Browse code

kernels: Fix CVE-2023-42755

Signed-off-by: Keerthana K <keerthanak@vmware.com>
Change-Id: I4f17002140da7520a338347591a64ced0590d4fc
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/c/photon/+/21970
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/c/photon/+/22478

Keerthana K authored on 2023/09/25 17:40:49
Showing 11 changed files
1 1
new file mode 100644
... ...
@@ -0,0 +1,1102 @@
0
+From 265b4da82dbf5df04bee5a5d46b7474b1aaf326a Mon Sep 17 00:00:00 2001
1
+From: Jamal Hadi Salim <jhs@mojatatu.com>
2
+Date: Tue, 14 Feb 2023 08:49:15 -0500
3
+Subject: net/sched: Retire rsvp classifier
4
+
5
+From: Jamal Hadi Salim <jhs@mojatatu.com>
6
+
7
+commit 265b4da82dbf5df04bee5a5d46b7474b1aaf326a upstream.
8
+
9
+The rsvp classifier has served us well for about a quarter of a century but has
10
+has not been getting much maintenance attention due to lack of known users.
11
+
12
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
13
+Acked-by: Jiri Pirko <jiri@nvidia.com>
14
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
15
+Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
16
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
17
+
18
+---
19
+ net/sched/Kconfig                                             |   28 
20
+ net/sched/Makefile                                            |    2 
21
+ net/sched/cls_rsvp.c                                          |   24 
22
+ net/sched/cls_rsvp.h                                          |  764 ----------
23
+ net/sched/cls_rsvp6.c                                         |   24 
24
+ tools/testing/selftests/tc-testing/tc-tests/filters/rsvp.json |  203 --
25
+ 6 files changed, 1045 deletions(-)
26
+
27
+--- a/net/sched/Kconfig
28
+@@ -548,34 +548,6 @@ config CLS_U32_MARK
29
+ 	help
30
+ 	  Say Y here to be able to use netfilter marks as u32 key.
31
+ 
32
+-config NET_CLS_RSVP
33
+-	tristate "IPv4 Resource Reservation Protocol (RSVP)"
34
+-	select NET_CLS
35
+-	help
36
+-	  The Resource Reservation Protocol (RSVP) permits end systems to
37
+-	  request a minimum and maximum data flow rate for a connection; this
38
+-	  is important for real time data such as streaming sound or video.
39
+-
40
+-	  Say Y here if you want to be able to classify outgoing packets based
41
+-	  on their RSVP requests.
42
+-
43
+-	  To compile this code as a module, choose M here: the
44
+-	  module will be called cls_rsvp.
45
+-
46
+-config NET_CLS_RSVP6
47
+-	tristate "IPv6 Resource Reservation Protocol (RSVP6)"
48
+-	select NET_CLS
49
+-	help
50
+-	  The Resource Reservation Protocol (RSVP) permits end systems to
51
+-	  request a minimum and maximum data flow rate for a connection; this
52
+-	  is important for real time data such as streaming sound or video.
53
+-
54
+-	  Say Y here if you want to be able to classify outgoing packets based
55
+-	  on their RSVP requests and you are using the IPv6 protocol.
56
+-
57
+-	  To compile this code as a module, choose M here: the
58
+-	  module will be called cls_rsvp6.
59
+-
60
+ config NET_CLS_FLOW
61
+ 	tristate "Flow classifier"
62
+ 	select NET_CLS
63
+--- a/net/sched/Makefile
64
+@@ -69,8 +69,6 @@ obj-$(CONFIG_NET_SCH_TAPRIO)	+= sch_tapr
65
+ obj-$(CONFIG_NET_CLS_U32)	+= cls_u32.o
66
+ obj-$(CONFIG_NET_CLS_ROUTE4)	+= cls_route.o
67
+ obj-$(CONFIG_NET_CLS_FW)	+= cls_fw.o
68
+-obj-$(CONFIG_NET_CLS_RSVP)	+= cls_rsvp.o
69
+-obj-$(CONFIG_NET_CLS_RSVP6)	+= cls_rsvp6.o
70
+ obj-$(CONFIG_NET_CLS_BASIC)	+= cls_basic.o
71
+ obj-$(CONFIG_NET_CLS_FLOW)	+= cls_flow.o
72
+ obj-$(CONFIG_NET_CLS_CGROUP)	+= cls_cgroup.o
73
+--- a/net/sched/cls_rsvp.c
74
+@@ -1,24 +0,0 @@
75
+-// SPDX-License-Identifier: GPL-2.0-or-later
76
+-/*
77
+- * net/sched/cls_rsvp.c	Special RSVP packet classifier for IPv4.
78
+- *
79
+- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
80
+- */
81
+-
82
+-#include <linux/module.h>
83
+-#include <linux/types.h>
84
+-#include <linux/kernel.h>
85
+-#include <linux/string.h>
86
+-#include <linux/errno.h>
87
+-#include <linux/skbuff.h>
88
+-#include <net/ip.h>
89
+-#include <net/netlink.h>
90
+-#include <net/act_api.h>
91
+-#include <net/pkt_cls.h>
92
+-
93
+-#define RSVP_DST_LEN	1
94
+-#define RSVP_ID		"rsvp"
95
+-#define RSVP_OPS	cls_rsvp_ops
96
+-
97
+-#include "cls_rsvp.h"
98
+-MODULE_LICENSE("GPL");
99
+--- a/net/sched/cls_rsvp.h
100
+@@ -1,764 +0,0 @@
101
+-/* SPDX-License-Identifier: GPL-2.0-or-later */
102
+-/*
103
+- * net/sched/cls_rsvp.h	Template file for RSVPv[46] classifiers.
104
+- *
105
+- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
106
+- */
107
+-
108
+-/*
109
+-   Comparing to general packet classification problem,
110
+-   RSVP needs only several relatively simple rules:
111
+-
112
+-   * (dst, protocol) are always specified,
113
+-     so that we are able to hash them.
114
+-   * src may be exact, or may be wildcard, so that
115
+-     we can keep a hash table plus one wildcard entry.
116
+-   * source port (or flow label) is important only if src is given.
117
+-
118
+-   IMPLEMENTATION.
119
+-
120
+-   We use a two level hash table: The top level is keyed by
121
+-   destination address and protocol ID, every bucket contains a list
122
+-   of "rsvp sessions", identified by destination address, protocol and
123
+-   DPI(="Destination Port ID"): triple (key, mask, offset).
124
+-
125
+-   Every bucket has a smaller hash table keyed by source address
126
+-   (cf. RSVP flowspec) and one wildcard entry for wildcard reservations.
127
+-   Every bucket is again a list of "RSVP flows", selected by
128
+-   source address and SPI(="Source Port ID" here rather than
129
+-   "security parameter index"): triple (key, mask, offset).
130
+-
131
+-
132
+-   NOTE 1. All the packets with IPv6 extension headers (but AH and ESP)
133
+-   and all fragmented packets go to the best-effort traffic class.
