linux.git/net/socket.c, branch v5.19

net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()

2022-06-24T03:56:23+00:00

syzbot reported uninit-value in tcp_recvmsg() [1]

Issue here is that msg->msg_get_inq should have been cleared,
otherwise tcp_recvmsg() might read garbage and perform
more work than needed, or have undefined behavior.

Given CONFIG_INIT_STACK_ALL_ZERO=y is probably going to be
the default soon, I chose to change __sys_recvfrom() to clear
all fields but msghdr.addr which might be not NULL.

For __copy_msghdr_from_user(), I added an explicit clear
of kmsg->msg_get_inq.

[1]
BUG: KMSAN: uninit-value in tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
inet_recvmsg+0x13a/0x5a0 net/ipv4/af_inet.c:850
sock_recvmsg_nosec net/socket.c:995 [inline]
sock_recvmsg net/socket.c:1013 [inline]
__sys_recvfrom+0x696/0x900 net/socket.c:2176
__do_sys_recvfrom net/socket.c:2194 [inline]
__se_sys_recvfrom net/socket.c:2190 [inline]
__x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Local variable msg created at:
__sys_recvfrom+0x81/0x900 net/socket.c:2154
__do_sys_recvfrom net/socket.c:2194 [inline]
__se_sys_recvfrom net/socket.c:2190 [inline]
__x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190

CPU: 0 PID: 3493 Comm: syz-executor170 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive")
Reported-by: syzbot 
Signed-off-by: Eric Dumazet 
Reviewed-by: Jens Axboe 
Tested-by: Alexander Potapenko
Link: https://lore.kernel.org/r/20220622150220.1091182-1-edumazet@google.com
Signed-off-by: Jakub Kicinski

Merge tag 'net-next-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2022-05-25T19:22:58+00:00

Pull networking updates from Jakub Kicinski:
"Core
----

- Support TCPv6 segmentation offload with super-segments larger than
64k bytes using the IPv6 Jumbogram extension header (AKA BIG TCP).

- Generalize skb freeing deferral to per-cpu lists, instead of
per-socket lists.

- Add a netdev statistic for packets dropped due to L2 address
mismatch (rx_otherhost_dropped).

- Continue work annotating skb drop reasons.

- Accept alternative netdev names (ALT_IFNAME) in more netlink
requests.

- Add VLAN support for AF_PACKET SOCK_RAW GSO.

- Allow receiving skb mark from the socket as a cmsg.

- Enable memcg accounting for veth queues, sysctl tables and IPv6.

BPF
---

- Add libbpf support for User Statically-Defined Tracing (USDTs).

- Speed up symbol resolution for kprobes multi-link attachments.

- Support storing typed pointers to referenced and unreferenced
objects in BPF maps.

- Add support for BPF link iterator.

- Introduce access to remote CPU map elements in BPF per-cpu map.

- Allow middle-of-the-road settings for the
kernel.unprivileged_bpf_disabled sysctl.

- Implement basic types of dynamic pointers e.g. to allow for
dynamically sized ringbuf reservations without extra memory copies.

Protocols
---------

- Retire port only listening_hash table, add a second bind table
hashed by port and address. Avoid linear list walk when binding to
very popular ports (e.g. 443).

- Add bridge FDB bulk flush filtering support allowing user space to
remove all FDB entries matching a condition.

- Introduce accept_unsolicited_na sysctl for IPv6 to implement
router-side changes for RFC9131.

- Support for MPTCP path manager in user space.

- Add MPTCP support for fallback to regular TCP for connections that
have never connected additional subflows or transmitted
out-of-sequence data (partial support for RFC8684 fallback).

- Avoid races in MPTCP-level window tracking, stabilize and improve
throughput.

- Support lockless operation of GRE tunnels with seq numbers enabled.

- WiFi support for host based BSS color collision detection.

- Add support for SO_TXTIME/SCM_TXTIME on CAN sockets.

- Support transmission w/o flow control in CAN ISOTP (ISO 15765-2).

- Support zero-copy Tx with TLS 1.2 crypto offload (sendfile).

- Allow matching on the number of VLAN tags via tc-flower.

- Add tracepoint for tcp_set_ca_state().

Driver API
----------

- Improve error reporting from classifier and action offload.

- Add support for listing line cards in switches (devlink).

- Add helpers for reporting page pool statistics with ethtool -S.

- Add support for reading clock cycles when using PTP virtual clocks,
instead of having the driver convert to time before reporting. This
makes it possible to report time from different vclocks.

- Support configuring low-latency Tx descriptor push via ethtool.

- Separate Clause 22 and Clause 45 MDIO accesses more explicitly.

