless accesses to sk->sk_err_soft

Wed, 15 Mar 2023 20:57:42 +0000

dccp: annotate lockless accesses to sk->sk_err_softThis field can be read/written without lock synchronization.Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller List of files: /linux-6.15/net/dccp/ipv4.c

e0833d1f - dccp/tcp: Fixup bhash2 bucket when connect() fails.

Sat, 19 Nov 2022 01:49:14 +0000

dccp/tcp: Fixup bhash2 bucket when connect() fails.If a socket bound to a wildcard address fails to connect(), weonly reset saddr and keep the port. Then, we have to fix up thebhash2 bucket; otherwise, the bucket has an inconsistent addressin the list.Also, listen() for such a socket will fire the WARN_ON() ininet_csk_get_port(). [0]Note that when a system runs out of memory, we give up fixing thebucket and unlink sk from bhash and bhash2 by inet_put_port().[0]:WARNING: CPU: 0 PID: 207 at net/ipv4/inet_connection_sock.c:548 inet_csk_get_port (net/ipv4/inet_connection_sock.c:548 (discriminator 1))Modules linked in:CPU: 0 PID: 207 Comm: bhash2_prev_rep Not tainted 6.1.0-rc3-00799-gc8421681c845 #63Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014RIP: 0010:inet_csk_get_port (net/ipv4/inet_connection_sock.c:548 (discriminator 1))Code: 74 a7 eb 93 48 8b 54 24 18 0f b7 cb 4c 89 e6 4c 89 ff e8 48 b2 ff ff 49 8b 87 18 04 00 00 e9 32 ff ff ff 0f 0b e9 34 ff ff ff <0f> 0b e9 42 ff ff ff 41 8b 7f 50 41 8b 4f 54 89 fe 81 f6 00 00 ffRSP: 0018:ffffc900003d7e50 EFLAGS: 00010202RAX: ffff8881047fb500 RBX: 0000000000004e20 RCX: 0000000000000000RDX: 000000000000000a RSI: 00000000fffffe00 RDI: 00000000ffffffffRBP: ffffffff8324dc00 R08: 0000000000000001 R09: 0000000000000001R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000R13: 0000000000000001 R14: 0000000000004e20 R15: ffff8881054e1280FS: 00007f8ac04dc740(0000) GS:ffff88842fc00000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000020001540 CR3: 00000001055fa003 CR4: 0000000000770ef0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400PKRU: 55555554Call Trace: inet_csk_listen_start (net/ipv4/inet_connection_sock.c:1205) inet_listen (net/ipv4/af_inet.c:228) __sys_listen (net/socket.c:1810) __x64_sys_listen (net/socket.c:1819 net/socket.c:1817 net/socket.c:1817) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)RIP: 0033:0x7f8ac051de5dCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48RSP: 002b:00007ffc1c177248 EFLAGS: 00000206 ORIG_RAX: 0000000000000032RAX: ffffffffffffffda RBX: 0000000020001550 RCX: 00007f8ac051de5dRDX: ffffffffffffff80 RSI: 0000000000000000 RDI: 0000000000000004RBP: 00007ffc1c177270 R08: 0000000000000018 R09: 0000000000000007R10: 0000000020001540 R11: 0000000000000206 R12: 00007ffc1c177388R13: 0000000000401169 R14: 0000000000403e18 R15: 00007f8ac0723000 Fixes: 28044fc1d495 ("net: Add a bhash2 table hashed by port and address")Reported-by: syzbot Reported-by: Mat Martineau Signed-off-by: Kuniyuki Iwashima Acked-by: Joanne Koong Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

8c5dae4c - dccp/tcp: Update saddr under bhash's lock.

