Changes in ip6_output.c

a18dfa99 - ipv6: save dontfrag in cork

Fri, 07 Mar 2025 03:34:09 +0000

ipv6: save dontfrag in corkWhen spanning datagram construction over multiple send calls usingMSG_MORE, per datagram settings are configured on the first send.That is when ip(6)_setup_cork stores these settings for subsequent usein __ip(6)_append_data and others.The only flag that escaped this was dontfrag. As a result, a datagramcould be constructed with df=0 on the first sendmsg, but df=1 on anext. Which is what cmsg_ip.sh does in an upcoming MSG_MORE test inthe "diff" scenario.Changing datagram conditions in the middle of constructing an skbmakes this already complex code path even more convoluted. It is hereunintentional. Bring this flag in line with expected sockopt/cmsgbehavior.And stop passing ipc6 to __ip6_append_data, to avoid such issuesin the future. This is already the case for __ip_append_data.inet6_cork had a 6 byte hole, so the 1B flag has no impact.Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250307033620.411611-3-willemdebruijn.kernel@gmail.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

54580ccd - ipv6: remove leftover ip6 cookie initializer

Fri, 07 Mar 2025 03:34:08 +0000

ipv6: remove leftover ip6 cookie initializerAs of the blamed commit ipc6.dontfrag is always initialized at thestart of udpv6_sendmsg, by ipcm6_init_sk, to either 0 or 1.Later checks against -1 are no longer needed and the branches are nowdead code.The blamed commit had removed those branches. But I had overlookedthis one case.UDP has both a lockless fast path and a slower path for corkedrequests. This branch remained in the fast path.Fixes: 096208592b09 ("ipv6: replace ipcm6_init calls with ipcm6_init_sk")Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250307033620.411611-2-willemdebruijn.kernel@gmail.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

a853c609 - inetpeer: do not get a refcount in inet_getpeer()

Sun, 15 Dec 2024 17:56:29 +0000

inetpeer: do not get a refcount in inet_getpeer()All inet_getpeer() callers except ip4_frag_init() don't needto acquire a permanent refcount on the inetpeer.They can switch to full RCU protection.Move the refcount_inc_not_zero() into ip4_frag_init(),so that all the other callers no longer have toperform a pair of expensive atomic operations ona possibly contended cache line.inet_putpeer() no longer needs to be exported.After this patch, my DUT can receive 8,400,000 UDP packetsper second targeting closed ports, using 50% less cpu cyclesthan before.Also change two calls to l3mdev_master_ifindex() byl3mdev_master_ifindex_rcu() (Ido ideas)Fixes: 8c2bd38b95f7 ("icmp: change the order of rate limits")Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20241215175629.1248773-5-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

661cd8fc - inetpeer: remove create argument of inet_getpeer_v[46]()

Sun, 15 Dec 2024 17:56:26 +0000

inetpeer: remove create argument of inet_getpeer_v[46]()All callers of inet_getpeer_v4() and inet_getpeer_v6()want to create an inetpeer.Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20241215175629.1248773-2-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

a32f3e9d - sock: support SO_PRIORITY cmsg

Fri, 13 Dec 2024 08:44:55 +0000

sock: support SO_PRIORITY cmsgThe Linux socket API currently allows setting SO_PRIORITY at thesocket level, applying a uniform priority to all packets sent throughthat socket. The exception to this is IP_TOS, when the priority valueis calculated during the handling ofancillary data, as implemented in commit f02db315b8d8 ("ipv4: IP_TOSand IP_TTL can be specified as ancillary data").However, this is a computedvalue, and there is currently no mechanism to set a custom priorityvia control messages prior to this patch.According to this patch, if SO_PRIORITY is specified as ancillary data,the packet is sent with the priority value set throughsockc->priority, overriding the socket-level valuesset via the traditional setsockopt() method. This is analogous tothe existing support for SO_MARK, as implemented incommit c6af0c227a22 ("ip: support SO_MARK cmsg").If both cmsg SO_PRIORITY and IP_TOS are passed, then the one thattakes precedence is the last one in the cmsg list.This patch has the side effect that raw_send_hdrinc now interprets cmsgIP_TOS.Reviewed-by: Willem de Bruijn Suggested-by: Ferenc Fejes Signed-off-by: Anna Emese Nyiri Link: https://patch.msgid.link/20241213084457.45120-3-annaemesenyiri@gmail.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

