All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/1] ipset patch for nf
@ 2017-09-23 21:37 Jozsef Kadlecsik
  2017-09-23 21:37 ` [PATCH 1/1] Fix adding an IPv4 range containing more than 2^31 addresses Jozsef Kadlecsik
  0 siblings, 1 reply; 12+ messages in thread
From: Jozsef Kadlecsik @ 2017-09-23 21:37 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

Hi Pablo,

Please apply the next patch for the nf tree. It fixes the issue
when an IP range with more than 2^31 addresses was specified to
add (bugzilla id #1005)

- Fix adding an IPv4 range containing more than 2^31 addresses,
  which failed silently due to wrong comparison (bugzilla id #1005).

Thanks,
Jozsef
-

The following changes since commit 7f4f7dd4417d9efd038b14d39c70170db2e0baa0:

  netfilter: ipset: ipset list may return wrong member count for set with timeout (2017-09-18 17:35:32 +0200)

are available in the git repository at:

  git://blackhole.kfki.hu/nf 

for you to fetch changes up to 625a0411a81ae51c12bde4452171f08174b656cd:

  Fix adding an IPv4 range containing more than 2^31 addresses (2017-09-23 23:28:13 +0200)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      Fix adding an IPv4 range containing more than 2^31 addresses

 net/netfilter/ipset/ip_set_hash_ip.c         | 22 ++++++++++++----------
 net/netfilter/ipset/ip_set_hash_ipmark.c     |  2 +-
 net/netfilter/ipset/ip_set_hash_ipport.c     |  2 +-
 net/netfilter/ipset/ip_set_hash_ipportip.c   |  2 +-
 net/netfilter/ipset/ip_set_hash_ipportnet.c  |  4 ++--
 net/netfilter/ipset/ip_set_hash_net.c        |  2 +-
 net/netfilter/ipset/ip_set_hash_netiface.c   |  2 +-
 net/netfilter/ipset/ip_set_hash_netnet.c     |  4 ++--
 net/netfilter/ipset/ip_set_hash_netport.c    |  2 +-
 net/netfilter/ipset/ip_set_hash_netportnet.c |  4 ++--
 10 files changed, 24 insertions(+), 22 deletions(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 1/1] Fix adding an IPv4 range containing more than 2^31 addresses
  2017-09-23 21:37 [PATCH 0/1] ipset patch for nf Jozsef Kadlecsik
@ 2017-09-23 21:37 ` Jozsef Kadlecsik
  2017-09-26 18:01   ` Pablo Neira Ayuso
  0 siblings, 1 reply; 12+ messages in thread
From: Jozsef Kadlecsik @ 2017-09-23 21:37 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

Wrong comparison prevented the hash types to add a range with
more than 2^31 addresses but reported as a success.

Fixes bugzilla id #1005, reported by Oleg Serditov and Oliver Ford.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
---
 net/netfilter/ipset/ip_set_hash_ip.c         | 22 ++++++++++++----------
 net/netfilter/ipset/ip_set_hash_ipmark.c     |  2 +-
 net/netfilter/ipset/ip_set_hash_ipport.c     |  2 +-
 net/netfilter/ipset/ip_set_hash_ipportip.c   |  2 +-
 net/netfilter/ipset/ip_set_hash_ipportnet.c  |  4 ++--
 net/netfilter/ipset/ip_set_hash_net.c        |  2 +-
 net/netfilter/ipset/ip_set_hash_netiface.c   |  2 +-
 net/netfilter/ipset/ip_set_hash_netnet.c     |  4 ++--
 net/netfilter/ipset/ip_set_hash_netport.c    |  2 +-
 net/netfilter/ipset/ip_set_hash_netportnet.c |  4 ++--
 10 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index 20bfbd3..613eb21 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -123,13 +123,12 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
 		return ret;
 
 	ip &= ip_set_hostmask(h->netmask);
+	e.ip = htonl(ip);
+	if (e.ip == 0)
+		return -IPSET_ERR_HASH_ELEM;
 
-	if (adt == IPSET_TEST) {
-		e.ip = htonl(ip);
-		if (e.ip == 0)
-			return -IPSET_ERR_HASH_ELEM;
+	if (adt == IPSET_TEST)
 		return adtfn(set, &e, &ext, &ext, flags);
-	}
 
 	ip_to = ip;
 	if (tb[IPSET_ATTR_IP_TO]) {
@@ -148,17 +147,20 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);
 
-	if (retried)
+	if (retried) {
 		ip = ntohl(h->next.ip);
-	for (; !before(ip_to, ip); ip += hosts) {
 		e.ip = htonl(ip);
-		if (e.ip == 0)
-			return -IPSET_ERR_HASH_ELEM;
+	}
+	for (; ip <= ip_to;) {
 		ret = adtfn(set, &e, &ext, &ext, flags);
-
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
 
+		ip += hosts;
+		e.ip = htonl(ip);
+		if (e.ip == 0)
+			return 0;
+
 		ret = 0;
 	}
 	return ret;
diff --git a/net/netfilter/ipset/ip_set_hash_ipmark.c b/net/netfilter/ipset/ip_set_hash_ipmark.c
index b64cf14..f3ba834 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmark.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmark.c
@@ -149,7 +149,7 @@ hash_ipmark4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (retried)
 		ip = ntohl(h->next.ip);
-	for (; !before(ip_to, ip); ip++) {
+	for (; ip <= ip_to; ip++) {
 		e.ip = htonl(ip);
 		ret = adtfn(set, &e, &ext, &ext, flags);
 
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index f438740..ddb8039 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -178,7 +178,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (retried)
 		ip = ntohl(h->next.ip);
-	for (; !before(ip_to, ip); ip++) {
+	for (; ip <= ip_to; ip++) {
 		p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
 						       : port;
 		for (; p <= port_to; p++) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 6215fb8..a7f4d7a 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -185,7 +185,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (retried)
 		ip = ntohl(h->next.ip);
-	for (; !before(ip_to, ip); ip++) {
+	for (; ip <= ip_to; ip++) {
 		p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
 						       : port;
 		for (; p <= port_to; p++) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 5ab1b99..a2f19b9 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -271,7 +271,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (retried)
 		ip = ntohl(h->next.ip);
-	for (; !before(ip_to, ip); ip++) {
+	for (; ip <= ip_to; ip++) {
 		e.ip = htonl(ip);
 		p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
 						       : port;
@@ -281,7 +281,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 			      ip == ntohl(h->next.ip) &&
 			      p == ntohs(h->next.port)
 				? ntohl(h->next.ip2) : ip2_from;
-			while (!after(ip2, ip2_to)) {
+			while (ip2 <= ip2_to) {
 				e.ip2 = htonl(ip2);
 				ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
 								&cidr);
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 5d9e8954..1c67a17 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -193,7 +193,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
 	}
 	if (retried)
 		ip = ntohl(h->next.ip);
-	while (!after(ip, ip_to)) {
+	while (ip <= ip_to) {
 		e.ip = htonl(ip);
 		last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
 		ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 44cf119..d417074 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -255,7 +255,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (retried)
 		ip = ntohl(h->next.ip);
-	while (!after(ip, ip_to)) {
+	while (ip <= ip_to) {
 		e.ip = htonl(ip);
 		last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
 		ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index db614e1..7f9ae2e 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -250,13 +250,13 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 	if (retried)
 		ip = ntohl(h->next.ip[0]);
 
-	while (!after(ip, ip_to)) {
+	while (ip <= ip_to) {
 		e.ip[0] = htonl(ip);
 		last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
 		ip2 = (retried &&
 		       ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
 						   : ip2_from;
-		while (!after(ip2, ip2_to)) {
+		while (ip2 <= ip2_to) {
 			e.ip[1] = htonl(ip2);
 			last2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
 			ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 54b64b6..e6ef382 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -241,7 +241,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (retried)
 		ip = ntohl(h->next.ip);
-	while (!after(ip, ip_to)) {
+	while (ip <= ip_to) {
 		e.ip = htonl(ip);
 		last = ip_set_range_to_cidr(ip, ip_to, &cidr);
 		e.cidr = cidr - 1;
diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
index aff8469..8602f25 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -291,7 +291,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 	if (retried)
 		ip = ntohl(h->next.ip[0]);
 
-	while (!after(ip, ip_to)) {
+	while (ip <= ip_to) {
 		e.ip[0] = htonl(ip);
 		ip_last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
 		p = retried && ip == ntohl(h->next.ip[0]) ? ntohs(h->next.port)
@@ -301,7 +301,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 			ip2 = (retried && ip == ntohl(h->next.ip[0]) &&
 			       p == ntohs(h->next.port)) ? ntohl(h->next.ip[1])
 							 : ip2_from;
-			while (!after(ip2, ip2_to)) {
+			while (ip2 <= ip2_to) {
 				e.ip[1] = htonl(ip2);
 				ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
 								&e.cidr[1]);
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [PATCH 1/1] Fix adding an IPv4 range containing more than 2^31 addresses
  2017-09-23 21:37 ` [PATCH 1/1] Fix adding an IPv4 range containing more than 2^31 addresses Jozsef Kadlecsik
@ 2017-09-26 18:01   ` Pablo Neira Ayuso
  2017-09-26 18:45     ` Jozsef Kadlecsik
  0 siblings, 1 reply; 12+ messages in thread
From: Pablo Neira Ayuso @ 2017-09-26 18:01 UTC (permalink / raw)
  To: Jozsef Kadlecsik; +Cc: netfilter-devel

