Commit d878395f authored by Eric Dumazet's avatar Eric Dumazet Committed by Wang Liang
Browse files

tcp/dccp: do not care about families in inet_twsk_purge() 

stable inclusion
from stable-v6.6.48
commit 7348061662c7149b81e38e545d5dd6bd427bec81
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZW
CVE: CVE-2024-44991

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7348061662c7149b81e38e545d5dd6bd427bec81



--------------------------------

[ Upstream commit 1eeb5043573981f3a1278876515851b7f6b1df1b ]

We lost ability to unload ipv6 module a long time ago.

Instead of calling expensive inet_twsk_purge() twice,
we can handle all families in one round.

Also remove an extra line added in my prior patch,
per Kuniyuki Iwashima feedback.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/netdev/20240327192934.6843-1-kuniyu@amazon.com/


Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240329153203.345203-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Stable-dep-of: 565d121b6998 ("tcp: prevent concurrent execution of tcp_sk_exit_batch")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWang Liang <wangliang74@huawei.com>
parent 375d9696

include/net/inet_timewait_sock.h

+1 −1
Original line number Diff line number Diff line
@@ -114,7 +114,7 @@ static inline void inet_twsk_reschedule(struct inet_timewait_sock *tw, int timeo 


void inet_twsk_deschedule_put(struct inet_timewait_sock *tw);



void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family);

void inet_twsk_purge(struct inet_hashinfo *hashinfo);



static inline

struct net *twsk_net(const struct inet_timewait_sock *twsk)

include/net/tcp.h

+1 −1
Original line number Diff line number Diff line
@@ -349,7 +349,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb); 
void tcp_rcv_space_adjust(struct sock *sk);

int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp);

void tcp_twsk_destructor(struct sock *sk);

void tcp_twsk_purge(struct list_head *net_exit_list, int family);

void tcp_twsk_purge(struct list_head *net_exit_list);

ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos,

			struct pipe_inode_info *pipe, size_t len,

			unsigned int flags);

net/dccp/ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -1042,7 +1042,7 @@ static void __net_exit dccp_v4_exit_net(struct net *net) 


static void __net_exit dccp_v4_exit_batch(struct list_head *net_exit_list)

{

	inet_twsk_purge(&dccp_hashinfo, AF_INET);

	inet_twsk_purge(&dccp_hashinfo);

}



static struct pernet_operations dccp_v4_ops = {

net/dccp/ipv6.c

+0 −6
Original line number Diff line number Diff line
@@ -1122,15 +1122,9 @@ static void __net_exit dccp_v6_exit_net(struct net *net) 
	inet_ctl_sock_destroy(pn->v6_ctl_sk);

}



static void __net_exit dccp_v6_exit_batch(struct list_head *net_exit_list)

{

	inet_twsk_purge(&dccp_hashinfo, AF_INET6);

}



static struct pernet_operations dccp_v6_ops = {

	.init   = dccp_v6_init_net,

	.exit   = dccp_v6_exit_net,

	.exit_batch = dccp_v6_exit_batch,

	.id	= &dccp_v6_pernet_id,

	.size   = sizeof(struct dccp_v6_pernet),

};

net/ipv4/inet_timewait_sock.c

+3 −6
Original line number Diff line number Diff line
@@ -279,7 +279,7 @@ void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo, bool rearm) 
EXPORT_SYMBOL_GPL(__inet_twsk_schedule);



/* Remove all non full sockets (TIME_WAIT and NEW_SYN_RECV) for dead netns */

void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family)

void inet_twsk_purge(struct inet_hashinfo *hashinfo)

{

	struct inet_ehash_bucket *head = &hashinfo->ehash[0];

	unsigned int ehash_mask = hashinfo->ehash_mask;
@@ -288,7 +288,6 @@ void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family) 
	struct sock *sk;



	for (slot = 0; slot <= ehash_mask; slot++, head++) {



		if (hlist_nulls_empty(&head->chain))

			continue;
@@ -303,15 +302,13 @@ void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family) 
					     TCPF_NEW_SYN_RECV))

				continue;



			if (sk->sk_family != family ||

			    refcount_read(&sock_net(sk)->ns.count))

			if (refcount_read(&sock_net(sk)->ns.count))

				continue;



			if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))

				continue;



			if (unlikely(sk->sk_family != family ||

				     refcount_read(&sock_net(sk)->ns.count))) {

			if (refcount_read(&sock_net(sk)->ns.count)) {

				sock_gen_put(sk);

				goto restart;

			}