134
+-
135
+-
136
+-   NOTE 2. Two "port id"'s seems to be redundant, rfc2207 requires
137
+-   only one "Generalized Port Identifier". So that for classic
138
+-   ah, esp (and udp,tcp) both *pi should coincide or one of them
139
+-   should be wildcard.
140
+-
141
+-   At first sight, this redundancy is just a waste of CPU
142
+-   resources. But DPI and SPI add the possibility to assign different
143
+-   priorities to GPIs. Look also at note 4 about tunnels below.
144
+-
145
+-
146
+-   NOTE 3. One complication is the case of tunneled packets.
147
+-   We implement it as following: if the first lookup
148
+-   matches a special session with "tunnelhdr" value not zero,
149
+-   flowid doesn't contain the true flow ID, but the tunnel ID (1...255).
150
+-   In this case, we pull tunnelhdr bytes and restart lookup
151
+-   with tunnel ID added to the list of keys. Simple and stupid 8)8)
152
+-   It's enough for PIMREG and IPIP.
153
+-
154
+-
155
+-   NOTE 4. Two GPIs make it possible to parse even GRE packets.
156
+-   F.e. DPI can select ETH_P_IP (and necessary flags to make
157
+-   tunnelhdr correct) in GRE protocol field and SPI matches
158
+-   GRE key. Is it not nice? 8)8)
159
+-
160
+-
161
+-   Well, as result, despite its simplicity, we get a pretty
162
+-   powerful classification engine.  */
163
+-
164
+-
165
+-struct rsvp_head {
166
+-	u32			tmap[256/32];
167
+-	u32			hgenerator;
168
+-	u8			tgenerator;
169
+-	struct rsvp_session __rcu *ht[256];
170
+-	struct rcu_head		rcu;
171
+-};
172
+-
173
+-struct rsvp_session {
174
+-	struct rsvp_session __rcu	*next;
175
+-	__be32				dst[RSVP_DST_LEN];
176
+-	struct tc_rsvp_gpi		dpi;
177
+-	u8				protocol;
178
+-	u8				tunnelid;
179
+-	/* 16 (src,sport) hash slots, and one wildcard source slot */
180
+-	struct rsvp_filter __rcu	*ht[16 + 1];
181
+-	struct rcu_head			rcu;
182
+-};
183
+-
184
+-
185
+-struct rsvp_filter {
186
+-	struct rsvp_filter __rcu	*next;
187
+-	__be32				src[RSVP_DST_LEN];
188
+-	struct tc_rsvp_gpi		spi;
189
+-	u8				tunnelhdr;
190
+-
191
+-	struct tcf_result		res;
192
+-	struct tcf_exts			exts;
193
+-
194
+-	u32				handle;
195
+-	struct rsvp_session		*sess;
196
+-	struct rcu_work			rwork;
197
+-};
198
+-
199
+-static inline unsigned int hash_dst(__be32 *dst, u8 protocol, u8 tunnelid)
200
+-{
201
+-	unsigned int h = (__force __u32)dst[RSVP_DST_LEN - 1];
202
+-
203
+-	h ^= h>>16;
204
+-	h ^= h>>8;
205
+-	return (h ^ protocol ^ tunnelid) & 0xFF;
206
+-}
207
+-
208
+-static inline unsigned int hash_src(__be32 *src)
209
+-{
210
+-	unsigned int h = (__force __u32)src[RSVP_DST_LEN-1];
211
+-
212
+-	h ^= h>>16;
213
+-	h ^= h>>8;
214
+-	h ^= h>>4;
215
+-	return h & 0xF;
216
+-}
217
+-
218
+-#define RSVP_APPLY_RESULT()				\
219
+-{							\
220
+-	int r = tcf_exts_exec(skb, &f->exts, res);	\
221
+-	if (r < 0)					\
222
+-		continue;				\
223
+-	else if (r > 0)					\
224
+-		return r;				\
225
+-}
226
+-
227
+-static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
228
+-			 struct tcf_result *res)
229
+-{
230
+-	struct rsvp_head *head = rcu_dereference_bh(tp->root);
231
+-	struct rsvp_session *s;
232
+-	struct rsvp_filter *f;
233
+-	unsigned int h1, h2;
234
+-	__be32 *dst, *src;
235
+-	u8 protocol;
236
+-	u8 tunnelid = 0;
237
+-	u8 *xprt;
238
+-#if RSVP_DST_LEN == 4
239
+-	struct ipv6hdr *nhptr;
240
+-
241
+-	if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
242
+-		return -1;
243
+-	nhptr = ipv6_hdr(skb);
244
+-#else
245
+-	struct iphdr *nhptr;
246
+-
247
+-	if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
248
+-		return -1;
249
+-	nhptr = ip_hdr(skb);
250
+-#endif
251
+-restart:
252
+-
253
+-#if RSVP_DST_LEN == 4
254
+-	src = &nhptr->saddr.s6_addr32[0];
255
+-	dst = &nhptr->daddr.s6_addr32[0];
256
+-	protocol = nhptr->nexthdr;
257
+-	xprt = ((u8 *)nhptr) + sizeof(struct ipv6hdr);
258
+-#else
259
+-	src = &nhptr->saddr;
260
+-	dst = &nhptr->daddr;
261
+-	protocol = nhptr->protocol;
262
+-	xprt = ((u8 *)nhptr) + (nhptr->ihl<<2);
263
+-	if (ip_is_fragment(nhptr))
264
+-		return -1;
265
+-#endif
266
+-
267
+-	h1 = hash_dst(dst, protocol, tunnelid);
268
+-	h2 = hash_src(src);
269
+-
270
+-	for (s = rcu_dereference_bh(head->ht[h1]); s;
271
+-	     s = rcu_dereference_bh(s->next)) {
272
+-		if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN - 1] &&
273
+-		    protocol == s->protocol &&
274
+-		    !(s->dpi.mask &
275
+-		      (*(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key)) &&
276
+-#if RSVP_DST_LEN == 4
277
+-		    dst[0] == s->dst[0] &&
278
+-		    dst[1] == s->dst[1] &&
279
+-		    dst[2] == s->dst[2] &&
280
+-#endif
281
+-		    tunnelid == s->tunnelid) {
282
+-
283
+-			for (f = rcu_dereference_bh(s->ht[h2]); f;
284
+-			     f = rcu_dereference_bh(f->next)) {
285
+-				if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN - 1] &&
286
+-				    !(f->spi.mask & (*(u32 *)(xprt + f->spi.offset) ^ f->spi.key))
287
+-#if RSVP_DST_LEN == 4
288
+-				    &&
289
+-				    src[0] == f->src[0] &&
290
+-				    src[1] == f->src[1] &&
291
+-				    src[2] == f->src[2]
292
+-#endif
293
+-				    ) {
294
+-					*res = f->res;
295
+-					RSVP_APPLY_RESULT();
296
+-
297
+-matched:
298
+-					if (f->tunnelhdr == 0)
299
+-						return 0;
300
+-
301
+-					tunnelid = f->res.classid;
302
+-					nhptr = (void *)(xprt + f->tunnelhdr - sizeof(*nhptr));
303
+-					goto restart;
304
+-				}
305
+-			}
306
+-
307
+-			/* And wildcard bucket... */
308
+-			for (f = rcu_dereference_bh(s->ht[16]); f;
309
+-			     f = rcu_dereference_bh(f->next)) {
310
+-				*res = f->res;
311
+-				RSVP_APPLY_RESULT();
312
+-				goto matched;
313
+-			}
314
+-			return -1;
315
+-		}
316
+-	}
317
+-	return -1;
318
+-}
319
+-
320
+-static void rsvp_replace(struct tcf_proto *tp, struct rsvp_filter *n, u32 h)
321
+-{
322
+-	struct rsvp_head *head = rtnl_dereference(tp->root);
323
+-	struct rsvp_session *s;
324
+-	struct rsvp_filter __rcu **ins;
325
+-	struct rsvp_filter *pins;
326
+-	unsigned int h1 = h & 0xFF;
327
+-	unsigned int h2 = (h >> 8) & 0xFF;
328
+-
329
+-	for (s = rtnl_dereference(head->ht[h1]); s;
330
+-	     s = rtnl_dereference(s->next)) {
331
+-		for (ins = &s->ht[h2], pins = rtnl_dereference(*ins); ;
332
+-		     ins = &pins->next, pins = rtnl_dereference(*ins)) {
333
+-			if (pins->handle == h) {
334
+-				RCU_INIT_POINTER(n->next, pins->next);
335
+-				rcu_assign_pointer(*ins, n);
336
+-				return;
337
+-			}
338
+-		}
339
+-	}
340
+-
341
+-	/* Something went wrong if we are trying to replace a non-existent
342
+-	 * node. Mind as well halt instead of silently failing.
