Skip to content

Conversation

@palash-gandhi
Copy link
Contributor

@palash-gandhi palash-gandhi commented Oct 24, 2024

This change cherry-picks the Delphix patch set from develop onto a branch forked off of upstreams/os-upgrade. upstreams/os-upgrade currently has commits from Linux kernel 6.8, the version that ships with Ubuntu 24.04. I ran the following command to perform the cherry-pick:

git cherry-pick 102db3bf9c23a6415716c03edad77f066fb8ed52^..5c74cf868341e44828bcd03f61c8fb9340f6f10a

Here's the actual diff between upstreams/os-upgrade and os-upgrade: upstreams/os-upgrade...dlpx/pr/palash.gandhi/gcp

Additional changes that were required:

build-package: https://ops-jenkins.eng-tools-prd.aws.delphixcloud.com/job/linux-pkg/job/os-upgrade/job/build-package/job/linux-kernel-gcp/job/pre-push/4/console

mdiewa and others added 30 commits August 29, 2024 15:55
Ignore: yes
Signed-off-by: Manuel Diewald <[email protected]>
BugLink: https://bugs.launchpad.net/bugs/2078100
Properties: no-test-build
Signed-off-by: Manuel Diewald <[email protected]>
Signed-off-by: Manuel Diewald <[email protected]>
There is a bug in netem_enqueue() introduced by
commit 5845f70 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec")
that can lead to a use-after-free.

This commit made netem_enqueue() always return NET_XMIT_SUCCESS
when a packet is duplicated, which can cause the parent qdisc's q.qlen
to be mistakenly incremented. When this happens qlen_notify() may be
skipped on the parent during destruction, leaving a dangling pointer
for some classful qdiscs like DRR.

There are two ways for the bug happen:

- If the duplicated packet is dropped by rootq->enqueue() and then
  the original packet is also dropped.
- If rootq->enqueue() sends the duplicated packet to a different qdisc
  and the original packet is dropped.

In both cases NET_XMIT_SUCCESS is returned even though no packets
are enqueued at the netem qdisc.

The fix is to defer the enqueue of the duplicate packet until after
the original packet has been guaranteed to return NET_XMIT_SUCCESS.

Fixes: 5845f70 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec")
Reported-by: Budimir Markovic <[email protected]>
Signed-off-by: Stephen Hemminger <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

CVE-2024-45016
(cherry picked from commit c07ff85)
Signed-off-by: Ian Whitfield <[email protected]>
Acked-by: Magali Lemes <[email protected]>
Acked-by: Jacob Martin <[email protected]>
Signed-off-by: Stefan Bader <[email protected]>
Ignore: yes
Signed-off-by: Manuel Diewald <[email protected]>
BugLink: https://bugs.launchpad.net/bugs/2082118
Properties: no-test-build
Signed-off-by: Manuel Diewald <[email protected]>
Signed-off-by: Manuel Diewald <[email protected]>
Remove unnecessary annotations, clean up the annotations file

Signed-off-by: Khalid Elmously <[email protected]>
Ignore: yes
Signed-off-by: Khalid Elmously <[email protected]>
BugLink: https://bugs.launchpad.net/bugs/1960473
Properties: no-test-build
Signed-off-by: Khalid Elmously <[email protected]>
Ignore: yes
Signed-off-by: Khalid Elmously <[email protected]>
Ignore: yes
Signed-off-by: Khalid Elmously <[email protected]>
BugLink: https://bugs.launchpad.net/bugs/1965077
Properties: no-test-build
Signed-off-by: Khalid Elmously <[email protected]>
Remove x86 cruft

Ignore: yes
Signed-off-by: Khalid Elmously <[email protected]>
Ignore: yes
Signed-off-by: Paolo Pisati <[email protected]>
khbecker and others added 21 commits October 4, 2024 16:36
BugLink: https://bugs.launchpad.net/bugs/2082094
Properties: no-test-build
Signed-off-by: Kevin Becker <[email protected]>
This is a placeholder commit to separate the Ubuntu kernel source and
our patches. Used by kernel_merge_with_upstream() in the linux-pkg repo.
)

Link: https://lore.kernel.org/r/[email protected]

Signed-off-by: Dmitry Bogdanov <[email protected]>
Signed-off-by: Mike Christie <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Co-authored-by: Dmitry Bogdanov <[email protected]>
@palash-gandhi palash-gandhi marked this pull request as ready for review October 24, 2024 06:07
@palash-gandhi palash-gandhi changed the title Cherry-pick Delphix commits of linux-kernel-gcp for LTS upgrade DLPX-92457 Cherry-pick Delphix commits of linux-kernel-gcp for LTS upgrade Oct 24, 2024
@palash-gandhi
Copy link
Contributor Author

This was in fact merged into os-upgrade. This PR's base was incorrectly set to develop. Closed this manually.

@palash-gandhi palash-gandhi deleted the dlpx/pr/palash.gandhi/gcp branch October 24, 2024 23:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet