mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-15 15:15:47 +00:00
Code Issues Releases Wiki Activity
No description
1143099 commits 104 branches 5093 tags 5.5 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Find a file
Paolo Abeni 2827f099b3 mptcp: use the workqueue to destroy unaccepted sockets 
[ Upstream commit b6985b9b82 ]

  Backports notes: one simple conflict in net/mptcp/protocol.c with:

    commit a5ef058dc4 ("net: introduce and use custom sockopt socket flag")

  Where the two commits add a new line for different actions in the same
  context in mptcp_stream_accept().

Christoph reported a UaF at token lookup time after having
refactored the passive socket initialization part:

  BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260
  Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198

  CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x6e/0x91
   print_report+0x16a/0x46f
   kasan_report+0xad/0x130
   __token_bucket_busy+0x253/0x260
   mptcp_token_new_connect+0x13d/0x490
   mptcp_connect+0x4ed/0x860
   __inet_stream_connect+0x80e/0xd90
   tcp_sendmsg_fastopen+0x3ce/0x710
   mptcp_sendmsg+0xff1/0x1a20
   inet_sendmsg+0x11d/0x140
   __sys_sendto+0x405/0x490
   __x64_sys_sendto+0xdc/0x1b0
   do_syscall_64+0x3b/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

We need to properly clean-up all the paired MPTCP-level
resources and be sure to release the msk last, even when
the unaccepted subflow is destroyed by the TCP internals
via inet_child_forget().

We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra,
explicitly checking that for the critical scenario: the
closed subflow is the MPC one, the msk is not accepted and
eventually going through full cleanup.

With such change, __mptcp_destroy_sock() is always called
on msk sockets, even on accepted ones. We don't need anymore
to transiently drop one sk reference at msk clone time.

Please note this commit depends on the parent one:

  mptcp: refactor passive socket initialization

Fixes: 58b0991962 ("mptcp: create msk early")
Cc: stable@vger.kernel.org
Reported-and-tested-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/347
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:00 +02:00
arch powerpc/64: Replace -mcpu=e500mc64 by -mcpu=e5500 2023-03-22 13:34:07 +01:00
block block: do not reverse request order when flushing plug list 2023-03-22 13:33:46 +01:00
certs certs: Fix build error when PKCS#11 URI contains semicolon 2023-02-09 11:28:11 +01:00
crypto crypto: rsa-pkcs1pad - Use akcipher_request_complete 2023-03-10 09:33:03 +01:00
Documentation docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate 2023-03-22 13:33:40 +01:00
drivers drm/amd/display: Remove OTG DIV register write for Virtual signals. 2023-03-30 12:49:00 +02:00
fs ocfs2: fix data corruption after failed write 2023-03-22 13:34:02 +01:00
include fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() 2023-03-22 13:34:04 +01:00
init gcc: disable -Warray-bounds for gcc-11 too 2023-01-14 10:33:43 +01:00
io_uring io_uring/msg_ring: let target know allocated index 2023-03-22 13:34:06 +01:00
ipc
kernel tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr 2023-03-30 12:48:59 +02:00
lib sbitmap: Try each queue to wake up at least one waiter 2023-03-10 09:34:34 +01:00
LICENSES
mm mm: teach mincore_hugetlb about pte markers 2023-03-22 13:34:03 +01:00
net mptcp: use the workqueue to destroy unaccepted sockets 2023-03-30 12:49:00 +02:00
rust rust: print: avoid evaluating arguments in pr_* macros in unsafe blocks 2023-02-06 08:06:34 +01:00
samples ftrace: Export ftrace_free_filter() to modules 2023-02-01 08:34:37 +01:00
scripts kconfig: Update config changed flag before calling callback 2023-03-22 13:33:52 +01:00
security ima: Align ima_file_mmap() parameters with mmap_file LSM hook 2023-03-10 09:34:15 +01:00
sound ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP 2023-03-22 13:34:05 +01:00
tools selftests: net: devlink_port_split.py: skip test if no suitable device available 2023-03-22 13:33:50 +01:00
usr
virt KVM: Register /dev/kvm as the _very_ last thing during initialization 2023-03-10 09:34:11 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS audit: update the mailing list in MAINTAINERS 2023-02-25 11:25:42 +01:00
Makefile Linux 6.1.21 2023-03-22 13:34:07 +01:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.