linux.git/net/handshake, branch v6.6

net/handshake: fix file ref count in handshake_nl_accept_doit()

2023-10-23T17:19:33+00:00

If req->hr_proto->hp_accept() fail, we call fput() twice:
Once in the error path, but also a second time because sock->file
is at that point already associated with the file descriptor. Once
the task exits, as it would probably do after receiving an error
reading from netlink, the fd is closed, calling fput() a second time.

To fix, we move installing the file after the error path for the
hp_accept() call. In the case of errors we simply put the unused fd.
In case of success we can use fd_install() to link the sock->file
to the reserved fd.

Fixes: 7ea9c1ec66bc ("net/handshake: Fix handshake_dup() ref counting")
Signed-off-by: Moritz Wanzenböck 
Reviewed-by: Chuck Lever 
Link: https://lore.kernel.org/r/20231019125847.276443-1-moritz.wanzenboeck@linbit.com
Signed-off-by: Jakub Kicinski

net/handshake: Fix memory leak in __sock_create() and sock_alloc_file()

2023-09-20T10:54:49+00:00

When making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y,
modprobe handshake-test and then rmmmod handshake-test, the below memory
leak is detected.

The struct socket_alloc which is allocated by alloc_inode_sb() in
__sock_create() is not freed. And the struct dentry which is allocated
by __d_alloc() in sock_alloc_file() is not freed.

Since fput() will call file->f_op->release() which is sock_close() here and
it will call __sock_release(). and fput() will call dput(dentry) to free
the struct dentry. So replace sock_release() with fput() to fix the
below memory leak. After applying this patch, the following memory leak is
never detected.

unreferenced object 0xffff888109165840 (size 768):
  comm "kunit_try_catch", pid 1852, jiffies 4294685807 (age 976.262s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00  ......ZZ .......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] sock_alloc_inode+0x1f/0x1b0
    [] alloc_inode+0x5b/0x1a0
    [] new_inode_pseudo+0xd/0x70
    [] sock_alloc+0x3c/0x260
    [] __sock_create+0x66/0x3d0
    [] 0xffffffffa0209ba2
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810f472008 (size 192):
  comm "kunit_try_catch", pid 1852, jiffies 4294685808 (age 976.261s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 08 20 47 0f 81 88 ff ff  ......... G.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0209bbb
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810958e580 (size 224):
  comm "kunit_try_catch", pid 1852, jiffies 4294685808 (age 976.261s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0209bbb
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926dc88 (size 192):
  comm "kunit_try_catch", pid 1854, jiffies 4294685809 (age 976.271s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 88 dc 26 09 81 88 ff ff  ..........&.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0208fdc
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a241380 (size 224):
  comm "kunit_try_catch", pid 1854, jiffies 4294685809 (age 976.271s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0208fdc
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109165040 (size 768):
  comm "kunit_try_catch", pid 1856, jiffies 4294685811 (age 976.269s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00  ......ZZ .......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] sock_alloc_inode+0x1f/0x1b0
    [] alloc_inode+0x5b/0x1a0
    [] new_inode_pseudo+0xd/0x70
    [] sock_alloc+0x3c/0x260
    [] __sock_create+0x66/0x3d0
    [] 0xffffffffa0208860
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926d568 (size 192):
  comm "kunit_try_catch", pid 1856, jiffies 4294685811 (age 976.269s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 68 d5 26 09 81 88 ff ff  ........h.&.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0208879
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a240580 (size 224):
  comm "kunit_try_catch", pid 1856, jiffies 4294685811 (age 976.347s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0208879
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109164c40 (size 768):
  comm "kunit_try_catch", pid 1858, jiffies 4294685816 (age 976.342s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00  ......ZZ .......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] sock_alloc_inode+0x1f/0x1b0
    [] alloc_inode+0x5b/0x1a0
    [] new_inode_pseudo+0xd/0x70
    [] sock_alloc+0x3c/0x260
    [] __sock_create+0x66/0x3d0
    [] 0xffffffffa0208541
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926cd18 (size 192):
  comm "kunit_try_catch", pid 1858, jiffies 4294685816 (age 976.342s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 18 cd 26 09 81 88 ff ff  ..........&.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa020855a
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a240200 (size 224):
  comm "kunit_try_catch", pid 1858, jiffies 4294685816 (age 976.342s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa020855a
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109164840 (size 768):
  comm "kunit_try_catch", pid 1860, jiffies 4294685817 (age 976.416s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00  ......ZZ .......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] sock_alloc_inode+0x1f/0x1b0
    [] alloc_inode+0x5b/0x1a0
    [] new_inode_pseudo+0xd/0x70
    [] sock_alloc+0x3c/0x260
    [] __sock_create+0x66/0x3d0
    [] 0xffffffffa02093e2
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926cab8 (size 192):
  comm "kunit_try_catch", pid 1860, jiffies 4294685817 (age 976.416s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 b8 ca 26 09 81 88 ff ff  ..........&.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa02093fb
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a240040 (size 224):
  comm "kunit_try_catch", pid 1860, jiffies 4294685817 (age 976.416s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa02093fb
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109166440 (size 768):
  comm "kunit_try_catch", pid 1862, jiffies 4294685819 (age 976.489s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00  ......ZZ .......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] sock_alloc_inode+0x1f/0x1b0
    [] alloc_inode+0x5b/0x1a0
    [] new_inode_pseudo+0xd/0x70
    [] sock_alloc+0x3c/0x260
    [] __sock_create+0x66/0x3d0
    [] 0xffffffffa02097c1
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926c398 (size 192):
  comm "kunit_try_catch", pid 1862, jiffies 4294685819 (age 976.489s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 98 c3 26 09 81 88 ff ff  ..........&.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa02097da
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888107e0b8c0 (size 224):
  comm "kunit_try_catch", pid 1862, jiffies 4294685819 (age 976.489s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa02097da
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109164440 (size 768):
  comm "kunit_try_catch", pid 1864, jiffies 4294685821 (age 976.487s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00  ......ZZ .......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] sock_alloc_inode+0x1f/0x1b0
    [] alloc_inode+0x5b/0x1a0
    [] new_inode_pseudo+0xd/0x70
    [] sock_alloc+0x3c/0x260
    [] __sock_create+0x66/0x3d0
    [] 0xffffffffa020824e
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810f4cf698 (size 192):
  comm "kunit_try_catch", pid 1864, jiffies 4294685821 (age 976.501s)
  hex dump (first 32 bytes):
    00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00  ..P@............
    00 00 00 00 00 00 00 00 98 f6 4c 0f 81 88 ff ff  ..........L.....
  backtrace:
    [] __d_alloc+0x31/0x8a0
    [] d_alloc_pseudo+0xe/0x50
    [] alloc_file_pseudo+0xce/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0208267
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888107e0b000 (size 224):
  comm "kunit_try_catch", pid 1864, jiffies 4294685821 (age 976.501s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] alloc_empty_file+0x50/0x160
    [] alloc_file+0x59/0x730
    [] alloc_file_pseudo+0x154/0x210
    [] sock_alloc_file+0x42/0x1b0
    [] 0xffffffffa0208267
    [] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [] kthread+0x2b6/0x380
    [] ret_from_fork+0x2d/0x70
    [] ret_from_fork_asm+0x11/0x20

