* [PATCH net 0/6] Netfilter fixes for net
@ 2024-04-04 10:43 Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path Pablo Neira Ayuso
` (5 more replies)
0 siblings, 6 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 unlike early commit path stage which triggers a call to abort,
an explicit release of the batch is required on abort, otherwise
mutex is released and commit_list remains in place.
Patch #2 release mutex after nft_gc_seq_end() in commit path, otherwise
async GC worker could collect expired objects.
Patch #3 flush pending destroy work in module removal path, otherwise UaF
is possible.
Patch #4 and #6 restrict the table dormant flag with basechain updates
to fix state inconsistency in the hook registration.
Patch #5 adds missing RCU read side lock to flowtable type to avoid races
with module removal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-04-04
Thanks.
----------------------------------------------------------------
The following changes since commit 72076fc9fe60b9143cd971fd8737718719bc512e:
Revert "tg3: Remove residual error handling in tg3_suspend" (2024-04-04 10:51:01 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-04-04
for you to fetch changes up to 1bc83a019bbe268be3526406245ec28c2458a518:
netfilter: nf_tables: discard table flag update with pending basechain deletion (2024-04-04 11:38:35 +0200)
----------------------------------------------------------------
netfilter pull request 24-04-04
----------------------------------------------------------------
Pablo Neira Ayuso (5):
netfilter: nf_tables: release batch on table validation from abort path
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
netfilter: nf_tables: flush pending destroy work before exit_net release
netfilter: nf_tables: reject new basechain after table flag update
netfilter: nf_tables: discard table flag update with pending basechain deletion
Ziyang Xuan (1):
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
net/netfilter/nf_tables_api.c | 50 +++++++++++++++++++++++++++++--------------
1 file changed, 34 insertions(+), 16 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
@ 2024-04-04 10:43 ` Pablo Neira Ayuso
2024-04-04 16:50 ` patchwork-bot+netdevbpf
2024-04-04 10:43 ` [PATCH net 2/6] netfilter: nf_tables: release mutex after nft_gc_seq_end " Pablo Neira Ayuso
` (4 subsequent siblings)
5 siblings, 1 reply; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Unlike early commit path stage which triggers a call to abort, an
explicit release of the batch is required on abort, otherwise mutex is
released and commit_list remains in place.
Add WARN_ON_ONCE to ensure commit_list is empty from the abort path
before releasing the mutex.
After this patch, commit_list is always assumed to be empty before
grabbing the mutex, therefore
03c1f1ef1584 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()")
only needs to release the pending modules for registration.
Cc: stable@vger.kernel.org
Fixes: c0391b6ab810 ("netfilter: nf_tables: missing validation from the abort path")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index fd86f2720c9e..ffcd3213c335 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10455,10 +10455,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
struct nft_trans *trans, *next;
LIST_HEAD(set_update_list);
struct nft_trans_elem *te;
+ int err = 0;
if (action == NFNL_ABORT_VALIDATE &&
nf_tables_validate(net) < 0)
- return -EAGAIN;
+ err = -EAGAIN;
list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,
list) {
@@ -10655,7 +10656,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
else
nf_tables_module_autoload_cleanup(net);
- return 0;
+ return err;
}
static int nf_tables_abort(struct net *net, struct sk_buff *skb,
@@ -10668,6 +10669,9 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb,
gc_seq = nft_gc_seq_begin(nft_net);
ret = __nf_tables_abort(net, action);
nft_gc_seq_end(nft_net, gc_seq);
+
+ WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
+
mutex_unlock(&nft_net->commit_mutex);
return ret;
@@ -11473,9 +11477,10 @@ static void __net_exit nf_tables_exit_net(struct net *net)
gc_seq = nft_gc_seq_begin(nft_net);
- if (!list_empty(&nft_net->commit_list) ||
- !list_empty(&nft_net->module_list))
- __nf_tables_abort(net, NFNL_ABORT_NONE);
+ WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
+
+ if (!list_empty(&nft_net->module_list))
+ nf_tables_module_autoload_cleanup(net);
__nft_release_tables(net);
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* Re: [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path
2024-04-04 10:43 ` [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path Pablo Neira Ayuso
@ 2024-04-04 16:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 19+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-04-04 16:50 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
Hello:
This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Thu, 4 Apr 2024 12:43:29 +0200 you wrote:
> Unlike early commit path stage which triggers a call to abort, an
> explicit release of the batch is required on abort, otherwise mutex is
> released and commit_list remains in place.
