Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7fc9d47 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Greg Kroah-Hartman
Browse files

packet: Move reference count in packet_sock to atomic_long_t 



commit db3fadacaf0c817b222090290d06ca2a338422d0 upstream.

In some potential instances the reference count on struct packet_sock
could be saturated and cause overflows which gets the kernel a bit
confused. To prevent this, move to a 64-bit atomic reference count on
64-bit architectures to prevent the possibility of this type to overflow.

Because we can not handle saturation, using refcount_t is not possible
in this place. Maybe someday in the future if it changes it could be
used. Also, instead of using plain atomic64_t, use atomic_long_t instead.
32-bit machines tend to be memory-limited (i.e. anything that increases
a reference uses so much memory that you can't actually get to 2**32
references). 32-bit architectures also tend to have serious problems
with 64-bit atomics. Hence, atomic_long_t is the more natural solution.

Reported-by: default avatar"The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Co-developed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@kernel.org
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231201131021.19999-1-daniel@iogearbox.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 25f8c84d

net/packet/af_packet.c

+8 −8
Original line number Diff line number Diff line
@@ -4214,7 +4214,7 @@ static void packet_mm_open(struct vm_area_struct *vma) 
	struct sock *sk = sock->sk;



	if (sk)

		atomic_inc(&pkt_sk(sk)->mapped);

		atomic_long_inc(&pkt_sk(sk)->mapped);

}



static void packet_mm_close(struct vm_area_struct *vma)
@@ -4224,7 +4224,7 @@ static void packet_mm_close(struct vm_area_struct *vma) 
	struct sock *sk = sock->sk;



	if (sk)

		atomic_dec(&pkt_sk(sk)->mapped);

		atomic_long_dec(&pkt_sk(sk)->mapped);

}



static const struct vm_operations_struct packet_mmap_ops = {
@@ -4319,7 +4319,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, 


	err = -EBUSY;

	if (!closing) {

		if (atomic_read(&po->mapped))

		if (atomic_long_read(&po->mapped))

			goto out;

		if (packet_read_pending(rb))

			goto out;
@@ -4422,7 +4422,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, 


	err = -EBUSY;

	mutex_lock(&po->pg_vec_lock);

	if (closing || atomic_read(&po->mapped) == 0) {

	if (closing || atomic_long_read(&po->mapped) == 0) {

		err = 0;

		spin_lock_bh(&rb_queue->lock);

		swap(rb->pg_vec, pg_vec);
@@ -4440,9 +4440,9 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, 
		po->prot_hook.func = (po->rx_ring.pg_vec) ?

						tpacket_rcv : packet_rcv;

		skb_queue_purge(rb_queue);

		if (atomic_read(&po->mapped))

			pr_err("packet_mmap: vma is busy: %d\n",

			       atomic_read(&po->mapped));

		if (atomic_long_read(&po->mapped))

			pr_err("packet_mmap: vma is busy: %ld\n",

			       atomic_long_read(&po->mapped));

	}

	mutex_unlock(&po->pg_vec_lock);
@@ -4520,7 +4520,7 @@ static int packet_mmap(struct file *file, struct socket *sock, 
		}

	}



	atomic_inc(&po->mapped);

	atomic_long_inc(&po->mapped);

	vma->vm_ops = &packet_mmap_ops;

	err = 0;

net/packet/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -125,7 +125,7 @@ struct packet_sock { 
	__be16			num;

	struct packet_rollover	*rollover;

	struct packet_mclist	*mclist;

	atomic_t		mapped;

	atomic_long_t		mapped;

	enum tpacket_versions	tp_version;

	unsigned int		tp_hdrlen;

	unsigned int		tp_reserve;