On Sat, Sep 23, 2017 at 11:37:40PM +0200, Jozsef Kadlecsik wrote:
> Wrong comparison prevented the hash types to add a range with
> more than 2^31 addresses but reported as a success.
> 
> Fixes bugzilla id #1005, reported by Oleg Serditov and Oliver Ford.

Applied, thanks Jozsef.

Jozsef, I'm prepending the following to this patch title: "netfilter: ipset:"

^ permalink raw reply	[flat|nested] 12+ messages in thread
* Re: [PATCH 1/1] Fix adding an IPv4 range containing more than 2^31 addresses
  2017-09-26 18:01   ` Pablo Neira Ayuso
@ 2017-09-26 18:45     ` Jozsef Kadlecsik
  0 siblings, 0 replies; 12+ messages in thread
From: Jozsef Kadlecsik @ 2017-09-26 18:45 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel

On Tue, 26 Sep 2017, Pablo Neira Ayuso wrote:

> On Sat, Sep 23, 2017 at 11:37:40PM +0200, Jozsef Kadlecsik wrote:
> > Wrong comparison prevented the hash types to add a range with
> > more than 2^31 addresses but reported as a success.
> > 
> > Fixes bugzilla id #1005, reported by Oleg Serditov and Oliver Ford.
> 
> Applied, thanks Jozsef.
> 
> Jozsef, I'm prepending the following to this patch title: "netfilter: ipset:"

I forgot to add that prefix... Thanks indeed!

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 0/1] ipset patch for nf
@ 2020-02-18 12:19 Jozsef Kadlecsik
  0 siblings, 0 replies; 12+ messages in thread
From: Jozsef Kadlecsik @ 2020-02-18 12:19 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso, Hillf Danton

Hi Pablo,

Please consider to apply the next patch to the nf tree. It's larger than
usual, but the issue could not be solved simpler.

- Fix "INFO: rcu detected stall in hash_xxx" reports of syzbot
  by introducing region locking and using workqueue instead of timer based
  gc of timed out entries in hash types of sets in ipset.

Best regards,
Jozsef

The following changes since commit 83d0585f91da441a0b11bc5ff93f4cda56de6703:

  Merge branch 'Fix-reconnection-latency-caused-by-FIN-ACK-handling-race' (2020-02-02 13:45:05 -0800)

are available in the Git repository at:

  git://blackhole.kfki.hu/nf f431c76a1f36bcd6bbfd

for you to fetch changes up to f431c76a1f36bcd6bbfd668a98127ac60226b86f:

  netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (2020-02-18 11:19:06 +0100)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports

 include/linux/netfilter/ipset/ip_set.h |  11 +-
 net/netfilter/ipset/ip_set_core.c      |  34 +-
 net/netfilter/ipset/ip_set_hash_gen.h  | 633 +++++++++++++++++++++++----------
 3 files changed, 472 insertions(+), 206 deletions(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread
* Re: [PATCH 0/1] ipset patch for nf
  2016-03-16 21:02 Jozsef Kadlecsik
@ 2016-03-21 21:37 ` Pablo Neira Ayuso
  0 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-03-21 21:37 UTC (permalink / raw)
  To: Jozsef Kadlecsik; +Cc: netfilter-devel

On Wed, Mar 16, 2016 at 10:02:29PM +0100, Jozsef Kadlecsik wrote:
> Hi Pablo,
> 
> Please apply the next patch against the nf tree:
> 
> - There was a race condition between parallel save/swap and delete,
>   which resulted a kernel crash due to the increase ref for save, swap,
>   wrong ref decrease operations. Reported and fixed by Vishwanath Pai.
> 
> The patch should be applied to the older stable kernel branches too.
> 
> Best regards,
> Jozsef
> 
> The following changes since commit fe1c3e3f630ef7765f34d9585d6b524899502b3f:
> 
>   netfilter: ipset: Check IPSET_ATTR_ETHER netlink attribute length (2016-03-16 21:43:50 +0100)
> 
> are available in the git repository at:
> 
>   git://blackhole.kfki.hu/nf master

Pulled, thanks Jozsef.