New hardware / drivers
----------------------

- Ethernet:
- Marvell's Octeon NIC PCI Endpoint support (octeon_ep)
- Sunplus SP7021 SoC (sp7021_emac)
- Add support for Renesas RZ/V2M (in ravb)
- Add support for MediaTek mt7986 switches (in mtk_eth_soc)

- Ethernet PHYs:
- ADIN1100 industrial PHYs (w/ 10BASE-T1L and SQI reporting)
- TI DP83TD510 PHY
- Microchip LAN8742/LAN88xx PHYs

- WiFi:
- Driver for pureLiFi X, XL, XC devices (plfxlc)
- Driver for Silicon Labs devices (wfx)
- Support for WCN6750 (in ath11k)
- Support Realtek 8852ce devices (in rtw89)

- Mobile:
- MediaTek T700 modems (Intel 5G 5000 M.2 cards)

- CAN:
- ctucanfd: add support for CTU CAN FD open-source IP core from
Czech Technical University in Prague

Drivers
-------

- Delete a number of old drivers still using virt_to_bus().

- Ethernet NICs:
- intel: support TSO on tunnels MPLS
- broadcom: support multi-buffer XDP
- nfp: support VF rate limiting
- sfc: use hardware tx timestamps for more than PTP
- mlx5: multi-port eswitch support
- hyper-v: add support for XDP_REDIRECT
- atlantic: XDP support (including multi-buffer)
- macb: improve real-time perf by deferring Tx processing to NAPI

- High-speed Ethernet switches:
- mlxsw: implement basic line card information querying
- prestera: add support for traffic policing on ingress and egress

- Embedded Ethernet switches:
- lan966x: add support for packet DMA (FDMA)
- lan966x: add support for PTP programmable pins
- ti: cpsw_new: enable bc/mc storm prevention

- Qualcomm 802.11ax WiFi (ath11k):
- Wake-on-WLAN support for QCA6390 and WCN6855
- device recovery (firmware restart) support
- support setting Specific Absorption Rate (SAR) for WCN6855
- read country code from SMBIOS for WCN6855/QCA6390
- enable keep-alive during WoWLAN suspend
- implement remain-on-channel support

- MediaTek WiFi (mt76):
- support Wireless Ethernet Dispatch offloading packet movement
between the Ethernet switch and WiFi interfaces
- non-standard VHT MCS10-11 support
- mt7921 AP mode support
- mt7921 IPv6 NS offload support

- Ethernet PHYs:
- micrel: ksz9031/ksz9131: cabletest support
- lan87xx: SQI support for T1 PHYs
- lan937x: add interrupt support for link detection"

* tag 'net-next-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1809 commits)
ptp: ocp: Add firmware header checks
ptp: ocp: fix PPS source selector debugfs reporting
ptp: ocp: add .init function for sma_op vector
ptp: ocp: vectorize the sma accessor functions
ptp: ocp: constify selectors
ptp: ocp: parameterize input/output sma selectors
ptp: ocp: revise firmware display
ptp: ocp: add Celestica timecard PCI ids
ptp: ocp: Remove #ifdefs around PCI IDs
ptp: ocp: 32-bit fixups for pci start address
Revert "net/smc: fix listen processing for SMC-Rv2"
ath6kl: Use cc-disable-warning to disable -Wdangling-pointer
selftests/bpf: Dynptr tests
bpf: Add dynptr data slices
bpf: Add bpf_dynptr_read and bpf_dynptr_write
bpf: Dynptr support for ring buffers
bpf: Add bpf_dynptr_from_mem for local dynptrs
bpf: Add verifier support for dynptrs
bpf: Suppress 'passing zero to PTR_ERR' warning
bpf: Introduce bpf_arch_text_invalidate for bpf_prog_pack
...

ptp: Support late timestamp determination

2022-05-10T07:48:08+00:00

If a physical clock supports a free running cycle counter, then
timestamps shall be based on this time too. For TX it is known in
advance before the transmission if a timestamp based on the free running
cycle counter is needed. For RX it is impossible to know which timestamp
is needed before the packet is received and assigned to a socket.

Support late timestamp determination by a network device. Therefore, an
address/cookie is stored within the new netdev_data field of struct
skb_shared_hwtstamps. This address/cookie is provided to a new network
device function called ndo_get_tstamp(), which returns a timestamp based
on the normal/adjustable time or based on the free running cycle
counter. If function is not supported, then timestamp handling is not
changed.

This mechanism is intended for RX, but TX use is also possible.

