Patch "tcp: don't annotate mark on control socket from tcp_v6_send_response()" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Feb 17, 2017

Subsystems (5)

Networking Stable branch IPv4/IPv6 TCP +1 more subsystems

lore

Share & tools

lore

[email protected]

author maintainer Applied

2017-02-17 01:11 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

tcp: don't annotate mark on control socket from tcp_v6_send_response()

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tcp-don-t-annotate-mark-on-control-socket-from-tcp_v6_send_response.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 92e55f412cffd016cc245a74278cb4d7b89bb3bc Mon Sep 17 00:00:00 2001

From: Pablo Neira <[email protected]>
Date: Thu, 26 Jan 2017 22:56:21 +0100
Subject: tcp: don't annotate mark on control socket from tcp_v6_send_response()

From: Pablo Neira <[email protected]>

commit 92e55f412cffd016cc245a74278cb4d7b89bb3bc upstream.

Unlike ipv4, this control socket is shared by all cpus so we cannot use it as scratchpad area to annotate the mark that we pass to ip6_xmit().

Add a new parameter to ip6_xmit() to indicate the mark. The SCTP socket family caches the flowi6 structure in the sctp_transport structure, so we cannot use to carry the mark unless we later on reset it back, which I discarded since it looks ugly to me.

Fixes bf99b4ded5f8 ("tcp: fix mark propagation with fwmark_reflect enabled")

Signed-off-by Pablo Neira Ayuso <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/net/ipv6.h               |    2 +-
 net/dccp/ipv6.c                  |    4 ++--
 net/ipv6/inet6_connection_sock.c |    2 +-
 net/ipv6/ip6_output.c            |    4 ++--
 net/ipv6/tcp_ipv6.c              |    5 ++---
 net/sctp/ipv6.c                  |    3 ++-
 6 files changed, 10 insertions(+), 10 deletions(-)

include/net/ipv6.h +1 -1

@@ -871,7 +871,7 @@ int ip6_rcv_finish(struct net *net, stru
  *	upper-layer output functions
  */
 int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
-	     struct ipv6_txoptions *opt, int tclass);
+	     __u32 mark, struct ipv6_txoptions *opt, int tclass);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr);

net/dccp/ipv6.c +2 -2

@@ -227,7 +227,7 @@ static int dccp_v6_send_response(const s
 		opt = ireq->ipv6_opt;
 		if (!opt)
 			opt = rcu_dereference(np->opt);
-		err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
+		err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, opt, np->tclass);
 		rcu_read_unlock();
 		err = net_xmit_eval(err);
 	}

@@ -281,7 +281,7 @@ static void dccp_v6_ctl_send_reset(const
 	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 	if (!IS_ERR(dst)) {
 		skb_dst_set(skb, dst);
-		ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
+		ip6_xmit(ctl_sk, skb, &fl6, 0, NULL, 0);
 		DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 		DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
 		return;

net/ipv6/inet6_connection_sock.c +1 -1

@@ -173,7 +173,7 @@ int inet6_csk_xmit(struct sock *sk, stru
 	/* Restore final destination back after routing done */
 	fl6.daddr = sk->sk_v6_daddr;
 
-	res = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
+	res = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt),
 		       np->tclass);
 	rcu_read_unlock();
 	return res;

net/ipv6/ip6_output.c +2 -2

@@ -163,7 +163,7 @@ int ip6_output(struct net *net, struct s
  * which are using proper atomic operations or spinlocks.
  */
 int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
-	     struct ipv6_txoptions *opt, int tclass)
+	     __u32 mark, struct ipv6_txoptions *opt, int tclass)
 {
 	struct net *net = sock_net(sk);
 	const struct ipv6_pinfo *np = inet6_sk(sk);

@@ -230,7 +230,7 @@ int ip6_xmit(const struct sock *sk, stru
 
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->priority = sk->sk_priority;
-	skb->mark = sk->sk_mark;
+	skb->mark = mark;
 
 	mtu = dst_mtu(dst);
 	if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {

net/ipv6/tcp_ipv6.c +2 -3

@@ -467,7 +467,7 @@ static int tcp_v6_send_synack(const stru
 		opt = ireq->ipv6_opt;
 		if (!opt)
 			opt = rcu_dereference(np->opt);
-		err = ip6_xmit(sk, skb, fl6, opt, np->tclass);
+		err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
 		rcu_read_unlock();
 		err = net_xmit_eval(err);
 	}

@@ -837,8 +837,7 @@ static void tcp_v6_send_response(const s
 	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 	if (!IS_ERR(dst)) {
 		skb_dst_set(buff, dst);
-		ctl_sk->sk_mark = fl6.flowi6_mark;
-		ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
+		ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 		TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 		if (rst)
 			TCP_INC_STATS(net, TCP_MIB_OUTRSTS);

net/sctp/ipv6.c +2 -1

@@ -222,7 +222,8 @@ static int sctp_v6_xmit(struct sk_buff *
 	SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
 
 	rcu_read_lock();
-	res = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt), np->tclass);
+	res = ip6_xmit(sk, skb, fl6, sk->sk_mark, rcu_dereference(np->opt),
+		       np->tclass);
 	rcu_read_unlock();
 	return res;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/tcp-don-t-annotate-mark-on-control-socket-from-tcp_v6_send_response.patch queue-4.9/tcp-fix-mark-propagation-with-fwmark_reflect-enabled.patch