Fixes: 88232ec1ec5e ("net/handshake: Add Kunit tests for the handshake consumer API")
Signed-off-by: Jinjie Ruan 
Signed-off-by: David S. Miller

net/handshake: fix null-ptr-deref in handshake_nl_done_doit()

2023-09-01T06:25:14+00:00

We should not call trace_handshake_cmd_done_err() if socket lookup has failed.

Also we should call trace_handshake_cmd_done_err() before releasing the file,
otherwise dereferencing sock->sk can return garbage.

This also reverts 7afc6d0a107f ("net/handshake: Fix uninitialized local variable")

Unable to handle kernel paging request at virtual address dfff800000000003
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000003] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5986 Comm: syz-executor292 Not tainted 6.5.0-rc7-syzkaller-gfe4469582053 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : handshake_nl_done_doit+0x198/0x9c8 net/handshake/netlink.c:193
lr : handshake_nl_done_doit+0x180/0x9c8
sp : ffff800096e37180
x29: ffff800096e37200 x28: 1ffff00012dc6e34 x27: dfff800000000000
x26: ffff800096e373d0 x25: 0000000000000000 x24: 00000000ffffffa8
x23: ffff800096e373f0 x22: 1ffff00012dc6e38 x21: 0000000000000000
x20: ffff800096e371c0 x19: 0000000000000018 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800080516cc4 x15: 0000000000000001
x14: 1fffe0001b14aa3b x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000003
x8 : 0000000000000003 x7 : ffff800080afe47c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080a88078
x2 : 0000000000000001 x1 : 00000000ffffffa8 x0 : 0000000000000000
Call trace:
handshake_nl_done_doit+0x198/0x9c8 net/handshake/netlink.c:193
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x96c/0xc50 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2549
genl_rcv+0x38/0x50 net/netlink/genetlink.c:1078
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x834/0xb18 net/netlink/af_netlink.c:1914
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x56c/0x840 net/socket.c:2494
___sys_sendmsg net/socket.c:2548 [inline]
__sys_sendmsg+0x26c/0x33c net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2584
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: 12800108 b90043e8 910062b3 d343fe68 (387b6908)

Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests")
Reported-by: syzbot 
Signed-off-by: Eric Dumazet 
Cc: Chuck Lever 
Reviewed-by: Michal Kubiak 
Signed-off-by: David S. Miller

net/handshake: Trace events for TLS Alert helpers

2023-07-28T21:07:59+00:00

Add observability for the new TLS Alert infrastructure.

Reviewed-by: Hannes Reinecke 
Signed-off-by: Chuck Lever 
Link: https://lore.kernel.org/r/169047947409.5241.14548832149596892717.stgit@oracle-102.nfsv4bat.org
Signed-off-by: Jakub Kicinski

net/handshake: Add helpers for parsing incoming TLS Alerts

2023-07-28T21:07:59+00:00

Kernel TLS consumers can replace common TLS Alert parsing code with
these helpers.

Signed-off-by: Chuck Lever 
Link: https://lore.kernel.org/r/169047942074.5241.13791647439480672048.stgit@oracle-102.nfsv4bat.org
Signed-off-by: Jakub Kicinski

net/handshake: Add API for sending TLS Closure alerts

2023-07-28T21:07:59+00:00

This helper sends an alert only if a TLS session was established.

Signed-off-by: Chuck Lever 
Link: https://lore.kernel.org/r/169047936730.5241.618595693821012638.stgit@oracle-102.nfsv4bat.org
Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2023-06-16T05:19:41+00:00

Cross-merge networking fixes after downstream PR.

Conflicts:

include/linux/mlx5/driver.h
  617f5db1a626 ("RDMA/mlx5: Fix affinity assignment")
  dc13180824b7 ("net/mlx5: Enable devlink port for embedded cpu VF vports")
https://lore.kernel.org/all/20230613125939.595e50b8@canb.auug.org.au/

tools/testing/selftests/net/mptcp/mptcp_join.sh
  47867f0a7e83 ("selftests: mptcp: join: skip check if MIB counter not supported")
  425ba803124b ("selftests: mptcp: join: support RM_ADDR for used endpoints or not")
  45b1a1227a7a ("mptcp: introduces more address related mibs")
  0639fa230a21 ("selftests: mptcp: add explicit check for new mibs")
https://lore.kernel.org/netdev/20230609-upstream-net-20230610-mptcp-selftests-support-old-kernels-part-3-v1-0-2896fe2ee8a3@tessares.net/

No adjacent changes.

Signed-off-by: Jakub Kicinski

net/handshake: remove fput() that causes use-after-free

2023-06-15T05:26:37+00:00

A reference underflow is found in TLS handshake subsystem that causes a
direct use-after-free. Part of the crash log is like below:

[    2.022114] ------------[ cut here ]------------
[    2.022193] refcount_t: underflow; use-after-free.
[    2.022288] WARNING: CPU: 0 PID: 60 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
[    2.022432] Modules linked in:
[    2.022848] RIP: 0010:refcount_warn_saturate+0xbe/0x110
[    2.023231] RSP: 0018:ffffc900001bfe18 EFLAGS: 00000286
[    2.023325] RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00000000ffffdfff
[    2.023438] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[    2.023555] RBP: ffff888004c20098 R08: ffffffff82b392c8 R09: 00000000ffffdfff
[    2.023693] R10: ffffffff82a592e0 R11: ffffffff82b092e0 R12: ffff888004c200d8
[    2.023813] R13: 0000000000000000 R14: ffff888004c20000 R15: ffffc90000013ca8
[    2.023930] FS:  0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
[    2.024062] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.024161] CR2: ffff888003601000 CR3: 0000000002a2e000 CR4: 00000000000006f0
[    2.024275] Call Trace:
[    2.024322]  
[    2.024367]  ? __warn+0x7f/0x130
[    2.024430]  ? refcount_warn_saturate+0xbe/0x110
[    2.024513]  ? report_bug+0x199/0x1b0
[    2.024585]  ? handle_bug+0x3c/0x70
[    2.024676]  ? exc_invalid_op+0x18/0x70
[    2.024750]  ? asm_exc_invalid_op+0x1a/0x20
[    2.024830]  ? refcount_warn_saturate+0xbe/0x110
[    2.024916]  ? refcount_warn_saturate+0xbe/0x110
[    2.024998]  __tcp_close+0x2f4/0x3d0
[    2.025065]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[    2.025168]  tcp_close+0x1f/0x70
[    2.025231]  inet_release+0x33/0x60
[    2.025297]  sock_release+0x1f/0x80
[    2.025361]  handshake_req_cancel_test2+0x100/0x2d0
[    2.025457]  kunit_try_run_case+0x4c/0xa0
[    2.025532]  kunit_generic_run_threadfn_adapter+0x15/0x20
[    2.025644]  kthread+0xe1/0x110
[    2.025708]  ? __pfx_kthread+0x10/0x10
[    2.025780]  ret_from_fork+0x2c/0x50