Signed-off-by: Gerhard Engleder 
Acked-by: Jonathan Lemon 
Acked-by: Richard Cochran 
Signed-off-by: Paolo Abeni

ptp: Pass hwtstamp to ptp_convert_timestamp()

2022-05-10T07:48:08+00:00

ptp_convert_timestamp() converts only the timestamp hwtstamp, which is
a field of the argument with the type struct skb_shared_hwtstamps *. So
a pointer to the hwtstamp field of this structure is sufficient.

Rework ptp_convert_timestamp() to use an argument of type ktime_t *.
This allows to add additional timestamp manipulation stages before the
call of ptp_convert_timestamp().

Signed-off-by: Gerhard Engleder 
Acked-by: Richard Cochran 
Signed-off-by: Paolo Abeni

ptp: Request cycles for TX timestamp

2022-05-10T07:48:08+00:00

The free running cycle counter of physical clocks called cycles shall be
used for hardware timestamps to enable synchronisation.

Introduce new flag SKBTX_HW_TSTAMP_USE_CYCLES, which signals driver to
provide a TX timestamp based on cycles if cycles are supported.

Signed-off-by: Gerhard Engleder 
Acked-by: Richard Cochran 
Signed-off-by: Paolo Abeni

net: SO_RCVMARK socket option for SO_MARK with recvmsg()

2022-04-28T20:08:15+00:00

Adding a new socket option, SO_RCVMARK, to indicate that SO_MARK
should be included in the ancillary data returned by recvmsg().

Renamed the sock_recv_ts_and_drops() function to sock_recv_cmsgs().

Signed-off-by: Erin MacNeil 
Reviewed-by: Eric Dumazet 
Reviewed-by: David Ahern 
Acked-by: Marc Kleine-Budde 
Link: https://lore.kernel.org/r/20220427200259.2564-1-lnx.erin@gmail.com
Signed-off-by: Jakub Kicinski

net: add __sys_socket_file()

2022-04-25T00:19:21+00:00

This works like __sys_socket(), except instead of allocating and
returning a socket fd, it just returns the file associated with the
socket. No fd is installed into the process file table.

This is similar to do_accept(), and allows io_uring to use this without
instantiating a file descriptor in the process file table.

Signed-off-by: Jens Axboe 
Acked-by: David S. Miller 
Link: https://lore.kernel.org/r/20220412202240.234207-2-axboe@kernel.dk

fs: allocate inode by using alloc_inode_sb()

2022-03-22T22:57:03+00:00

The inode allocation is supposed to use alloc_inode_sb(), so convert
kmem_cache_alloc() of all filesystems to alloc_inode_sb().

Link: https://lkml.kernel.org/r/20220228122126.37293-5-songmuchun@bytedance.com
Signed-off-by: Muchun Song 
Acked-by: Theodore Ts'o 		[ext4]
Acked-by: Roman Gushchin 
Cc: Alex Shi 
Cc: Anna Schumaker 
Cc: Chao Yu 
Cc: Dave Chinner 
Cc: Fam Zheng 
Cc: Jaegeuk Kim 
Cc: Johannes Weiner 
Cc: Kari Argillander 
Cc: Matthew Wilcox (Oracle) 
Cc: Michal Hocko 
Cc: Qi Zheng 
Cc: Shakeel Butt 
Cc: Trond Myklebust 
Cc: Vladimir Davydov 
Cc: Vlastimil Babka 
Cc: Wei Yang 
Cc: Xiongchun Duan 
Cc: Yang Shi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

net: fix documentation for kernel_getsockname

2022-02-14T14:01:19+00:00

Fixes return value documentation of kernel_getsockname()
and kernel_getpeername() functions.

The previous documentation wrongly specified that the return
value is 0 in case of success, however sock->ops->getname returns
the length of the address in bytes in case of success.

Signed-off-by: Alex Maydanik 
Signed-off-by: David S. Miller

net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets

2022-01-06T12:18:08+00:00

When multiple sockets using the SOF_TIMESTAMPING_BIND_PHC flag received
a packet with a hardware timestamp (e.g. multiple PTP instances in
different PTP domains using the UDPv4/v6 multicast or L2 transport),
the timestamps received on some sockets were corrupted due to repeated
conversion of the same timestamp (by the same or different vclocks).

Fix ptp_convert_timestamp() to not modify the shared skb timestamp
and return the converted timestamp as a ktime_t instead. If the
conversion fails, return 0 to not confuse the application with
timestamps corresponding to an unexpected PHC.

Fixes: d7c088265588 ("net: socket: support hardware timestamp conversion to PHC bound")
Signed-off-by: Miroslav Lichvar 
Cc: Yangbo Lu 
Cc: Richard Cochran 
Acked-by: Richard Cochran 
Signed-off-by: David S. Miller