>
> Add WARN_ON_ONCE to ensure commit_list is empty from the abort path
> before releasing the mutex.
>
> [...]
Here is the summary with links:
- [net,1/6] netfilter: nf_tables: release batch on table validation from abort path
https://git.kernel.org/netdev/net/c/a45e6889575c
- [net,2/6] netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
https://git.kernel.org/netdev/net/c/0d459e2ffb54
- [net,3/6] netfilter: nf_tables: flush pending destroy work before exit_net release
https://git.kernel.org/netdev/net/c/24cea9677025
- [net,4/6] netfilter: nf_tables: reject new basechain after table flag update
https://git.kernel.org/netdev/net/c/994209ddf4f4
- [net,5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
https://git.kernel.org/netdev/net/c/24225011d81b
- [net,6/6] netfilter: nf_tables: discard table flag update with pending basechain deletion
https://git.kernel.org/netdev/net/c/1bc83a019bbe
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 2/6] netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path Pablo Neira Ayuso
@ 2024-04-04 10:43 ` Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 3/6] netfilter: nf_tables: flush pending destroy work before exit_net release Pablo Neira Ayuso
` (3 subsequent siblings)
5 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
The commit mutex should not be released during the critical section
between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC
worker could collect expired objects and get the released commit lock
within the same GC sequence.
nf_tables_module_autoload() temporarily releases the mutex to load
module dependencies, then it goes back to replay the transaction again.
Move it at the end of the abort phase after nft_gc_seq_end() is called.
Cc: stable@vger.kernel.org
Fixes: 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path")
Reported-by: Kuan-Ting Chen <hexrabbit@devco.re>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ffcd3213c335..0d432d0674e1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10651,11 +10651,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nf_tables_abort_release(trans);
}
- if (action == NFNL_ABORT_AUTOLOAD)
- nf_tables_module_autoload(net);
- else
- nf_tables_module_autoload_cleanup(net);
-
return err;
}
@@ -10672,6 +10667,14 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb,
WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
+ /* module autoload needs to happen after GC sequence update because it
+ * temporarily releases and grabs mutex again.
+ */
+ if (action == NFNL_ABORT_AUTOLOAD)
+ nf_tables_module_autoload(net);
+ else
+ nf_tables_module_autoload_cleanup(net);
+
mutex_unlock(&nft_net->commit_mutex);
return ret;
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 3/6] netfilter: nf_tables: flush pending destroy work before exit_net release
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 2/6] netfilter: nf_tables: release mutex after nft_gc_seq_end " Pablo Neira Ayuso
@ 2024-04-04 10:43 ` Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 4/6] netfilter: nf_tables: reject new basechain after table flag update Pablo Neira Ayuso
` (2 subsequent siblings)
5 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy
work before netlink notifier") to address a race between exit_net and
the destroy workqueue.
The trace below shows an element to be released via destroy workqueue
while exit_net path (triggered via module removal) has already released
the set that is used in such transaction.
[ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]
[ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465
[ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359
[ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables]
[ 1360.547984] Call Trace:
[ 1360.547991] <TASK>
[ 1360.547998] dump_stack_lvl+0x53/0x70
[ 1360.548014] print_report+0xc4/0x610
[ 1360.548026] ? __virt_addr_valid+0xba/0x160
[ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]
[ 1360.548176] kasan_report+0xae/0xe0
[ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]
[ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]
[ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables]
[ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30
[ 1360.548591] process_one_work+0x2f1/0x670
[ 1360.548610] worker_thread+0x4d3/0x760
[ 1360.548627] ? __pfx_worker_thread+0x10/0x10
[ 1360.548640] kthread+0x16b/0x1b0
[ 1360.548653] ? __pfx_kthread+0x10/0x10
[ 1360.548665] ret_from_fork+0x2f/0x50
[ 1360.548679] ? __pfx_kthread+0x10/0x10
[ 1360.548690] ret_from_fork_asm+0x1a/0x30
[ 1360.548707] </TASK>
[ 1360.548719] Allocated by task 192061:
[ 1360.548726] kasan_save_stack+0x20/0x40
[ 1360.548739] kasan_save_track+0x14/0x30
[ 1360.548750] __kasan_kmalloc+0x8f/0xa0
[ 1360.548760] __kmalloc_node+0x1f1/0x450
[ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables]
[ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink]
[ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink]
[ 1360.548927] netlink_unicast+0x367/0x4f0
[ 1360.548935] netlink_sendmsg+0x34b/0x610
[ 1360.548944] ____sys_sendmsg+0x4d4/0x510
[ 1360.548953] ___sys_sendmsg+0xc9/0x120
[ 1360.548961] __sys_sendmsg+0xbe/0x140
[ 1360.548971] do_syscall_64+0x55/0x120
[ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d
[ 1360.548994] Freed by task 192222:
[ 1360.548999] kasan_save_stack+0x20/0x40
[ 1360.549009] kasan_save_track+0x14/0x30
[ 1360.549019] kasan_save_free_info+0x3b/0x60
[ 1360.549028] poison_slab_object+0x100/0x180
[ 1360.549036] __kasan_slab_free+0x14/0x30
[ 1360.549042] kfree+0xb6/0x260
[ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables]
[ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables]
[ 1360.549221] ops_exit_list+0x50/0xa0
[ 1360.549229] free_exit_list+0x101/0x140
[ 1360.549236] unregister_pernet_operations+0x107/0x160
[ 1360.549245] unregister_pernet_subsys+0x1c/0x30
[ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables]
[ 1360.549345] __do_sys_delete_module+0x253/0x370
[ 1360.549352] do_syscall_64+0x55/0x120
[ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d
(gdb) list *__nft_release_table+0x473
0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354).
11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
11350 list_del(&flowtable->list);
11351 nft_use_dec(&table->use);
11352 nf_tables_flowtable_destroy(flowtable);
11353 }
11354 list_for_each_entry_safe(set, ns, &table->sets, list) {
11355 list_del(&set->list);
11356 nft_use_dec(&table->use);
11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
11358 nft_map_deactivate(&ctx, set);
(gdb)
[ 1360.549372] Last potentially related work creation:
[ 1360.549376] kasan_save_stack+0x20/0x40
[ 1360.549384] __kasan_record_aux_stack+0x9b/0xb0
[ 1360.549392] __queue_work+0x3fb/0x780
[ 1360.549399] queue_work_on+0x4f/0x60
[ 1360.549407] nft_rhash_remove+0x33b/0x340 [nf_tables]
[ 1360.549516] nf_tables_commit+0x1c6a/0x2620 [nf_tables]
[ 1360.549625] nfnetlink_rcv_batch+0x728/0xdc0 [nfnetlink]
[ 1360.549647] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink]
[ 1360.549671] netlink_unicast+0x367/0x4f0
[ 1360.549680] netlink_sendmsg+0x34b/0x610
[ 1360.549690] ____sys_sendmsg+0x4d4/0x510
[ 1360.549697] ___sys_sendmsg+0xc9/0x120
[ 1360.549706] __sys_sendmsg+0xbe/0x140
[ 1360.549715] do_syscall_64+0x55/0x120
[ 1360.549725] entry_SYSCALL_64_after_hwframe+0x55/0x5d
Fixes: 0935d5588400 ("netfilter: nf_tables: asynchronous release")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0d432d0674e1..17bf53cd0e84 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -11575,6 +11575,7 @@ static void __exit nf_tables_module_exit(void)
unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
nft_chain_filter_fini();
nft_chain_route_fini();
+ nf_tables_trans_destroy_flush_work();
unregister_pernet_subsys(&nf_tables_net_ops);
cancel_work_sync(&trans_gc_work);
cancel_work_sync(&trans_destroy_work);
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 4/6] netfilter: nf_tables: reject new basechain after table flag update
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2024-04-04 10:43 ` [PATCH net 3/6] netfilter: nf_tables: flush pending destroy work before exit_net release Pablo Neira Ayuso
@ 2024-04-04 10:43 ` Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 6/6] netfilter: nf_tables: discard table flag update with pending basechain deletion Pablo Neira Ayuso
5 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
When dormant flag is toggled, hooks are disabled in the commit phase by
iterating over current chains in table (existing and new).