One can enable CONFIG_NET_HANDSHAKE_KUNIT_TEST config to reproduce above
crash.

The root cause of this bug is that the commit 1ce77c998f04
("net/handshake: Unpin sock->file if a handshake is cancelled") adds one
additional fput() function. That patch claims that the fput() is used to
enable sock->file to be freed even when user space never calls DONE.

However, it seems that the intended DONE routine will never give an
additional fput() of ths sock->file. The existing two of them are just
used to balance the reference added in sockfd_lookup().

This patch revert the mentioned commit to avoid the use-after-free. The
patched kernel could successfully pass the KUNIT test and boot to shell.

[    0.733613]     # Subtest: Handshake API tests
[    0.734029]     1..11
[    0.734255]         KTAP version 1
[    0.734542]         # Subtest: req_alloc API fuzzing
[    0.736104]         ok 1 handshake_req_alloc NULL proto
[    0.736114]         ok 2 handshake_req_alloc CLASS_NONE
[    0.736559]         ok 3 handshake_req_alloc CLASS_MAX
[    0.737020]         ok 4 handshake_req_alloc no callbacks
[    0.737488]         ok 5 handshake_req_alloc no done callback
[    0.737988]         ok 6 handshake_req_alloc excessive privsize
[    0.738529]         ok 7 handshake_req_alloc all good
[    0.739036]     # req_alloc API fuzzing: pass:7 fail:0 skip:0 total:7
[    0.739444]     ok 1 req_alloc API fuzzing
[    0.740065]     ok 2 req_submit NULL req arg
[    0.740436]     ok 3 req_submit NULL sock arg
[    0.740834]     ok 4 req_submit NULL sock->file
[    0.741236]     ok 5 req_lookup works
[    0.741621]     ok 6 req_submit max pending
[    0.741974]     ok 7 req_submit multiple
[    0.742382]     ok 8 req_cancel before accept
[    0.742764]     ok 9 req_cancel after accept
[    0.743151]     ok 10 req_cancel after done
[    0.743510]     ok 11 req_destroy works
[    0.743882] # Handshake API tests: pass:11 fail:0 skip:0 total:11
[    0.744205] # Totals: pass:17 fail:0 skip:0 total:17

Acked-by: Chuck Lever 
Fixes: 1ce77c998f04 ("net/handshake: Unpin sock->file if a handshake is cancelled")
Signed-off-by: Lin Ma 
Link: https://lore.kernel.org/r/20230613083204.633896-1-linma@zju.edu.cn
Link: https://lore.kernel.org/r/20230614015249.987448-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski

net: ynl: prefix uAPI header include with uapi/

2023-05-26T09:30:14+00:00

To keep things simple we used to include the uAPI header
in the kernel in the #include  format.
This works well enough, most of the genl families should
have headers in include/net/ so linux/$family.h ends up
referring to the uAPI header, anyway. And if it doesn't
no big deal, we'll just include more info than we need.

Unless that is there is a naming conflict. Someone recently
created include/linux/psp.h which will be a problem when
supporting the PSP protocol. (I'm talking about
work-in-progress patches, but it's just a proof that assuming
lack of name conflicts was overly optimistic.)

Signed-off-by: Jakub Kicinski 
Reviewed-by: Simon Horman 
Signed-off-by: David S. Miller

net/handshake: Enable the SNI extension to work properly

2023-05-25T05:05:24+00:00

Enable the upper layer protocol to specify the SNI peername. This
avoids the need for tlshd to use a DNS lookup, which can return a
hostname that doesn't match the incoming certificate's SubjectName.

Fixes: 2fd5532044a8 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake")
Reviewed-by: Simon Horman 
Signed-off-by: Chuck Lever 
Signed-off-by: Jakub Kicinski