Sat, 19 Nov 2022 01:49:13 +0000

dccp/tcp: Update saddr under bhash's lock.When we call connect() for a socket bound to a wildcard address, we updatesaddr locklessly. However, it could result in a data race; another threaditerating over bhash might see a corrupted address.Let's update saddr under the bhash bucket's lock.Fixes: 3df80d9320bc ("[DCCP]: Introduce DCCPv6")Fixes: 7c657876b63c ("[DCCP]: Initial implementation")Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")Signed-off-by: Kuniyuki Iwashima Acked-by: Joanne Koong Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

77934dc6 - dccp/tcp: Reset saddr on failure after inet6?_hash_connect().

Sat, 19 Nov 2022 01:49:11 +0000

dccp/tcp: Reset saddr on failure after inet6?_hash_connect().When connect() is called on a socket bound to the wildcard address,we change the socket's saddr to a local address. If the socketfails to connect() to the destination, we have to reset the saddr.However, when an error occurs after inet_hash6?_connect() in(dccp|tcp)_v[46]_conect(), we forget to reset saddr and leavethe socket bound to the address.From the user's point of view, whether saddr is reset or not varieswith errno. Let's fix this inconsistent behaviour.Note that after this patch, the repro [0] will trigger the WARN_ON()in inet_csk_get_port() again, but this patch is not buggy and ratherfixes a bug papering over the bhash2's bug for which we need anotherfix.For the record, the repro causes -EADDRNOTAVAIL in inet_hash6_connect()by this sequence: s1 = socket() s1.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) s1.bind(('127.0.0.1', 10000)) s1.sendto(b'hello', MSG_FASTOPEN, (('127.0.0.1', 10000))) # or s1.connect(('127.0.0.1', 10000)) s2 = socket() s2.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) s2.bind(('0.0.0.0', 10000)) s2.connect(('127.0.0.1', 10000)) # -EADDRNOTAVAIL s2.listen(32) # WARN_ON(inet_csk(sk)->icsk_bind2_hash != tb2);[0]: https://syzkaller.appspot.com/bug?extid=015d756bbd1f8b5c8f09Fixes: 3df80d9320bc ("[DCCP]: Introduce DCCPv6")Fixes: 7c657876b63c ("[DCCP]: Initial implementation")Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")Signed-off-by: Kuniyuki Iwashima Acked-by: Joanne Koong Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c

7e3cf084 - treewide: use get_random_{u8,u16}() when possible, part 1

Wed, 05 Oct 2022 15:23:53 +0000

treewide: use get_random_{u8,u16}() when possible, part 1Rather than truncate a 32-bit value to a 16-bit value or an 8-bit value,simply use the get_random_{u8,u16}() functions, which are faster thanwasting the additional bytes from a 32-bit value. This was donemechanically with this coccinelle script:@@expression E;identifier get_random_u32 =~ "get_random_int|prandom_u32|get_random_u32";typedef u16;typedef __be16;typedef __le16;typedef u8;@@(- (get_random_u32() & 0xffff)+ get_random_u16()|- (get_random_u32() & 0xff)+ get_random_u8()|- (get_random_u32() % 65536)+ get_random_u16()|- (get_random_u32() % 256)+ get_random_u8()|- (get_random_u32() >> 16)+ get_random_u16()|- (get_random_u32() >> 24)+ get_random_u8()|- (u16)get_random_u32()+ get_random_u16()|- (u8)get_random_u32()+ get_random_u8()|- (__be16)get_random_u32()+ (__be16)get_random_u16()|- (__le16)get_random_u32()+ (__le16)get_random_u16()|- prandom_u32_max(65536)+ get_random_u16()|- prandom_u32_max(256)+ get_random_u8()|- E->inet_id = get_random_u32()+ E->inet_id = get_random_u16())@@identifier get_random_u32 =~ "get_random_int|prandom_u32|get_random_u32";typedef u16;identifier v;@@- u16 v = get_random_u32();+ u16 v = get_random_u16();@@identifier get_random_u32 =~ "get_random_int|prandom_u32|get_random_u32";typedef u8;identifier v;@@- u8 v = get_random_u32();+ u8 v = get_random_u8();@@identifier get_random_u32 =~ "get_random_int|prandom_u32|get_random_u32";typedef u16;u16 v;@@- v = get_random_u32();+ v = get_random_u16();@@identifier get_random_u32 =~ "get_random_int|prandom_u32|get_random_u32";typedef u8;u8 v;@@- v = get_random_u32();+ v = get_random_u8();// Find a potential literal@literal_mask@expression LITERAL;type T;identifier get_random_u32 =~ "get_random_int|prandom_u32|get_random_u32";position p;@@ ((T)get_random_u32()@p & (LITERAL))// Examine limits@script:python add_one@literal << literal_mask.LITERAL;RESULT;@@value = Noneif literal.startswith('0x'): value = int(literal, 16)elif literal[0] in '123456789': value = int(literal, 10)if value is None: print("I don't know how to handle %s" % (literal)) cocci.include_match(False)elif value < 256: coccinelle.RESULT = cocci.make_ident("get_random_u8")elif value < 65536: coccinelle.RESULT = cocci.make_ident("get_random_u16")else: print("Skipping large mask of %s" % (literal)) cocci.include_match(False)// Replace the literal mask with the calculated result.@plus_one@expression literal_mask.LITERAL;position literal_mask.p;identifier add_one.RESULT;identifier FUNC;@@- (FUNC()@p & (LITERAL))+ (RESULT() & LITERAL)Reviewed-by: Greg Kroah-Hartman Reviewed-by: Kees Cook Reviewed-by: Yury Norov Acked-by: Jakub Kicinski Acked-by: Toke Høiland-Jørgensen # for sch_cakeSigned-off-by: Jason A. Donenfeld List of files: /linux-6.15/net/dccp/ipv4.c