The following configuration allows for an inconsistent state:
add table x
add chain x y { type filter hook input priority 0; }
add table x { flags dormant; }
add chain x w { type filter hook input priority 1; }
which triggers the following warning when trying to unregister chain w
which is already unregistered.
[ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260
[...]
[ 127.322519] Call Trace:
[ 127.322521] <TASK>
[ 127.322524] ? __warn+0x9f/0x1a0
[ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260
[ 127.322537] ? report_bug+0x1b1/0x1e0
[ 127.322545] ? handle_bug+0x3c/0x70
[ 127.322552] ? exc_invalid_op+0x17/0x40
[ 127.322556] ? asm_exc_invalid_op+0x1a/0x20
[ 127.322563] ? kasan_save_free_info+0x3b/0x60
[ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260
[ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260
[ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260
[ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables]
[ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables]
[ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]
Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 17bf53cd0e84..1eb51bf24fc2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2449,6 +2449,9 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
struct nft_stats __percpu *stats = NULL;
struct nft_chain_hook hook = {};
+ if (table->flags & __NFT_TABLE_F_UPDATE)
+ return -EINVAL;
+
if (flags & NFT_CHAIN_BINDING)
return -EOPNOTSUPP;
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2024-04-04 10:43 ` [PATCH net 4/6] netfilter: nf_tables: reject new basechain after table flag update Pablo Neira Ayuso
@ 2024-04-04 10:43 ` Pablo Neira Ayuso
2024-04-11 10:03 ` Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 6/6] netfilter: nf_tables: discard table flag update with pending basechain deletion Pablo Neira Ayuso
5 siblings, 1 reply; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
From: Ziyang Xuan <william.xuanziyang@huawei.com>
nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can
concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable().
And thhere is not any protection when iterate over nf_tables_flowtables
list in __nft_flowtable_type_get(). Therefore, there is pertential
data-race of nf_tables_flowtables list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list
in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller
nft_flowtable_type_get() to protect the entire type query process.
Fixes: 3b49e2e94e6e ("netfilter: nf_tables: add flow table netlink frontend")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 1eb51bf24fc2..e02d0ae4f436 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8296,11 +8296,12 @@ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
return err;
}
+/* call under rcu_read_lock */
static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
{
const struct nf_flowtable_type *type;
- list_for_each_entry(type, &nf_tables_flowtables, list) {
+ list_for_each_entry_rcu(type, &nf_tables_flowtables, list) {
if (family == type->family)
return type;
}
@@ -8312,9 +8313,13 @@ nft_flowtable_type_get(struct net *net, u8 family)
{
const struct nf_flowtable_type *type;
+ rcu_read_lock();
type = __nft_flowtable_type_get(family);
- if (type != NULL && try_module_get(type->owner))
+ if (type != NULL && try_module_get(type->owner)) {
+ rcu_read_unlock();
return type;
+ }
+ rcu_read_unlock();
lockdep_nfnl_nft_mutex_not_held();
#ifdef CONFIG_MODULES
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* Re: [PATCH net 5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
2024-04-04 10:43 ` [PATCH net 5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() Pablo Neira Ayuso
@ 2024-04-11 10:03 ` Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-11 10:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
On Thu, Apr 04, 2024 at 12:43:33PM +0200, Pablo Neira Ayuso wrote:
> From: Ziyang Xuan <william.xuanziyang@huawei.com>
>
> nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can
> concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable().