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 0/1] ipset patch for nf
@ 2016-03-16 21:02 Jozsef Kadlecsik
  2016-03-21 21:37 ` Pablo Neira Ayuso
  0 siblings, 1 reply; 12+ messages in thread
From: Jozsef Kadlecsik @ 2016-03-16 21:02 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

Hi Pablo,

Please apply the next patch against the nf tree:

- There was a race condition between parallel save/swap and delete,
  which resulted a kernel crash due to the increase ref for save, swap,
  wrong ref decrease operations. Reported and fixed by Vishwanath Pai.

The patch should be applied to the older stable kernel branches too.

Best regards,
Jozsef

The following changes since commit fe1c3e3f630ef7765f34d9585d6b524899502b3f:

  netfilter: ipset: Check IPSET_ATTR_ETHER netlink attribute length (2016-03-16 21:43:50 +0100)

are available in the git repository at:

  git://blackhole.kfki.hu/nf master

for you to fetch changes up to 17f8a7334f3aee9783cfa6787172240c083ef394:

  netfilter: ipset: fix race condition in ipset save, swap and delete (2016-03-16 21:49:00 +0100)

----------------------------------------------------------------
Vishwanath Pai (1):
      netfilter: ipset: fix race condition in ipset save, swap and delete

 include/linux/netfilter/ipset/ip_set.h  |  4 ++++
 net/netfilter/ipset/ip_set_bitmap_gen.h |  2 +-
 net/netfilter/ipset/ip_set_core.c       | 33 ++++++++++++++++++++++++++++-----
 net/netfilter/ipset/ip_set_hash_gen.h   |  2 +-
 net/netfilter/ipset/ip_set_list_set.c   |  2 +-
 5 files changed, 35 insertions(+), 8 deletions(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread
* Re: [PATCH 0/1] ipset patch for nf
  2016-03-08 19:44 Jozsef Kadlecsik
@ 2016-03-10 18:28 ` Pablo Neira Ayuso
  0 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-03-10 18:28 UTC (permalink / raw)
  To: Jozsef Kadlecsik; +Cc: netfilter-devel

On Tue, Mar 08, 2016 at 08:44:19PM +0100, Jozsef Kadlecsik wrote:
> Hi Pablo,
> 
> Please apply the next patch against the nf tree:
> 
> - Julia Lawall pointed out that IPSET_ATTR_ETHER netlink attribute
>   length was not checked explicitly. The patch adds the missing
>   checkings.
> 
> The patch should be applied to the older stable kernel branches too.
> 
> Best regards,
> Jozsef
> 
> The following changes since commit 45040978c8994d1401baf5cc5ac71c1495d4e120:
> 
>   netfilter: ipset: Fix set:list type crash when flush/dump set in parallel (2016-02-24 20:32:21 +0100)
> 
> are available in the git repository at:
> 
>   git://blackhole.kfki.hu/nf master

This patch also came with the previous pull, so this will show up in
the nf-next tree too.

Thanks.

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 0/1] ipset patch for nf
@ 2016-03-08 19:44 Jozsef Kadlecsik
  2016-03-10 18:28 ` Pablo Neira Ayuso
  0 siblings, 1 reply; 12+ messages in thread
From: Jozsef Kadlecsik @ 2016-03-08 19:44 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

Hi Pablo,

Please apply the next patch against the nf tree:

- Julia Lawall pointed out that IPSET_ATTR_ETHER netlink attribute
  length was not checked explicitly. The patch adds the missing
  checkings.

The patch should be applied to the older stable kernel branches too.

Best regards,
Jozsef

The following changes since commit 45040978c8994d1401baf5cc5ac71c1495d4e120:

  netfilter: ipset: Fix set:list type crash when flush/dump set in parallel (2016-02-24 20:32:21 +0100)

are available in the git repository at:

  git://blackhole.kfki.hu/nf master

for you to fetch changes up to d8aacd87180141ff6b812b53de77a4336e87c91a:

  netfilter: ipset: Check IPSET_ATTR_ETHER netlink attribute length (2016-03-08 20:36:17 +0100)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      netfilter: ipset: Check IPSET_ATTR_ETHER netlink attribute length

 net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 ++
 net/netfilter/ipset/ip_set_hash_mac.c     | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 0/1] ipset patch for nf
@ 2016-02-24 20:19 Jozsef Kadlecsik
  0 siblings, 0 replies; 12+ messages in thread
From: Jozsef Kadlecsik @ 2016-02-24 20:19 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

Hi Pablo,

Please apply the next patch against the nf tree:

- Deniz Eren reported that parallel flush/dump of list:set type of sets
  can lead to kernel crash. The bug was due to non-RCU compatible flushing,
  listing in the set type, fixed by me.

The following changes since commit 5cc6ce9ff27565949a1001a2889a8dd9fd09e772:

  netfilter: nft_counter: fix erroneous return values (2016-02-08 13:05:02 +0100)

are available in the git repository at:

  git://blackhole.kfki.hu/nf master

for you to fetch changes up to 45040978c8994d1401baf5cc5ac71c1495d4e120:

  netfilter: ipset: Fix set:list type crash when flush/dump set in parallel (2016-02-24 20:32:21 +0100)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      netfilter: ipset: Fix set:list type crash when flush/dump set in parallel

 net/netfilter/ipset/ip_set_core.c     |  3 +++
 net/netfilter/ipset/ip_set_list_set.c | 55 ++++++++++++++++++++++--------------------------
 2 files changed, 28 insertions(+), 30 deletions(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread
* Re: [PATCH 0/1] ipset patch for nf
  2015-08-28 17:15 Jozsef Kadlecsik
@ 2015-08-28 23:03 ` Pablo Neira Ayuso
  0 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2015-08-28 23:03 UTC (permalink / raw)
  To: Jozsef Kadlecsik; +Cc: netfilter-devel

On Fri, Aug 28, 2015 at 07:15:51PM +0200, Jozsef Kadlecsik wrote:
> Hi Pablo,
> 
> Please apply the next bugfix patch against the nf tree.
> 
> - Dave Jones reported that KASan detected out of bounds access in hash:net*
>   types, which is fixed in the next patch
> 
> Thanks,
> Jozsef
> 
> The following changes since commit 18e1db67e93ed75d9dc0d34c8d783ccf10547c2b:
> 
>   netfilter: bridge: fix IPv6 packets not being bridged with CONFIG_IPV6=n (2015-08-19 21:21:41 +0200)
> 
> are available in the git repository at:
> 
>   git://blackhole.kfki.hu/nf master

Pulled into nf, thanks Jozsef.

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 0/1] ipset patch for nf
@ 2015-08-28 17:15 Jozsef Kadlecsik
  2015-08-28 23:03 ` Pablo Neira Ayuso
  0 siblings, 1 reply; 12+ messages in thread
From: Jozsef Kadlecsik @ 2015-08-28 17:15 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

Hi Pablo,

Please apply the next bugfix patch against the nf tree.

- Dave Jones reported that KASan detected out of bounds access in hash:net*
  types, which is fixed in the next patch

Thanks,
Jozsef

The following changes since commit 18e1db67e93ed75d9dc0d34c8d783ccf10547c2b:

  netfilter: bridge: fix IPv6 packets not being bridged with CONFIG_IPV6=n (2015-08-19 21:21:41 +0200)

are available in the git repository at:

  git://blackhole.kfki.hu/nf master

for you to fetch changes up to 6fe7ccfd77415a6ba250c10c580eb3f9acf79753:

  netfilter: ipset: Out of bound access in hash:net* types fixed (2015-08-28 18:51:30 +0200)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      netfilter: ipset: Out of bound access in hash:net* types fixed

 net/netfilter/ipset/ip_set_hash_gen.h | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
kadlec@blackhole ~/git/nf $ 

^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2020-02-18 12:19 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-09-23 21:37 [PATCH 0/1] ipset patch for nf Jozsef Kadlecsik
2017-09-23 21:37 ` [PATCH 1/1] Fix adding an IPv4 range containing more than 2^31 addresses Jozsef Kadlecsik
2017-09-26 18:01   ` Pablo Neira Ayuso
2017-09-26 18:45     ` Jozsef Kadlecsik
  -- strict thread matches above, loose matches on Subject: below --
2020-02-18 12:19 [PATCH 0/1] ipset patch for nf Jozsef Kadlecsik
2016-03-16 21:02 Jozsef Kadlecsik
2016-03-21 21:37 ` Pablo Neira Ayuso
2016-03-08 19:44 Jozsef Kadlecsik
2016-03-10 18:28 ` Pablo Neira Ayuso
2016-02-24 20:19 Jozsef Kadlecsik
2015-08-28 17:15 Jozsef Kadlecsik
2015-08-28 23:03 ` Pablo Neira Ayuso

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.