5204ccbf - inet: add indirect call wrapper for getfrag() calls

Tue, 03 Dec 2024 17:36:17 +0000

inet: add indirect call wrapper for getfrag() callsUDP send path suffers from one indirect call to ip_generic_getfrag()We can use INDIRECT_CALL_1() to avoid it.Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: Brian Vazquez Link: https://patch.msgid.link/20241203173617.2595451-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

3a1beabe - ipv6: Remove redundant unlikely()

Tue, 08 Oct 2024 08:54:54 +0000

ipv6: Remove redundant unlikely()IS_ERR_OR_NULL() already implies unlikely().Signed-off-by: Tobias Klauser Reviewed-by: Simon Horman Link: https://patch.msgid.link/20241008085454.8087-1-tklauser@distanz.chSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

822b5bc6 - net_tstamp: add SCM_TS_OPT_ID for RAW sockets

Tue, 01 Oct 2024 12:57:15 +0000

net_tstamp: add SCM_TS_OPT_ID for RAW socketsThe last type of sockets which supports SOF_TIMESTAMPING_OPT_ID is RAWsockets. To add new option this patch converts all callers (direct andindirect) of _sock_tx_timestamp to provide sockcm_cookie instead oftsflags. And while here fix __sock_tx_timestamp to receive tsflags as__u32 instead of __u16.Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20241001125716.2832769-3-vadfed@meta.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

4aecca4c - net_tstamp: add SCM_TS_OPT_ID to provide OPT_ID in control message

Tue, 01 Oct 2024 12:57:14 +0000

net_tstamp: add SCM_TS_OPT_ID to provide OPT_ID in control messageSOF_TIMESTAMPING_OPT_ID socket option flag gives a way to correlate TXtimestamps and packets sent via socket. Unfortunately, there is no wayto reliably predict socket timestamp ID value in case of error returnedby sendmsg. For UDP sockets it's impossible because of locklessnature of UDP transmit, several threads may send packets in parallel. Incase of RAW sockets MSG_MORE option makes things complicated. Moredetails are in the conversation [1].This patch adds new control message type to give user-spacesoftware an opportunity to control the mapping between packets andvalues by providing ID with each sendmsg for UDP sockets.The documentation is also added in this patch.[1] https://lore.kernel.org/netdev/CALCETrU0jB+kg0mhV6A8mrHfTE1D1pr1SD_B9Eaa9aDPfgHdtA@mail.gmail.com/Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20241001125716.2832769-2-vadfed@meta.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

2d5ff7e3 - ipv6: prevent possible UAF in ip6_xmit()

Tue, 20 Aug 2024 16:08:59 +0000

ipv6: prevent possible UAF in ip6_xmit()If skb_expand_head() returns NULL, skb has been freedand the associated dst/idev could also have been freed.We must use rcu_read_lock() to prevent a possible UAF.Fixes: 0c9f227bee11 ("ipv6: use skb_expand_head in ip6_xmit")Signed-off-by: Eric Dumazet Cc: Vasily Averin Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

da273b37 - ipv6: fix possible UAF in ip6_finish_output2()

Tue, 20 Aug 2024 16:08:58 +0000

ipv6: fix possible UAF in ip6_finish_output2()If skb_expand_head() returns NULL, skb has been freedand associated dst/idev could also have been freed.We need to hold rcu_read_lock() to make sure the dst andassociated idev are alive.Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()")Signed-off-by: Eric Dumazet Cc: Vasily Averin Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

faa389b2 - ipv6: prevent UAF in ip6_send_skb()

