From patchwork Thu Jan 27 18:09:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 537573 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9E02C433F5 for ; Thu, 27 Jan 2022 18:10:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244869AbiA0SKb (ORCPT ); Thu, 27 Jan 2022 13:10:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245097AbiA0SKG (ORCPT ); Thu, 27 Jan 2022 13:10:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 681A4C06175E; Thu, 27 Jan 2022 10:09:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0792061998; Thu, 27 Jan 2022 18:09:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFBF7C340E8; Thu, 27 Jan 2022 18:09:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643306973; bh=cTzy/uUSa4SbHM+Sg65a3vUrWjXyn+gy5N/7gXWhp/w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1xtbrkqICQenRVWrbg2ujnhODqnOwR5v2ilynetkPKdDk5J7V4a5UUtJZec8XPkCV I25kgo992H7KzQcP3AclSsgxdXJUOrkoHThO15jrwgQ4i8JRu6R92OPCkdUxNFnqKp PCjL9ECw8+Si6dySXSJ37vb6En1aOczhgcs/cin0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nikolay Aleksandrov , "David S. Miller" , Huang Guobin Subject: [PATCH 4.19 2/3] net: bridge: clear bridges private skb space on xmit Date: Thu, 27 Jan 2022 19:09:02 +0100 Message-Id: <20220127180256.913580967@linuxfoundation.org> X-Mailer: git-send-email 2.35.0 In-Reply-To: <20220127180256.837257619@linuxfoundation.org> References: <20220127180256.837257619@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nikolay Aleksandrov commit fd65e5a95d08389444e8591a20538b3edece0e15 upstream. We need to clear all of the bridge private skb variables as they can be stale due to the packet being recirculated through the stack and then transmitted through the bridge device. Similar memset is already done on bridge's input. We've seen cases where proxyarp_replied was 1 on routed multicast packets transmitted through the bridge to ports with neigh suppress which were getting dropped. Same thing can in theory happen with the port isolation bit as well. Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller Signed-off-by: Huang Guobin Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_device.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff * struct ethhdr *eth; u16 vid = 0; + memset(skb->cb, 0, sizeof(struct br_input_skb_cb)); + rcu_read_lock(); nf_ops = rcu_dereference(nf_br_ops); if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) { From patchwork Thu Jan 27 18:09:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 537576 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0166C433F5 for ; Thu, 27 Jan 2022 18:10:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244846AbiA0SKM (ORCPT ); Thu, 27 Jan 2022 13:10:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245135AbiA0SJq (ORCPT ); Thu, 27 Jan 2022 13:09:46 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABDCBC06175D; Thu, 27 Jan 2022 10:09:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6ADA2B820C8; Thu, 27 Jan 2022 18:09:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9376CC340E4; Thu, 27 Jan 2022 18:09:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643306970; bh=EmDU9pBT/xPBJnM3VVz+DnGxxc7WqCOmuKLje9v9Pug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aetIdn9Ew+pulrCIZ9Km7apsnhUSxk8qVb0CMqajSMeR/xLyQqxagVBmu96ebt9yN Xgaz+FgCyfIuI0IrU/aiPt5/ar8EjKKoGOz6JsRviNPOIUjdxwH7mQnf6xnjHuHX3w shmIBbfLyumYAqUcAV2JfqCj8Mb3u2DC0KsJj2TY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Jan Kara Subject: [PATCH 4.19 3/3] select: Fix indefinitely sleeping task in poll_schedule_timeout() Date: Thu, 27 Jan 2022 19:09:03 +0100 Message-Id: <20220127180256.943514512@linuxfoundation.org> X-Mailer: git-send-email 2.35.0 In-Reply-To: <20220127180256.837257619@linuxfoundation.org> References: <20220127180256.837257619@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Kara commit 68514dacf2715d11b91ca50d88de047c086fea9c upstream. A task can end up indefinitely sleeping in do_select() -> poll_schedule_timeout() when the following race happens: TASK1 (thread1) TASK2 TASK1 (thread2) do_select() setup poll_wqueues table with 'fd' write data to 'fd' pollwake() table->triggered = 1 closes 'fd' thread1 is waiting for poll_schedule_timeout() - sees table->triggered table->triggered = 0 return -EINTR loop back in do_select() But at this point when TASK1 loops back, the fdget() in the setup of poll_wqueues fails. So now so we never find 'fd' is ready for reading and sleep in poll_schedule_timeout() indefinitely. Treat an fd that got closed as a fd on which some event happened. This makes sure cannot block indefinitely in do_select(). Another option would be to return -EBADF in this case but that has a potential of subtly breaking applications that excercise this behavior and it happens to work for them. So returning fd as active seems like a safer choice. Suggested-by: Linus Torvalds CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/select.c | 63 +++++++++++++++++++++++++++++++----------------------------- 1 file changed, 33 insertions(+), 30 deletions(-) --- a/fs/select.c +++ b/fs/select.c @@ -431,9 +431,11 @@ get_max: return max; } -#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR) -#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR) -#define POLLEX_SET (EPOLLPRI) +#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR |\ + EPOLLNVAL) +#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR |\ + EPOLLNVAL) +#define POLLEX_SET (EPOLLPRI | EPOLLNVAL) static inline void wait_key_set(poll_table *wait, unsigned long in, unsigned long out, unsigned long bit, @@ -500,6 +502,7 @@ static int do_select(int n, fd_set_bits break; if (!(bit & all_bits)) continue; + mask = EPOLLNVAL; f = fdget(i); if (f.file) { wait_key_set(wait, in, out, bit, @@ -507,34 +510,34 @@ static int do_select(int n, fd_set_bits mask = vfs_poll(f.file, wait); fdput(f); - if ((mask & POLLIN_SET) && (in & bit)) { - res_in |= bit; - retval++; - wait->_qproc = NULL; - } - if ((mask & POLLOUT_SET) && (out & bit)) { - res_out |= bit; - retval++; - wait->_qproc = NULL; - } - if ((mask & POLLEX_SET) && (ex & bit)) { - res_ex |= bit; - retval++; - wait->_qproc = NULL; - } - /* got something, stop busy polling */ - if (retval) { - can_busy_loop = false; - busy_flag = 0; - - /* - * only remember a returned - * POLL_BUSY_LOOP if we asked for it - */ - } else if (busy_flag & mask) - can_busy_loop = true; - } + if ((mask & POLLIN_SET) && (in & bit)) { + res_in |= bit; + retval++; + wait->_qproc = NULL; + } + if ((mask & POLLOUT_SET) && (out & bit)) { + res_out |= bit; + retval++; + wait->_qproc = NULL; + } + if ((mask & POLLEX_SET) && (ex & bit)) { + res_ex |= bit; + retval++; + wait->_qproc = NULL; + } + /* got something, stop busy polling */ + if (retval) { + can_busy_loop = false; + busy_flag = 0; + + /* + * only remember a returned + * POLL_BUSY_LOOP if we asked for it + */ + } else if (busy_flag & mask) + can_busy_loop = true; + } if (res_in) *rinp = res_in;