> And thhere is not any protection when iterate over nf_tables_flowtables
> list in __nft_flowtable_type_get(). Therefore, there is pertential
> data-race of nf_tables_flowtables list entry.
>
> Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list
> in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller
> nft_flowtable_type_get() to protect the entire type query process.
Applied to nf, thanks
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 6/6] netfilter: nf_tables: discard table flag update with pending basechain deletion
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2024-04-04 10:43 ` [PATCH net 5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() Pablo Neira Ayuso
@ 2024-04-04 10:43 ` Pablo Neira Ayuso
5 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-04 10:43 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hook unregistration is deferred to the commit phase, same occurs with
hook updates triggered by the table dormant flag. When both commands are
combined, this results in deleting a basechain while leaving its hook
still registered in the core.
Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e02d0ae4f436..d89d77946719 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1209,10 +1209,11 @@ static bool nft_table_pending_update(const struct nft_ctx *ctx)
return true;
list_for_each_entry(trans, &nft_net->commit_list, list) {
- if ((trans->msg_type == NFT_MSG_NEWCHAIN ||
- trans->msg_type == NFT_MSG_DELCHAIN) &&
- trans->ctx.table == ctx->table &&
- nft_trans_chain_update(trans))
+ if (trans->ctx.table == ctx->table &&
+ ((trans->msg_type == NFT_MSG_NEWCHAIN &&
+ nft_trans_chain_update(trans)) ||
+ (trans->msg_type == NFT_MSG_DELCHAIN &&
+ nft_is_base_chain(trans->ctx.chain))))
return true;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2024-05-22 23:13 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-05-22 23:13 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 syzbot reports that nf_reinject() could be called without
rcu_read_lock() when flushing pending packets at nfnetlink
queue removal, from Eric Dumazet.
Patch #2 flushes ipset list:set when canceling garbage collection to
reference to other lists to fix a race, from Jozsef Kadlecsik.
Patch #3 restores q-in-q matching with nft_payload by reverting
f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support").
Patch #4 fixes vlan mangling in skbuff when vlan offload is present
in skbuff, without this patch nft_payload corrupts packets
in this case.
Patch #5 fixes possible nul-deref in tproxy no IP address is found in
netdevice, reported by syzbot and patch from Florian Westphal.
Patch #6 removes a superfluous restriction which prevents loose fib
lookups from input and forward hooks, from Eric Garver.
My assessment is that patches #1, #2 and #5 address possible kernel
crash, anything else in this batch fixes broken features.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-05-23
Thanks.
----------------------------------------------------------------
The following changes since commit 4b377b4868ef17b040065bd468668c707d2477a5:
kprobe/ftrace: fix build error due to bad function definition (2024-05-17 19:17:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-05-23
for you to fetch changes up to 4878baa295a377fa9116dbeb43208272efc1cb1b:
netfilter: nft_fib: allow from forward/input without iif selector (2024-05-21 16:37:01 +0200)
----------------------------------------------------------------
netfilter pull request 24-05-23
----------------------------------------------------------------
Alexander Maltsev (1):
netfilter: ipset: Add list flush to cancel_gc
Eric Dumazet (1):
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
Eric Garver (1):
netfilter: nft_fib: allow from forward/input without iif selector
Florian Westphal (1):
netfilter: tproxy: bail out if IP has been disabled on the device
Pablo Neira Ayuso (2):
netfilter: nft_payload: restore vlan q-in-q match support
netfilter: nft_payload: skbuff vlan metadata mangle support
net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +
net/netfilter/ipset/ip_set_list_set.c | 3 ++
net/netfilter/nfnetlink_queue.c | 2 +
net/netfilter/nft_fib.c | 8 ++-
net/netfilter/nft_payload.c | 95 ++++++++++++++++++++++++++---------
5 files changed, 82 insertions(+), 28 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2024-01-31 22:59 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-01-31 22:59 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
1) TCP conntrack now only evaluates window negotiation for packets in
the REPLY direction, from Ryan Schaefer. Otherwise SYN retransmissions
trigger incorrect window scale negotiation. From Ryan Schaefer.