28044fc1 - net: Add a bhash2 table hashed by port and address

Mon, 22 Aug 2022 18:10:21 +0000

net: Add a bhash2 table hashed by port and addressThe current bind hashtable (bhash) is hashed by port only.In the socket bind path, we have to check for bind conflicts bytraversing the specified port's inet_bind_bucket while holding thehashbucket's spinlock (see inet_csk_get_port() andinet_csk_bind_conflict()). In instances where there are tons ofsockets hashed to the same port at different addresses, the bindconflict check is time-intensive and can cause softirq cpu lockups,as well as stops new tcp connections since __inet_inherit_port()also contests for the spinlock.This patch adds a second bind table, bhash2, that hashes byport and sk->sk_rcv_saddr (ipv4) and sk->sk_v6_rcv_saddr (ipv6).Searching the bhash2 table leads to significantly faster conflictresolution and less time holding the hashbucket spinlock.Please note a few things:* There can be the case where the a socket's address changes after ithas been bound. There are two cases where this happens: 1) The case where there is a bind() call on INADDR_ANY (ipv4) or IPV6_ADDR_ANY (ipv6) and then a connect() call. The kernel will assign the socket an address when it handles the connect() 2) In inet_sk_reselect_saddr(), which is called when rebuilding the sk header and a few pre-conditions are met (eg rerouting fails).In these two cases, we need to update the bhash2 table by removing theentry for the old address, and add a new entry reflecting the updatedaddress.* The bhash2 table must have its own lock, even though concurrentaccesses on the same port are protected by the bhash lock. Bhash2 musthave its own lock to protect against cases where sockets on differentports hash to different bhash hashbuckets but to the same bhash2hashbucket.This brings up a few stipulations: 1) When acquiring both the bhash and the bhash2 lock, the bhash2 lock will always be acquired after the bhash lock and released before the bhash lock is released. 2) There are no nested bhash2 hashbucket locks. A bhash2 lock is always acquired+released before another bhash2 lock is acquired+released.* The bhash table cannot be superseded by the bhash2 table because forbind requests on INADDR_ANY (ipv4) or IPV6_ADDR_ANY (ipv6), every socketbound to that port must be checked for a potential conflict. The bhashtable is the only source of port->socket associations.Signed-off-by: Joanne Koong Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/dccp/ipv4.c