343
+-	 */
344
+-	BUG_ON(1);
345
+-}
346
+-
347
+-static void *rsvp_get(struct tcf_proto *tp, u32 handle)
348
+-{
349
+-	struct rsvp_head *head = rtnl_dereference(tp->root);
350
+-	struct rsvp_session *s;
351
+-	struct rsvp_filter *f;
352
+-	unsigned int h1 = handle & 0xFF;
353
+-	unsigned int h2 = (handle >> 8) & 0xFF;
354
+-
355
+-	if (h2 > 16)
356
+-		return NULL;
357
+-
358
+-	for (s = rtnl_dereference(head->ht[h1]); s;
359
+-	     s = rtnl_dereference(s->next)) {
360
+-		for (f = rtnl_dereference(s->ht[h2]); f;
361
+-		     f = rtnl_dereference(f->next)) {
362
+-			if (f->handle == handle)
363
+-				return f;
364
+-		}
365
+-	}
366
+-	return NULL;
367
+-}
368
+-
369
+-static int rsvp_init(struct tcf_proto *tp)
370
+-{
371
+-	struct rsvp_head *data;
372
+-
373
+-	data = kzalloc(sizeof(struct rsvp_head), GFP_KERNEL);
374
+-	if (data) {
375
+-		rcu_assign_pointer(tp->root, data);
376
+-		return 0;
377
+-	}
378
+-	return -ENOBUFS;
379
+-}
380
+-
381
+-static void __rsvp_delete_filter(struct rsvp_filter *f)
382
+-{
383
+-	tcf_exts_destroy(&f->exts);
384
+-	tcf_exts_put_net(&f->exts);
385
+-	kfree(f);
386
+-}
387
+-
388
+-static void rsvp_delete_filter_work(struct work_struct *work)
389
+-{
390
+-	struct rsvp_filter *f = container_of(to_rcu_work(work),
391
+-					     struct rsvp_filter,
392
+-					     rwork);
393
+-	rtnl_lock();
394
+-	__rsvp_delete_filter(f);
395
+-	rtnl_unlock();
396
+-}
397
+-
398
+-static void rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f)
399
+-{
400
+-	tcf_unbind_filter(tp, &f->res);
401
+-	/* all classifiers are required to call tcf_exts_destroy() after rcu
402
+-	 * grace period, since converted-to-rcu actions are relying on that
403
+-	 * in cleanup() callback
404
+-	 */
405
+-	if (tcf_exts_get_net(&f->exts))
406
+-		tcf_queue_work(&f->rwork, rsvp_delete_filter_work);
407
+-	else
408
+-		__rsvp_delete_filter(f);
409
+-}
410
+-
411
+-static void rsvp_destroy(struct tcf_proto *tp, bool rtnl_held,
412
+-			 struct netlink_ext_ack *extack)
413
+-{
414
+-	struct rsvp_head *data = rtnl_dereference(tp->root);
415
+-	int h1, h2;
416
+-
417
+-	if (data == NULL)
418
+-		return;
419
+-
420
+-	for (h1 = 0; h1 < 256; h1++) {
421
+-		struct rsvp_session *s;
422
+-
423
+-		while ((s = rtnl_dereference(data->ht[h1])) != NULL) {
424
+-			RCU_INIT_POINTER(data->ht[h1], s->next);
425
+-
426
+-			for (h2 = 0; h2 <= 16; h2++) {
427
+-				struct rsvp_filter *f;
428
+-
429
+-				while ((f = rtnl_dereference(s->ht[h2])) != NULL) {
430
+-					rcu_assign_pointer(s->ht[h2], f->next);
431
+-					rsvp_delete_filter(tp, f);
432
+-				}
433
+-			}
434
+-			kfree_rcu(s, rcu);
435
+-		}
436
+-	}
437
+-	kfree_rcu(data, rcu);
438
+-}
439
+-
440
+-static int rsvp_delete(struct tcf_proto *tp, void *arg, bool *last,
441
+-		       bool rtnl_held, struct netlink_ext_ack *extack)
442
+-{
443
+-	struct rsvp_head *head = rtnl_dereference(tp->root);
444
+-	struct rsvp_filter *nfp, *f = arg;
445
+-	struct rsvp_filter __rcu **fp;
446
+-	unsigned int h = f->handle;
447
+-	struct rsvp_session __rcu **sp;
448
+-	struct rsvp_session *nsp, *s = f->sess;
449
+-	int i, h1;
450
+-
451
+-	fp = &s->ht[(h >> 8) & 0xFF];
452
+-	for (nfp = rtnl_dereference(*fp); nfp;
453
+-	     fp = &nfp->next, nfp = rtnl_dereference(*fp)) {
454
+-		if (nfp == f) {
455
+-			RCU_INIT_POINTER(*fp, f->next);
456
+-			rsvp_delete_filter(tp, f);
457
+-
458
+-			/* Strip tree */
459
+-
460
+-			for (i = 0; i <= 16; i++)
461
+-				if (s->ht[i])
462
+-					goto out;
463
+-
464
+-			/* OK, session has no flows */
465
+-			sp = &head->ht[h & 0xFF];
466
+-			for (nsp = rtnl_dereference(*sp); nsp;
467
+-			     sp = &nsp->next, nsp = rtnl_dereference(*sp)) {
468
+-				if (nsp == s) {
469
+-					RCU_INIT_POINTER(*sp, s->next);
470
+-					kfree_rcu(s, rcu);
471
+-					goto out;
472
+-				}
473
+-			}
474
+-
475
+-			break;
476
+-		}
477
+-	}
478
+-
479
+-out:
480
+-	*last = true;
481
+-	for (h1 = 0; h1 < 256; h1++) {
482
+-		if (rcu_access_pointer(head->ht[h1])) {
483
+-			*last = false;
484
+-			break;
485
+-		}
486
+-	}
487
+-
488
+-	return 0;
489
+-}
490
+-
491
+-static unsigned int gen_handle(struct tcf_proto *tp, unsigned salt)
492
+-{
493
+-	struct rsvp_head *data = rtnl_dereference(tp->root);
494
+-	int i = 0xFFFF;
495
+-
496
+-	while (i-- > 0) {
497
+-		u32 h;
498
+-
499
+-		if ((data->hgenerator += 0x10000) == 0)
500
+-			data->hgenerator = 0x10000;
501
+-		h = data->hgenerator|salt;
502
+-		if (!rsvp_get(tp, h))
503
+-			return h;
504
+-	}
505
+-	return 0;
506
+-}
507
+-
508
+-static int tunnel_bts(struct rsvp_head *data)
509
+-{
510
+-	int n = data->tgenerator >> 5;
511
+-	u32 b = 1 << (data->tgenerator & 0x1F);
512
+-
513
+-	if (data->tmap[n] & b)
514
+-		return 0;
515
+-	data->tmap[n] |= b;
516
+-	return 1;
517
+-}
518
+-
519
+-static void tunnel_recycle(struct rsvp_head *data)
520
+-{
521
+-	struct rsvp_session __rcu **sht = data->ht;
522
+-	u32 tmap[256/32];
523
+-	int h1, h2;
524
+-
525