2) Restrict tunnel objects to NFPROTO_NETDEV which is where it makes sense
to use this object type.
3) Fix conntrack pick up from the middle of SCTP_CID_SHUTDOWN_ACK packets.
From Xin Long.
4) Another attempt from Jozsef Kadlecsik to address the slow down of the
swap command in ipset.
5) Replace a BUG_ON by WARN_ON_ONCE in nf_log, and consolidate check for
the case that the logger is NULL from the read side lock section.
6) Address lack of sanitization for custom expectations. Restrict layer 3
and 4 families to what it is supported by userspace.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-01-31
Thanks.
----------------------------------------------------------------
The following changes since commit a2933a8759a62269754e54733d993b19de870e84:
selftests: bonding: do not test arp/ns target with mode balance-alb/tlb (2024-01-25 09:50:54 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-01-31
for you to fetch changes up to 8059918a1377f2f1fff06af4f5a4ed3d5acd6bc4:
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (2024-01-31 23:14:14 +0100)
----------------------------------------------------------------
netfilter pull request 24-01-31
----------------------------------------------------------------
Jozsef Kadlecsik (1):
netfilter: ipset: fix performance regression in swap operation
Pablo Neira Ayuso (3):
netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
Ryan Schaefer (1):
netfilter: conntrack: correct window scaling with retransmitted SYN
Xin Long (1):
netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
include/linux/netfilter/ipset/ip_set.h | 4 ++++
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/ipset/ip_set_bitmap_gen.h | 14 ++++++++++---
net/netfilter/ipset/ip_set_core.c | 37 +++++++++++++++++++++++++--------
net/netfilter/ipset/ip_set_hash_gen.h | 15 ++++++++++---
net/netfilter/ipset/ip_set_list_set.c | 13 +++++++++---
net/netfilter/nf_conntrack_proto_sctp.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 10 +++++----
net/netfilter/nf_log.c | 7 ++++---
net/netfilter/nf_tables_api.c | 14 ++++++++-----
net/netfilter/nft_ct.c | 24 +++++++++++++++++++++
net/netfilter/nft_tunnel.c | 1 +
12 files changed, 112 insertions(+), 31 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2024-01-24 19:12 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2024-01-24 19:12 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
1) Update nf_tables kdoc to keep it in sync with the code, from George Guo.
2) Handle NETDEV_UNREGISTER event for inet/ingress basechain.
3) Reject configuration that cause nft_limit to overflow, from Florian Westphal.
4) Restrict anonymous set/map names to 16 bytes, from Florian Westphal.
5) Disallow to encode queue number and error in verdicts. This reverts
a patch which seems to have introduced an early attempt to support for
nfqueue maps, which is these days supported via nft_queue expression.
6) Sanitize family via .validate for expressions that explicitly refer
to NF_INET_* hooks.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-01-24
Thanks.
