diff options
Diffstat (limited to '0001-net-packet-move-reference-count-in-packet_sock-to-64.patch')
| -rw-r--r-- | 0001-net-packet-move-reference-count-in-packet_sock-to-64.patch | 98 |
1 files changed, 98 insertions, 0 deletions
diff --git a/0001-net-packet-move-reference-count-in-packet_sock-to-64.patch b/0001-net-packet-move-reference-count-in-packet_sock-to-64.patch new file mode 100644 index 00000000000000..734633f20a0ade --- /dev/null +++ b/0001-net-packet-move-reference-count-in-packet_sock-to-64.patch @@ -0,0 +1,98 @@ +From ac0d2377f612a16f1b452c7945e77dee93c0289e Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Date: Thu, 30 Nov 2023 14:10:27 +0000 +Subject: [PATCH] net/packet: move reference count in packet_sock to 64 bits + +In some potential instances the reference count on struct packet_sock +could be saturated and cause overflows which gets the kernel a bit +confused. To prevent this, move to a 64bit atomic reference count to +prevent the possibility of this type of overflow. + +Because we can not handle saturation, using refcount_t is not possible +in this place. Maybe someday in the future if it changes could it be +used. + +Original version from Daniel after I did it wrong, I've provided a +changelog. + +Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> +Cc: stable <stable@kernel.org> +Cc: Daniel Borkmann <daniel@iogearbox.net> +Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + net/packet/af_packet.c | 16 ++++++++-------- + net/packet/internal.h | 2 +- + 2 files changed, 9 insertions(+), 9 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -4300,7 +4300,7 @@ static void packet_mm_open(struct vm_are + struct sock *sk = sock->sk; + + if (sk) +- atomic_inc(&pkt_sk(sk)->mapped); ++ atomic64_inc(&pkt_sk(sk)->mapped); + } + + static void packet_mm_close(struct vm_area_struct *vma) +@@ -4310,7 +4310,7 @@ static void packet_mm_close(struct vm_ar + struct sock *sk = sock->sk; + + if (sk) +- atomic_dec(&pkt_sk(sk)->mapped); ++ atomic64_dec(&pkt_sk(sk)->mapped); + } + + static const struct vm_operations_struct packet_mmap_ops = { +@@ -4405,7 +4405,7 @@ static int packet_set_ring(struct sock * + + err = -EBUSY; + if (!closing) { +- if (atomic_read(&po->mapped)) ++ if (atomic64_read(&po->mapped)) + goto out; + if (packet_read_pending(rb)) + goto out; +@@ -4508,7 +4508,7 @@ static int packet_set_ring(struct sock * + + err = -EBUSY; + mutex_lock(&po->pg_vec_lock); +- if (closing || atomic_read(&po->mapped) == 0) { ++ if (closing || atomic64_read(&po->mapped) == 0) { + err = 0; + spin_lock_bh(&rb_queue->lock); + swap(rb->pg_vec, pg_vec); +@@ -4526,9 +4526,9 @@ static int packet_set_ring(struct sock * + po->prot_hook.func = (po->rx_ring.pg_vec) ? + tpacket_rcv : packet_rcv; + skb_queue_purge(rb_queue); +- if (atomic_read(&po->mapped)) +- pr_err("packet_mmap: vma is busy: %d\n", +- atomic_read(&po->mapped)); ++ if (atomic64_read(&po->mapped)) ++ pr_err("packet_mmap: vma is busy: %lld\n", ++ atomic64_read(&po->mapped)); + } + mutex_unlock(&po->pg_vec_lock); + +@@ -4606,7 +4606,7 @@ static int packet_mmap(struct file *file + } + } + +- atomic_inc(&po->mapped); ++ atomic64_inc(&po->mapped); + vma->vm_ops = &packet_mmap_ops; + err = 0; + +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -122,7 +122,7 @@ struct packet_sock { + __be16 num; + struct packet_rollover *rollover; + struct packet_mclist *mclist; +- atomic_t mapped; ++ atomic64_t mapped; + enum tpacket_versions tp_version; + unsigned int tp_hdrlen; + unsigned int tp_reserve; |