+-	memset(tmap, 0, sizeof(tmap));
526
+-
527
+-	for (h1 = 0; h1 < 256; h1++) {
528
+-		struct rsvp_session *s;
529
+-		for (s = rtnl_dereference(sht[h1]); s;
530
+-		     s = rtnl_dereference(s->next)) {
531
+-			for (h2 = 0; h2 <= 16; h2++) {
532
+-				struct rsvp_filter *f;
533
+-
534
+-				for (f = rtnl_dereference(s->ht[h2]); f;
535
+-				     f = rtnl_dereference(f->next)) {
536
+-					if (f->tunnelhdr == 0)
537
+-						continue;
538
+-					data->tgenerator = f->res.classid;
539
+-					tunnel_bts(data);
540
+-				}
541
+-			}
542
+-		}
543
+-	}
544
+-
545
+-	memcpy(data->tmap, tmap, sizeof(tmap));
546
+-}
547
+-
548
+-static u32 gen_tunnel(struct rsvp_head *data)
549
+-{
550
+-	int i, k;
551
+-
552
+-	for (k = 0; k < 2; k++) {
553
+-		for (i = 255; i > 0; i--) {
554
+-			if (++data->tgenerator == 0)
555
+-				data->tgenerator = 1;
556
+-			if (tunnel_bts(data))
557
+-				return data->tgenerator;
558
+-		}
559
+-		tunnel_recycle(data);
560
+-	}
561
+-	return 0;
562
+-}
563
+-
564
+-static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = {
565
+-	[TCA_RSVP_CLASSID]	= { .type = NLA_U32 },
566
+-	[TCA_RSVP_DST]		= { .len = RSVP_DST_LEN * sizeof(u32) },
567
+-	[TCA_RSVP_SRC]		= { .len = RSVP_DST_LEN * sizeof(u32) },
568
+-	[TCA_RSVP_PINFO]	= { .len = sizeof(struct tc_rsvp_pinfo) },
569
+-};
570
+-
571
+-static int rsvp_change(struct net *net, struct sk_buff *in_skb,
572
+-		       struct tcf_proto *tp, unsigned long base,
573
+-		       u32 handle, struct nlattr **tca,
574
+-		       void **arg, u32 flags,
575
+-		       struct netlink_ext_ack *extack)
576
+-{
577
+-	struct rsvp_head *data = rtnl_dereference(tp->root);
578
+-	struct rsvp_filter *f, *nfp;
579
+-	struct rsvp_filter __rcu **fp;
580
+-	struct rsvp_session *nsp, *s;
581
+-	struct rsvp_session __rcu **sp;
582
+-	struct tc_rsvp_pinfo *pinfo = NULL;
583
+-	struct nlattr *opt = tca[TCA_OPTIONS];
584
+-	struct nlattr *tb[TCA_RSVP_MAX + 1];
585
+-	struct tcf_exts e;
586
+-	unsigned int h1, h2;
587
+-	__be32 *dst;
588
+-	int err;
589
+-
590
+-	if (opt == NULL)
591
+-		return handle ? -EINVAL : 0;
592
+-
593
+-	err = nla_parse_nested_deprecated(tb, TCA_RSVP_MAX, opt, rsvp_policy,
594
+-					  NULL);
595
+-	if (err < 0)
596
+-		return err;
597
+-
598
+-	err = tcf_exts_init(&e, net, TCA_RSVP_ACT, TCA_RSVP_POLICE);
599
+-	if (err < 0)
600
+-		return err;
601
+-	err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, flags,
602
+-				extack);
603
+-	if (err < 0)
604
+-		goto errout2;
605
+-
606
+-	f = *arg;
607
+-	if (f) {
608
+-		/* Node exists: adjust only classid */
609
+-		struct rsvp_filter *n;
610
+-
611
+-		if (f->handle != handle && handle)
612
+-			goto errout2;
613
+-
614
+-		n = kmemdup(f, sizeof(*f), GFP_KERNEL);
615
+-		if (!n) {
616
+-			err = -ENOMEM;
617
+-			goto errout2;
618
+-		}
619
+-
620
+-		err = tcf_exts_init(&n->exts, net, TCA_RSVP_ACT,
621
+-				    TCA_RSVP_POLICE);
622
+-		if (err < 0) {
623
+-			kfree(n);
624
+-			goto errout2;
625
+-		}
626
+-
627
+-		if (tb[TCA_RSVP_CLASSID]) {
628
+-			n->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
629
+-			tcf_bind_filter(tp, &n->res, base);
630
+-		}
631
+-
632
+-		tcf_exts_change(&n->exts, &e);
633
+-		rsvp_replace(tp, n, handle);
634
+-		return 0;
635
+-	}
636
+-
637
+-	/* Now more serious part... */
638
+-	err = -EINVAL;
639
+-	if (handle)
640
+-		goto errout2;
641
+-	if (tb[TCA_RSVP_DST] == NULL)
642
+-		goto errout2;
643
+-
644
+-	err = -ENOBUFS;
645
+-	f = kzalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
646
+-	if (f == NULL)
647
+-		goto errout2;
648
+-
649
+-	err = tcf_exts_init(&f->exts, net, TCA_RSVP_ACT, TCA_RSVP_POLICE);
650
+-	if (err < 0)
651
+-		goto errout;
652
+-	h2 = 16;
653
+-	if (tb[TCA_RSVP_SRC]) {
654
+-		memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src));
655
+-		h2 = hash_src(f->src);
656
+-	}
657
+-	if (tb[TCA_RSVP_PINFO]) {
658
+-		pinfo = nla_data(tb[TCA_RSVP_PINFO]);
659
+-		f->spi = pinfo->spi;
660
+-		f->tunnelhdr = pinfo->tunnelhdr;
661
+-	}
662
+-	if (tb[TCA_RSVP_CLASSID])
663
+-		f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
664
+-
665
+-	dst = nla_data(tb[TCA_RSVP_DST]);
666
+-	h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0);
667
+-
668
+-	err = -ENOMEM;
669
+-	if ((f->handle = gen_handle(tp, h1 | (h2<<8))) == 0)
670
+-		goto errout;
671
+-
672
+-	if (f->tunnelhdr) {
673
+-		err = -EINVAL;
674
+-		if (f->res.classid > 255)
675
+-			goto errout;
676
+-
677
+-		err = -ENOMEM;
678
+-		if (f->res.classid == 0 &&
679
+-		    (f->res.classid = gen_tunnel(data)) == 0)
680
+-			goto errout;
681
+-	}
682
+-
683
+-	for (sp = &data->ht[h1];
684
+-	     (s = rtnl_dereference(*sp)) != NULL;
685
+-	     sp = &s->next) {
686
+-		if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
687
+-		    pinfo && pinfo->protocol == s->protocol &&
688
+-		    memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 &&
689
+-#if RSVP_DST_LEN == 4
690
+-		    dst[0] == s->dst[0] &&
691
