Patch "ping: Fix potentail NULL deref for /proc/net/icmp." has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ping: Fix potentail NULL deref for /proc/net/icmp.

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ping-fix-potentail-null-deref-for-proc-net-icmp.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9466b95455a98765b0364b6da11f2793bd52a0e3
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date:   Mon Apr 3 12:49:59 2023 -0700

    ping: Fix potentail NULL deref for /proc/net/icmp.
    
    [ Upstream commit ab5fb73ffa01072b4d8031cc05801fa1cb653bee ]
    
    After commit dbca1596bbb0 ("ping: convert to RCU lookups, get rid
    of rwlock"), we use RCU for ping sockets, but we should use spinlock
    for /proc/net/icmp to avoid a potential NULL deref mentioned in
    the previous patch.
    
    Let's go back to using spinlock there.
    
    Note we can convert ping sockets to use hlist instead of hlist_nulls
    because we do not use SLAB_TYPESAFE_BY_RCU for ping sockets.
    
    Fixes: dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 409ec2a1f95b0..5178a3f3cb537 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -1089,13 +1089,13 @@ static struct sock *ping_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 void *ping_seq_start(struct seq_file *seq, loff_t *pos, sa_family_t family)
-	__acquires(RCU)
+	__acquires(ping_table.lock)
 {
 	struct ping_iter_state *state = seq->private;
 	state->bucket = 0;
 	state->family = family;
 
-	rcu_read_lock();
+	spin_lock(&ping_table.lock);
 
 	return *pos ? ping_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
@@ -1121,9 +1121,9 @@ void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 EXPORT_SYMBOL_GPL(ping_seq_next);
 
 void ping_seq_stop(struct seq_file *seq, void *v)
-	__releases(RCU)
+	__releases(ping_table.lock)
 {
-	rcu_read_unlock();
+	spin_unlock(&ping_table.lock);
 }
 EXPORT_SYMBOL_GPL(ping_seq_stop);