packet: Move reference count in packet_sock to atomic_long_t
authorDaniel Borkmann <daniel@iogearbox.net>
Fri, 1 Dec 2023 13:10:21 +0000 (14:10 +0100)
committerJakub Kicinski <kuba@kernel.org>
Mon, 4 Dec 2023 22:45:04 +0000 (14:45 -0800)
commitdb3fadacaf0c817b222090290d06ca2a338422d0
treefdb8486356876ce4dbdfc16bb4b95b3e303d4b5f
parent79321a793945fdbff2f405f84712d0ab81bed287
packet: Move reference count in packet_sock to atomic_long_t

In some potential instances the reference count on struct packet_sock
could be saturated and cause overflows which gets the kernel a bit
confused. To prevent this, move to a 64-bit atomic reference count on
64-bit architectures to prevent the possibility of this type to overflow.

Because we can not handle saturation, using refcount_t is not possible
in this place. Maybe someday in the future if it changes it could be
used. Also, instead of using plain atomic64_t, use atomic_long_t instead.
32-bit machines tend to be memory-limited (i.e. anything that increases
a reference uses so much memory that you can't actually get to 2**32
references). 32-bit architectures also tend to have serious problems
with 64-bit atomics. Hence, atomic_long_t is the more natural solution.

Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Co-developed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231201131021.19999-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/packet/af_packet.c
net/packet/internal.h