+-		    dst[1] == s->dst[1] &&
692
+-		    dst[2] == s->dst[2] &&
693
+-#endif
694
+-		    pinfo->tunnelid == s->tunnelid) {
695
+-
696
+-insert:
697
+-			/* OK, we found appropriate session */
698
+-
699
+-			fp = &s->ht[h2];
700
+-
701
+-			f->sess = s;
702
+-			if (f->tunnelhdr == 0)
703
+-				tcf_bind_filter(tp, &f->res, base);
704
+-
705
+-			tcf_exts_change(&f->exts, &e);
706
+-
707
+-			fp = &s->ht[h2];
708
+-			for (nfp = rtnl_dereference(*fp); nfp;
709
+-			     fp = &nfp->next, nfp = rtnl_dereference(*fp)) {
710
+-				__u32 mask = nfp->spi.mask & f->spi.mask;
711
+-
712
+-				if (mask != f->spi.mask)
713
+-					break;
714
+-			}
715
+-			RCU_INIT_POINTER(f->next, nfp);
716
+-			rcu_assign_pointer(*fp, f);
717
+-
718
+-			*arg = f;
719
+-			return 0;
720
+-		}
721
+-	}
722
+-
723
+-	/* No session found. Create new one. */
724
+-
725
+-	err = -ENOBUFS;
726
+-	s = kzalloc(sizeof(struct rsvp_session), GFP_KERNEL);
727
+-	if (s == NULL)
728
+-		goto errout;
729
+-	memcpy(s->dst, dst, sizeof(s->dst));
730
+-
731
+-	if (pinfo) {
732
+-		s->dpi = pinfo->dpi;
733
+-		s->protocol = pinfo->protocol;
734
+-		s->tunnelid = pinfo->tunnelid;
735
+-	}
736
+-	sp = &data->ht[h1];
737
+-	for (nsp = rtnl_dereference(*sp); nsp;
738
+-	     sp = &nsp->next, nsp = rtnl_dereference(*sp)) {
739
+-		if ((nsp->dpi.mask & s->dpi.mask) != s->dpi.mask)
740
+-			break;
741
+-	}
742
+-	RCU_INIT_POINTER(s->next, nsp);
743
+-	rcu_assign_pointer(*sp, s);
744
+-
745
+-	goto insert;
746
+-
747
+-errout:
748
+-	tcf_exts_destroy(&f->exts);
749
+-	kfree(f);
750
+-errout2:
751
+-	tcf_exts_destroy(&e);
752
+-	return err;
753
+-}
754
+-
755
+-static void rsvp_walk(struct tcf_proto *tp, struct tcf_walker *arg,
756
+-		      bool rtnl_held)
757
+-{
758
+-	struct rsvp_head *head = rtnl_dereference(tp->root);
759
+-	unsigned int h, h1;
760
+-
761
+-	if (arg->stop)
762
+-		return;
763
+-
764
+-	for (h = 0; h < 256; h++) {
765
+-		struct rsvp_session *s;
766
+-
767
+-		for (s = rtnl_dereference(head->ht[h]); s;
768
+-		     s = rtnl_dereference(s->next)) {
769
+-			for (h1 = 0; h1 <= 16; h1++) {
770
+-				struct rsvp_filter *f;
771
+-
772
+-				for (f = rtnl_dereference(s->ht[h1]); f;
773
+-				     f = rtnl_dereference(f->next)) {
774
+-					if (!tc_cls_stats_dump(tp, arg, f))
775
+-						return;
776
+-				}
777
+-			}
778
+-		}
779
+-	}
780
+-}
781
+-
782
+-static int rsvp_dump(struct net *net, struct tcf_proto *tp, void *fh,
783
+-		     struct sk_buff *skb, struct tcmsg *t, bool rtnl_held)
784
+-{
785
+-	struct rsvp_filter *f = fh;
786
+-	struct rsvp_session *s;
787
+-	struct nlattr *nest;
788
+-	struct tc_rsvp_pinfo pinfo;
789
+-
790
+-	if (f == NULL)
791
+-		return skb->len;
792
+-	s = f->sess;
793
+-
794
+-	t->tcm_handle = f->handle;
795
+-
796
+-	nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
797
+-	if (nest == NULL)
798
+-		goto nla_put_failure;
799
+-
800
+-	if (nla_put(skb, TCA_RSVP_DST, sizeof(s->dst), &s->dst))
801
+-		goto nla_put_failure;
802
+-	pinfo.dpi = s->dpi;
803
+-	pinfo.spi = f->spi;
804
+-	pinfo.protocol = s->protocol;
805
+-	pinfo.tunnelid = s->tunnelid;
806
+-	pinfo.tunnelhdr = f->tunnelhdr;
807
+-	pinfo.pad = 0;
808
+-	if (nla_put(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo))
809
+-		goto nla_put_failure;
810
+-	if (f->res.classid &&
811
+-	    nla_put_u32(skb, TCA_RSVP_CLASSID, f->res.classid))
812
+-		goto nla_put_failure;
813
+-	if (((f->handle >> 8) & 0xFF) != 16 &&
814
+-	    nla_put(skb, TCA_RSVP_SRC, sizeof(f->src), f->src))
815
+-		goto nla_put_failure;
816
+-
817
+-	if (tcf_exts_dump(skb, &f->exts) < 0)
818
+-		goto nla_put_failure;
819
+-
820
+-	nla_nest_end(skb, nest);
821
+-
822
+-	if (tcf_exts_dump_stats(skb, &f->exts) < 0)
823
+-		goto nla_put_failure;
824
+-	return skb->len;
825
+-
826
+-nla_put_failure:
827
+-	nla_nest_cancel(skb, nest);
828
+-	return -1;
829
+-}
830
+-
831
+-static void rsvp_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
832
+-			    unsigned long base)
833
+-{
834
+-	struct rsvp_filter *f = fh;
835
+-
836
+-	tc_cls_bind_class(classid, cl, q, &f->res, base);
837
+-}
838
+-
839
+-static struct tcf_proto_ops RSVP_OPS __read_mostly = {
840
+-	.kind		=	RSVP_ID,
841
+-	.classify	=	rsvp_classify,
842
+-	.init		=	rsvp_init,
843
+-	.destroy	=	rsvp_destroy,
844
+-	.get		=	rsvp_get,
845
+-	.change		=	rsvp_change,
846
+-	.delete		=	rsvp_delete,
847
+-	.walk		=	rsvp_walk,
848
+-	.dump		=	rsvp_dump,
849
+-	.bind_class	=	rsvp_bind_class,
850
+-	.owner		=	THIS_MODULE,
851
+-};
852
+-
853
+-static int __init init_rsvp(void)
854
+-{
855
+-	return register_tcf_proto_ops(&RSVP_OPS);
856
+-}
857
+-
858
+-static void __exit exit_rsvp(void)
859
+-{
860
+-	unregister_tcf_proto_ops(&RSVP_OPS);
861
+-}
862
+-
863
+-module_init(init_rsvp)
864
+-module_exit(exit_rsvp)
865
+--- a/net/sched/cls_rsvp6.c
866
+@@ -1,24 +0,0 @@
867
+-// SPDX-License-Identifier: GPL-2.0-or-later
868
+-/*
869
+- * net/sched/cls_rsvp6.c	Special RSVP packet classifier for IPv6.
