Patch "net: use skb_to_full_sk() in skb_update_prio()" has been added to the 4.9-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
net: use skb_to_full_sk() in skb_update_prio()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-use-skb_to_full_sk-in-skb_update_prio.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Wed Mar 28 20:16:33 CEST 2018
From: Eric Dumazet <[email protected]>
Date: Wed, 14 Mar 2018 09:04:16 -0700
Subject: net: use skb_to_full_sk() in skb_update_prio()
From: Eric Dumazet <[email protected]>
[ Upstream commit 4dcb31d4649df36297296b819437709f5407059c ]
Andrei Vagin reported a KASAN: slab-out-of-bounds error in skb_update_prio()
Since SYNACK might be attached to a request socket, we need to get back to the listener socket.
Since this listener is manipulated without locks, add const qualifiers to sock_cgroup_prioidx() so that the const can also be used in skb_update_prio()
Also add the const qualifier to sock_cgroup_classid() for consistency.
--- include/linux/cgroup-defs.h | 4 ++-- net/core/dev.c | 22 +++++++++++++++------- 2 files changed, 17 insertions(+), 9 deletions(-)
include/linux/cgroup-defs.h +2 -2
@@ -609,13 +609,13 @@ struct sock_cgroup_data {* updaters and return part of the previous pointer as the prioidx or * classid. Such races are short-lived and the result isn't critical. */ -static inline u16 sock_cgroup_prioidx (struct sock_cgroup_data *skcd) +static inline u16 sock_cgroup_prioidx (const struct sock_cgroup_data *skcd) {/* fallback to 1 which is always the ID of the root cgroup */ return (skcd->is_data &1 ) ? skcd->prioidx :1 ; } -static inline u32 sock_cgroup_classid (struct sock_cgroup_data *skcd) +static inline u32 sock_cgroup_classid (const struct sock_cgroup_data *skcd) {/* fallback to 0 which is the unconfigured default classid */ return (skcd->is_data &1 ) ? skcd->classid :0 ;
net/core/dev.c +15 -7
@@ -3179,15 +3179,23 @@ static inline int __dev_xmit_skb(struct#if IS_ENABLED (CONFIG_CGROUP_NET_PRIO )static void skb_update_prio (struct sk_buff *skb) { -struct netprio_map *map =rcu_dereference_bh (skb->dev->priomap); +const struct netprio_map *map; +const struct sock *sk; +unsigned int prioidx; -if (!skb->priority && skb->sk && map) { -unsigned int prioidx = -sock_cgroup_prioidx (&skb->sk->sk_cgrp_data); +if (skb->priority) +return ; + map =rcu_dereference_bh (skb->dev->priomap); +if (!map) +return ; + sk =skb_to_full_sk (skb); +if (!sk) +return ; -if (prioidx < map->priomap_len) - skb->priority = map->priomap[prioidx]; - } + prioidx =sock_cgroup_prioidx (&sk->sk_cgrp_data); + +if (prioidx < map->priomap_len) + skb->priority = map->priomap[prioidx]; }#else #define skb_update_prio (skb)
Patches currently in stable-queue which might be from [email protected] are
queue-4.9/ipv6-fix-access-to-non-linear-packet-in-ndisc_fill_redirect_hdr_option.patch queue-4.9/skbuff-fix-not-waking-applications-when-errors-are-enqueued.patch queue-4.9/l2tp-do-not-accept-arbitrary-sockets.patch queue-4.9/net-use-skb_to_full_sk-in-skb_update_prio.patch queue-4.9/ieee802154-6lowpan-fix-possible-null-deref-in-lowpan_device_event.patch