Tue, 20 Aug 2024 16:08:57 +0000

ipv6: prevent UAF in ip6_send_skb()syzbot reported an UAF in ip6_send_skb() [1]After ip6_local_out() has returned, we no longer can safelydereference rt, unless we hold rcu_read_lock().A similar issue has been fixed in commita688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()")Another potential issue in ip6_finish_output2() is handled in aseparate patch.[1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7f936bf79e79Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fFreed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3106 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] nf_ct_frag6_queue net/ipv6/netfilter/nf_conntrack_reasm.c:306 [inline] nf_ct_frag6_gather+0xb9a/0x2080 net/ipv6/netfilter/nf_conntrack_reasm.c:485 ipv6_defrag+0x2c8/0x3c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip6_local_out+0x6fa/0x800 net/ipv6/output_core.c:143 ip6_local_out+0x26/0x70 net/ipv6/output_core.c:153 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1959 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890Fixes: 0625491493d9 ("ipv6: ip6_push_pending_frames() should increment IPSTATS_MIB_OUTDISCARDS")Signed-off-by: Eric Dumazet Reported-by: syzbot Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-2-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

252442f2 - ipv6: fix source address selection with route leak

Wed, 10 Jul 2024 08:14:28 +0000

ipv6: fix source address selection with route leakBy default, an address assigned to the output interface is selected whenthe source address is not specified. This is problematic when a route,configured in a vrf, uses an interface from another vrf (aka route leak).The original vrf does not own the selected source address.Let's add a check against the output interface and call the appropriatefunction to select the source address.CC: stable@vger.kernel.orgFixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6")Signed-off-by: Nicolas Dichtel Link: https://patch.msgid.link/20240710081521.3809742-3-nicolas.dichtel@6wind.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

1693c5db - net: Add additional bit to support clockid_t timestamp type

Thu, 09 May 2024 21:18:33 +0000

net: Add additional bit to support clockid_t timestamp typetstamp_type is now set based on actual clockid_t compressedinto 2 bits.To make the design scalable for future needs this commit bring inthe change to extend the tstamp_type:1 to tstamp_type:2 to supportother clockid_t timestamp.We now support CLOCK_TAI as part of tstamp_type as part of thiscommit with existing support CLOCK_MONOTONIC and CLOCK_REALTIME.Signed-off-by: Abhishek Chauhan Reviewed-by: Willem de Bruijn Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20240509211834.3235191-3-quic_abchauha@quicinc.comSigned-off-by: Martin KaFai Lau List of files: /linux-6.15/net/ipv6/ip6_output.c

4d25ca2d - net: Rename mono_delivery_time to tstamp_type for scalabilty

Thu, 09 May 2024 21:18:32 +0000

net: Rename mono_delivery_time to tstamp_type for scalabiltymono_delivery_time was added to check if skb->tstamp has deliverytime in mono clock base (i.e. EDT) otherwise skb->tstamp hastimestamp in ingress and delivery_time at egress.Renaming the bitfield from mono_delivery_time to tstamp_type is forextensibilty for other timestamps such as userspace timestamp(i.e. SO_TXTIME) set via sock opts.As we are renaming the mono_delivery_time to tstamp_type, it makessense to start assigning tstamp_type based on enum definedin this commit.Earlier we used bool arg flag to check if the tstamp is mono infunction skb_set_delivery_time, Now the signature of the functionsaccepts tstamp_type to distinguish between mono and real time.Also skb_set_delivery_type_by_clockid is a new function which acceptsclockid to determine the tstamp_type.In future tstamp_type:1 can be extended to support userspace timestampby increasing the bitfield.Signed-off-by: Abhishek Chauhan Reviewed-by: Willem de Bruijn Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20240509211834.3235191-2-quic_abchauha@quicinc.comSigned-off-by: Martin KaFai Lau List of files: /linux-6.15/net/ipv6/ip6_output.c

4db783d6 - ipv6: prevent NULL dereference in ip6_output()