870
+- *
871
+- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
872
+- */
873
+-
874
+-#include <linux/module.h>
875
+-#include <linux/types.h>
876
+-#include <linux/kernel.h>
877
+-#include <linux/string.h>
878
+-#include <linux/errno.h>
879
+-#include <linux/ipv6.h>
880
+-#include <linux/skbuff.h>
881
+-#include <net/act_api.h>
882
+-#include <net/pkt_cls.h>
883
+-#include <net/netlink.h>
884
+-
885
+-#define RSVP_DST_LEN	4
886
+-#define RSVP_ID		"rsvp6"
887
+-#define RSVP_OPS	cls_rsvp6_ops
888
+-
889
+-#include "cls_rsvp.h"
890
+-MODULE_LICENSE("GPL");
891
+--- a/tools/testing/selftests/tc-testing/tc-tests/filters/rsvp.json
892
+@@ -1,203 +0,0 @@
893
+-[
894
+-    {
895
+-        "id": "2141",
896
+-        "name": "Add rsvp filter with tcp proto and specific IP address",
897
+-        "category": [
898
+-            "filter",
899
+-            "rsvp"
900
+-        ],
901
+-        "plugins": {
902
+-            "requires": "nsPlugin"
903
+-        },
904
+-        "setup": [
905
+-            "$TC qdisc add dev $DEV1 ingress"
906
+-        ],
907
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto tcp session 198.168.10.64",
908
+-        "expExitCode": "0",
909
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
910
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*session 198.168.10.64 ipproto tcp",
911
+-        "matchCount": "1",
912
+-        "teardown": [
913
+-            "$TC qdisc del dev $DEV1 ingress"
914
+-        ]
915
+-    },
916
+-    {
917
+-        "id": "5267",
918
+-        "name": "Add rsvp filter with udp proto and specific IP address",
919
+-        "category": [
920
+-            "filter",
921
+-            "rsvp"
922
+-        ],
923
+-        "plugins": {
924
+-            "requires": "nsPlugin"
925
+-        },
926
+-        "setup": [
927
+-            "$TC qdisc add dev $DEV1 ingress"
928
+-        ],
929
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1",
930
+-        "expExitCode": "0",
931
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
932
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*session 1.1.1.1 ipproto udp",
933
+-        "matchCount": "1",
934
+-        "teardown": [
935
+-            "$TC qdisc del dev $DEV1 ingress"
936
+-        ]
937
+-    },
938
+-    {
939
+-        "id": "2819",
940
+-        "name": "Add rsvp filter with src ip and src port",
941
+-        "category": [
942
+-            "filter",
943
+-            "rsvp"
944
+-        ],
945
+-        "plugins": {
946
+-            "requires": "nsPlugin"
947
+-        },
948
+-        "setup": [
949
+-            "$TC qdisc add dev $DEV1 ingress"
950
+-        ],
951
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1 sender 2.2.2.2/5021 classid 1:1",
952
+-        "expExitCode": "0",
953
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
954
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*flowid 1:1 session 1.1.1.1 ipproto udp sender  2.2.2.2/5021",
955
+-        "matchCount": "1",
956
+-        "teardown": [
957
+-            "$TC qdisc del dev $DEV1 ingress"
958
+-        ]
959
+-    },
960
+-    {
961
+-        "id": "c967",
962
+-        "name": "Add rsvp filter with tunnelid and continue action",
963
+-        "category": [
964
+-            "filter",
965
+-            "rsvp"
966
+-        ],
967
+-        "plugins": {
968
+-            "requires": "nsPlugin"
969
+-        },
970
+-        "setup": [
971
+-            "$TC qdisc add dev $DEV1 ingress"
972
+-        ],
973
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1 tunnelid 2 classid 1:1 action continue",
974
+-        "expExitCode": "0",
975
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
976
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*flowid 1:1 session 1.1.1.1 ipproto udp tunnelid 2.*action order [0-9]+: gact action continue",
977
+-        "matchCount": "1",
978
+-        "teardown": [
979
+-            "$TC qdisc del dev $DEV1 ingress"
980
+-        ]
981
+-    },
982
+-    {
983
+-        "id": "5463",
984
+-        "name": "Add rsvp filter with tunnel and pipe action",
985
+-        "category": [
986
+-            "filter",
987
+-            "rsvp"
988
+-        ],
989
+-        "plugins": {
990
+-            "requires": "nsPlugin"
991
+-        },
992
+-        "setup": [
993
+-            "$TC qdisc add dev $DEV1 ingress"
994
+-        ],
995
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1 tunnel 2 skip 1 action pipe",
996
+-        "expExitCode": "0",
997
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
998
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*tunnel 2 skip 1 session 1.1.1.1 ipproto udp.*action order [0-9]+: gact action pipe",
999
+-        "matchCount": "1",
1000
+-        "teardown": [
1001
+-            "$TC qdisc del dev $DEV1 ingress"
1002
+-        ]
1003
+-    },
1004
+-    {
1005
+-        "id": "2332",
1006
+-        "name": "Add rsvp filter with miltiple actions",
1007
+-        "category": [
1008
+-            "filter",
1009
+-            "rsvp"
1010
+-        ],
1011
+-        "plugins": {
1012
+-            "requires": "nsPlugin"
1013
+-        },
1014
+-        "setup": [
1015
+-            "$TC qdisc add dev $DEV1 ingress"
1016
+-        ],
1017
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 7 rsvp ipproto udp session 1.1.1.1 classid 1:1 action skbedit mark 7 pipe action gact drop",
