Patch "net: do not keep the dst cache when uncloning an skb dst and its metadata" has been added to the 4.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: do not keep the dst cache when uncloning an skb dst and its metadata

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-do-not-keep-the-dst-cache-when-uncloning-an-skb-.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ff0ce481d7afc00d984aed052b9360b4b30a40c8
Author: Antoine Tenart <atenart@xxxxxxxxxx>
Date:   Mon Feb 7 18:13:18 2022 +0100

    net: do not keep the dst cache when uncloning an skb dst and its metadata
    
    [ Upstream commit cfc56f85e72f5b9c5c5be26dc2b16518d36a7868 ]
    
    When uncloning an skb dst and its associated metadata a new dst+metadata
    is allocated and the tunnel information from the old metadata is copied
    over there.
    
    The issue is the tunnel metadata has references to cached dst, which are
    copied along the way. When a dst+metadata refcount drops to 0 the
    metadata is freed including the cached dst entries. As they are also
    referenced in the initial dst+metadata, this ends up in UaFs.
    
    In practice the above did not happen because of another issue, the
    dst+metadata was never freed because its refcount never dropped to 0
    (this will be fixed in a subsequent patch).
    
    Fix this by initializing the dst cache after copying the tunnel
    information from the old metadata to also unshare the dst cache.
    
    Fixes: d71785ffc7e7 ("net: add dst_cache to ovs vxlan lwtunnel")
    Cc: Paolo Abeni <pabeni@xxxxxxxxxx>
    Reported-by: Vlad Buslov <vladbu@xxxxxxxxxx>
    Tested-by: Vlad Buslov <vladbu@xxxxxxxxxx>
    Signed-off-by: Antoine Tenart <atenart@xxxxxxxxxx>
    Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
index 5a23535a5018d..33ca53057f318 100644
--- a/include/net/dst_metadata.h
+++ b/include/net/dst_metadata.h
@@ -97,6 +97,19 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb)
 
 	memcpy(&new_md->u.tun_info, &md_dst->u.tun_info,
 	       sizeof(struct ip_tunnel_info) + md_size);
+#ifdef CONFIG_DST_CACHE
+	/* Unclone the dst cache if there is one */
+	if (new_md->u.tun_info.dst_cache.cache) {
+		int ret;
+
+		ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC);
+		if (ret) {
+			metadata_dst_free(new_md);
+			return ERR_PTR(ret);
+		}
+	}
+#endif
+
 	skb_dst_drop(skb);
 	dst_hold(&new_md->dst);
 	skb_dst_set(skb, &new_md->dst);