Tue, 07 May 2024 16:18:42 +0000

ipv6: prevent NULL dereference in ip6_output()According to syzbot, there is a chance that ip6_dst_idev()returns NULL in ip6_output(). Most places in IPv6 stackdeal with a NULL idev just fine, but not here.syzbot reported:general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]CPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237Code: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ffRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000RDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48RBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fadR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0R13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000FS: 00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358 sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248 sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653 sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783 sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline] sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169 sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73 __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234 sctp_connect net/sctp/socket.c:4819 [inline] sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834 __sys_connect_file net/socket.c:2048 [inline] __sys_connect+0x2df/0x310 net/socket.c:2065 __do_sys_connect net/socket.c:2075 [inline] __se_sys_connect net/socket.c:2072 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2072 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fFixes: 778d80be5269 ("ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface.")Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Larysa Zaremba Link: https://lore.kernel.org/r/20240507161842.773961-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_output.c

4e13d3a9 - ipv6: Fix potential uninit-value access in __ip6_make_skb()

Mon, 06 May 2024 14:11:29 +0000

ipv6: Fix potential uninit-value access in __ip6_make_skb()As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in__ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flagsinstead of testing HDRINCL on the socket to avoid a race condition whichcauses uninit-value access.Fixes: ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()")Signed-off-by: Shigeru Yoshida Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_output.c

e8dfd42c - ipv6: introduce dst_rt6_info() helper

Fri, 26 Apr 2024 15:19:52 +0000

ipv6: introduce dst_rt6_info() helperInstead of (struct rt6_info *)dst casts, we can use : #define dst_rt6_info(_ptr) \ container_of_const(_ptr, struct rt6_info, dst)Some places needed missing const qualifiers :ip6_confirm_neigh(), ipv6_anycast_destination(),ipv6_unicast_destination(), has_gateway()v2: added missing parts (David Ahern)Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_output.c

35c3e279 - Revert "net: Re-use and set mono_delivery_time bit for userspace tstamp packets"

Thu, 14 Mar 2024 19:24:04 +0000

Revert "net: Re-use and set mono_delivery_time bit for userspace tstamp packets"This reverts commit 885c36e59f46375c138de18ff1692f18eff67b7f.The patch currently broke the bpf selftest test_tc_dtime becauseuapi field __sk_buff->tstamp_type depends on skb->mono_delivery_time whichdoes not necessarily mean mono with the original fix as the bit was re-usedfor userspace timestamp as well to avoid tstamp reset in the forwardingpath. To solve this we need to keep mono_delivery_time as is andintroduce another bit called user_delivery_time and fall back to theinitial proposal of setting the user_delivery_time bit based onsk_clockid set from userspace.Fixes: 885c36e59f46 ("net: Re-use and set mono_delivery_time bit for userspace tstamp packets")Link: https://lore.kernel.org/netdev/bc037db4-58bb-4861-ac31-a361a93841d3@linux.dev/Signed-off-by: Abhishek Chauhan Acked-by: Daniel Borkmann Acked-by: Martin KaFai Lau Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_output.c

885c36e5 - net: Re-use and set mono_delivery_time bit for userspace tstamp packets

Fri, 01 Mar 2024 20:13:48 +0000

net: Re-use and set mono_delivery_time bit for userspace tstamp packetsBridge driver today has no support to forward the userspace timestamppackets and ends up resetting the timestamp. ETF qdisc checks thepacket coming from userspace and encounters to be 0 thereby droppingtime sensitive packets. These changes will allow userspace timestampspackets to be forwarded from the bridge to NIC drivers.Setting the same bit (mono_delivery_time) to avoid dropping ofuserspace tstamp packets in the forwarding path.Existing functionality of mono_delivery_time remains unaltered here,instead just extended with userspace tstamp support for bridgeforwarding path.Signed-off-by: Abhishek Chauhan Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20240301201348.2815102-1-quic_abchauha@quicinc.comSigned-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv6/ip6_output.c