1018
+-        "expExitCode": "0",
1019
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
1020
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*flowid 1:1 session 1.1.1.1 ipproto udp.*action order [0-9]+: skbedit  mark 7 pipe.*action order [0-9]+: gact action drop",
1021
+-        "matchCount": "1",
1022
+-        "teardown": [
1023
+-            "$TC qdisc del dev $DEV1 ingress"
1024
+-        ]
1025
+-    },
1026
+-    {
1027
+-        "id": "8879",
1028
+-        "name": "Add rsvp filter with tunnel and skp flag",
1029
+-        "category": [
1030
+-            "filter",
1031
+-            "rsvp"
1032
+-        ],
1033
+-        "plugins": {
1034
+-            "requires": "nsPlugin"
1035
+-        },
1036
+-        "setup": [
1037
+-            "$TC qdisc add dev $DEV1 ingress"
1038
+-        ],
1039
+-        "cmdUnderTest": "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1 tunnel 2 skip 1 action pipe",
1040
+-        "expExitCode": "0",
1041
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
1042
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*tunnel 2 skip 1 session 1.1.1.1 ipproto udp.*action order [0-9]+: gact action pipe",
1043
+-        "matchCount": "1",
1044
+-        "teardown": [
1045
+-            "$TC qdisc del dev $DEV1 ingress"
1046
+-        ]
1047
+-    },
1048
+-    {
1049
+-        "id": "8261",
1050
+-        "name": "List rsvp filters",
1051
+-        "category": [
1052
+-            "filter",
1053
+-            "rsvp"
1054
+-        ],
1055
+-        "plugins": {
1056
+-            "requires": "nsPlugin"
1057
+-        },
1058
+-        "setup": [
1059
+-            "$TC qdisc add dev $DEV1 ingress",
1060
+-            "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1/1234 classid 1:1",
1061
+-            "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto tcp session 2.2.2.2/1234 classid 2:1"
1062
+-        ],
1063
+-        "cmdUnderTest": "$TC filter show dev $DEV1 parent ffff:",
1064
+-        "expExitCode": "0",
1065
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
1066
+-        "matchPattern": "^filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh",
1067
+-        "matchCount": "2",
1068
+-        "teardown": [
1069
+-            "$TC qdisc del dev $DEV1 ingress"
1070
+-        ]
1071
+-    },
1072
+-    {
1073
+-        "id": "8989",
1074
+-        "name": "Delete rsvp filter",
1075
+-        "category": [
1076
+-            "filter",
1077
+-            "rsvp"
1078
+-        ],
1079
+-        "plugins": {
1080
+-            "requires": "nsPlugin"
1081
+-        },
1082
+-        "setup": [
1083
+-            "$TC qdisc add dev $DEV1 ingress",
1084
+-            "$TC filter add dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1/1234 tunnelid 9 classid 2:1"
1085
+-        ],
1086
+-        "cmdUnderTest": "$TC filter del dev $DEV1 parent ffff: protocol ip prio 1 rsvp ipproto udp session 1.1.1.1/1234 tunnelid 9 classid 2:1",
1087
+-        "expExitCode": "0",
1088
+-        "verifyCmd": "$TC filter show dev $DEV1 parent ffff:",
1089
+-        "matchPattern": "filter protocol ip pref [0-9]+ rsvp chain [0-9]+ fh 0x.*flowid 2:1 session 1.1.1.1/1234 ipproto udp tunnelid 9",
1090
+-        "matchCount": "0",
1091
+-        "teardown": [
1092
+-            "$TC qdisc del dev $DEV1 ingress"
1093
+-        ]
1094
+-    }
1095
+-]
... ...
@@ -1376,8 +1376,6 @@ CONFIG_NET_CLS_FW=m
1376 1376
 CONFIG_NET_CLS_U32=m
1377 1377
 CONFIG_CLS_U32_PERF=y
1378 1378
 CONFIG_CLS_U32_MARK=y
1379
-# CONFIG_NET_CLS_RSVP is not set
1380
-# CONFIG_NET_CLS_RSVP6 is not set
1381 1379
 CONFIG_NET_CLS_FLOW=m
1382 1380
 CONFIG_NET_CLS_CGROUP=m
1383 1381
 # CONFIG_NET_CLS_BPF is not set
... ...
@@ -1370,8 +1370,6 @@ CONFIG_NET_CLS_FW=m
1370 1370
 CONFIG_NET_CLS_U32=m
1371 1371
 CONFIG_CLS_U32_PERF=y
1372 1372
 CONFIG_CLS_U32_MARK=y
1373
-# CONFIG_NET_CLS_RSVP is not set
1374
-# CONFIG_NET_CLS_RSVP6 is not set
1375 1373
 CONFIG_NET_CLS_FLOW=m
1376 1374
 CONFIG_NET_CLS_CGROUP=m
1377 1375
 # CONFIG_NET_CLS_BPF is not set
... ...
@@ -1585,8 +1585,6 @@ CONFIG_NET_CLS_FW=m
1585 1585
 CONFIG_NET_CLS_U32=m
1586 1586
 CONFIG_CLS_U32_PERF=y
1587 1587
 CONFIG_CLS_U32_MARK=y
1588
-CONFIG_NET_CLS_RSVP=m
1589
-CONFIG_NET_CLS_RSVP6=m
1590 1588
 CONFIG_NET_CLS_FLOW=m
1591 1589
 CONFIG_NET_CLS_CGROUP=m
1592 1590
 CONFIG_NET_CLS_BPF=m
... ...
@@ -1593,8 +1593,6 @@ CONFIG_NET_CLS_FW=m
1593 1593
 CONFIG_NET_CLS_U32=m
1594 1594
 CONFIG_CLS_U32_PERF=y
1595 1595
 CONFIG_CLS_U32_MARK=y
1596
-CONFIG_NET_CLS_RSVP=m
1597
-CONFIG_NET_CLS_RSVP6=m
1598 1596
 CONFIG_NET_CLS_FLOW=m
1599 1597
 CONFIG_NET_CLS_CGROUP=m
1600 1598
 CONFIG_NET_CLS_BPF=m
... ...
@@ -1510,8 +1510,6 @@ CONFIG_NET_CLS_FW=m
1510 1510
 CONFIG_NET_CLS_U32=m
1511 1511
 CONFIG_CLS_U32_PERF=y
1512 1512
 CONFIG_CLS_U32_MARK=y
1513
-CONFIG_NET_CLS_RSVP=m
1514
-CONFIG_NET_CLS_RSVP6=m
1515 1513
 CONFIG_NET_CLS_FLOW=m
1516 1514
 CONFIG_NET_CLS_CGROUP=m
1517 1515
 CONFIG_NET_CLS_BPF=m
... ...
@@ -1597,8 +1597,6 @@ CONFIG_NET_CLS_FW=m
1597 1597
 CONFIG_NET_CLS_U32=m
1598 1598
 CONFIG_CLS_U32_PERF=y
1599 1599
 CONFIG_CLS_U32_MARK=y
1600
-CONFIG_NET_CLS_RSVP=m
1601
-CONFIG_NET_CLS_RSVP6=m
1602 1600
 CONFIG_NET_CLS_FLOW=m
1603 1601
 CONFIG_NET_CLS_CGROUP=m
1604 1602
 CONFIG_NET_CLS_BPF=m
... ...
@@ -23,7 +23,7 @@
23 23
 Summary:        Kernel
24 24
 Name:           linux-esx
25 25
 Version:        6.1.53
26
-Release:        1%{?kat_build:.kat}%{?dist}
26
+Release:        2%{?kat_build:.kat}%{?dist}
27 27
 License:        GPLv2
28 28
 URL:            http://www.kernel.org
29 29
 Group:          System Environment/Kernel
... ...
@@ -168,6 +168,8 @@ Patch100: 6.0-0003-apparmor-fix-use-after-free-in-sk_peer_label.patch
168 168
 Patch101: KVM-Don-t-accept-obviously-wrong-gsi-values-via-KVM_.patch
169 169
 #Fix CVE-2023-28464
170 170
 Patch102: 0001-Bluetooth-Fix-double-free-in-hci_conn_cleanup.patch
171
+#Fix CVE-2023-42755
172
+Patch103: net-sched-retire-rsvp-classifier.patch
171 173
 
172 174
 # Fix: net: roundup issue in kmalloc_reserve()
173 175
 Patch111: 0001-net-add-SKB_HEAD_ALIGN-helper.patch
... ...
@@ -533,6 +535,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
533 533
 %{_usrsrc}/linux-headers-%{uname_r}
534 534
 
535 535
 %changelog
536
+* Thu Nov 23 2023 Keerthana K <keerthanak@vmware.com> 6.1.53-2
537
+- Fix for CVE-2023-42755
536 538
 * Thu Nov 23 2023 Roye Eshed <eshedr@vmware.com> 6.1.53-1
537 539
 - Update to version 6.1.53
538 540
 * Thu Nov 23 2023 Ajay Kaher <akaher@vmware.com> 6.1.45-7
... ...
@@ -16,7 +16,7 @@
16 16
 Summary:        Kernel
17 17
 Name:           linux-rt
18 18
 Version:        6.1.53
19
-Release:        1%{?kat_build:.kat}%{?dist}
19
+Release:        2%{?kat_build:.kat}%{?dist}
20 20
 License:        GPLv2
21 21
 URL:            http://www.kernel.org
22 22
 Group:          System Environment/Kernel
... ...
@@ -131,6 +131,8 @@ Patch61: 0001-x86-boot-unconditional-preserve-CR4.MCE.patch
131 131
 Patch100: 6.0-0003-apparmor-fix-use-after-free-in-sk_peer_label.patch
132 132
 #Fix CVE-2023-28464
133 133
 Patch101: 0001-Bluetooth-Fix-double-free-in-hci_conn_cleanup.patch
134
+#Fix CVE-2023-42755
135
+Patch102: net-sched-retire-rsvp-classifier.patch
134 136
 
135 137
 # Fix: net: roundup issue in kmalloc_reserve()
136 138
 Patch111: 0001-net-add-SKB_HEAD_ALIGN-helper.patch
... ...
@@ -564,6 +566,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
564 564
 %{_usrsrc}/linux-headers-%{uname_r}
565 565
 
566 566
 %changelog
567
+* Thu Nov 23 2023 Keerthana K <keerthanak@vmware.com> 6.1.53-2
568
+- Fix for CVE-2023-42755
567 569
 * Thu Nov 23 2023 Roye Eshed <eshedr@vmware.com> 6.1.53-1
568 570
 - Update to version 6.1.53
569 571
 * Thu Nov 23 2023 Alexey Makhalov <amakhalov@vmware.com> 6.1.45-8
... ...
@@ -16,7 +16,7 @@
16 16
 Summary:        Kernel
17 17
 Name:           linux-secure
18 18
 Version:        6.1.53
19
-Release:        1%{?kat_build:.kat}%{?dist}
19
+Release:        2%{?kat_build:.kat}%{?dist}
20 20
 License:        GPLv2
21 21
 URL:            http://www.kernel.org
22 22
 Group:          System Environment/Kernel
... ...
@@ -124,6 +124,8 @@ Patch61: 0001-x86-boot-unconditional-preserve-CR4.MCE.patch
124 124
 Patch100: KVM-Don-t-accept-obviously-wrong-gsi-values-via-KVM_.patch
125 125
 #Fix CVE-2023-28464
126 126
 Patch101: 0001-Bluetooth-Fix-double-free-in-hci_conn_cleanup.patch
127
+#Fix CVE-2023-42755
128
+Patch102: net-sched-retire-rsvp-classifier.patch
127 129
 
128 130
 # Fix: net: roundup issue in kmalloc_reserve()
129 131
 Patch111: 0001-net-add-SKB_HEAD_ALIGN-helper.patch
... ...
@@ -464,6 +466,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
464 464
 %endif
465 465
 
466 466
 %changelog
467
+* Thu Nov 23 2023 Keerthana K <keerthanak@vmware.com> 6.1.53-2
468
+- Fix for CVE-2023-42755
467 469
 * Thu Nov 23 2023 Roye Eshed <eshedr@vmware.com> 6.1.53-1
468 470
 - Update to version 6.1.53
469 471
 * Thu Nov 23 2023 Alexey Makhalov <amakhalov@vmware.com> 6.1.45-9
... ...
@@ -23,7 +23,7 @@
23 23
 Summary:        Kernel
24 24
 Name:           linux
25 25
 Version:        6.1.53
26
-Release:        1%{?kat_build:.kat}%{?dist}
26
+Release:        2%{?kat_build:.kat}%{?dist}
27 27
 License:        GPLv2
28 28
 URL:            http://www.kernel.org/
29 29
 Group:          System Environment/Kernel
... ...
@@ -143,6 +143,8 @@ Patch100: 6.0-0003-apparmor-fix-use-after-free-in-sk_peer_label.patch
143 143
 Patch101: KVM-Don-t-accept-obviously-wrong-gsi-values-via-KVM_.patch
144 144
 #Fix CVE-2023-28464
145 145
 Patch102: 0001-Bluetooth-Fix-double-free-in-hci_conn_cleanup.patch
146
+#Fix CVE-2023-42755
147
+Patch103: net-sched-retire-rsvp-classifier.patch
146 148
 
147 149
 # Fix: net: roundup issue in kmalloc_reserve()
148 150
 Patch111: 0001-net-add-SKB_HEAD_ALIGN-helper.patch
... ...
@@ -750,6 +752,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
750 750
 %{_datadir}/bash-completion/completions/bpftool
751 751
 
752 752
 %changelog
753
+* Thu Nov 23 2023 Keerthana K <keerthanak@vmware.com> 6.1.53-2
754
+- Fix for CVE-2023-42755
753 755
 * Thu Nov 23 2023 Roye Eshed <eshedr@vmware.com> 6.1.53-1
754 756
 - Update to version 6.1.53
755 757
 * Thu Nov 23 2023 Ajay Kaher <akaher@vmware.com> 6.1.45-7