----------------------------------------------------------------
The following changes since commit 32f2a0afa95fae0d1ceec2ff06e0e816939964b8:
net/sched: flower: Fix chain template offload (2024-01-24 01:33:59 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-01-24
for you to fetch changes up to d0009effa8862c20a13af4cb7475d9771b905693:
netfilter: nf_tables: validate NFPROTO_* family (2024-01-24 20:02:40 +0100)
----------------------------------------------------------------
netfilter pull request 24-01-24
----------------------------------------------------------------
Florian Westphal (3):
netfilter: nft_limit: reject configurations that cause integer overflow
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
George Guo (1):
netfilter: nf_tables: cleanup documentation
Pablo Neira Ayuso (2):
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
netfilter: nf_tables: validate NFPROTO_* family
include/net/netfilter/nf_tables.h | 49 +++++++++++++++++++++++++++++++--------
net/netfilter/nf_tables_api.c | 20 ++++++++--------
net/netfilter/nft_chain_filter.c | 11 +++++++--
net/netfilter/nft_compat.c | 12 ++++++++++
net/netfilter/nft_flow_offload.c | 5 ++++
net/netfilter/nft_limit.c | 23 ++++++++++++------
net/netfilter/nft_nat.c | 5 ++++
net/netfilter/nft_rt.c | 5 ++++
net/netfilter/nft_socket.c | 5 ++++
net/netfilter/nft_synproxy.c | 7 ++++--
net/netfilter/nft_tproxy.c | 5 ++++
net/netfilter/nft_xfrm.c | 5 ++++
12 files changed, 121 insertions(+), 31 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2023-12-06 18:03 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-12-06 18:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
1) Incorrect nf_defrag registration for bpf link infra, from D. Wythe.
2) Skip inactive elements in pipapo set backend walk to avoid double
deactivation, from Florian Westphal.
3) Fix NFT_*_F_PRESENT check with big endian arch, also from Florian.
4) Bail out if number of expressions in NFTA_DYNSET_EXPRESSIONS mismatch
stateful expressions in set declaration.
5) Honor family in table lookup by handle. Broken since 4.16.
6) Use sk_callback_lock to protect access to sk->sk_socket in xt_owner.
sock_orphan() might zap this pointer, from Phil Sutter.
All of these fixes address broken stuff for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-12-06
Thanks.
----------------------------------------------------------------
The following changes since commit 54d4434da824460a190d547404530eff12a7907d:
Merge branch 'hv_netvsc-fix-race-of-netvsc-vf-register-and-slave-bit' (2023-11-21 13:15:05 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-12-06
for you to fetch changes up to 7ae836a3d630e146b732fe8ef7d86b243748751f:
netfilter: xt_owner: Fix for unsafe access of sk->sk_socket (2023-12-06 17:52:15 +0100)
----------------------------------------------------------------
netfilter pull request 23-12-06
----------------------------------------------------------------
D. Wythe (1):
netfilter: bpf: fix bad registration on nf_defrag
Florian Westphal (2):
netfilter: nft_set_pipapo: skip inactive elements during set walk
netfilter: nf_tables: fix 'exist' matching on bigendian arches
Pablo Neira Ayuso (2):
netfilter: nf_tables: bail out on mismatching dynset and set expressions
netfilter: nf_tables: validate family when identifying table via handle
Phil Sutter (1):
netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
net/netfilter/nf_bpf_link.c | 10 +++++-----
net/netfilter/nf_tables_api.c | 5 +++--
net/netfilter/nft_dynset.c | 13 +++++++++----
net/netfilter/nft_exthdr.c | 4 ++--
net/netfilter/nft_fib.c | 8 ++++++--
net/netfilter/nft_set_pipapo.c | 3 +++
net/netfilter/xt_owner.c | 16 ++++++++++++----
7 files changed, 40 insertions(+), 19 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2023-11-15 18:45 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-11-15 18:45 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
1) Remove unused variable causing compilation warning in nft_set_rbtree,
from Yang Li. This unused variable is a left over from previous
merge window.
2) Possible return of uninitialized in nf_conntrack_bridge, from
Linkui Xiao. This is there since nf_conntrack_bridge is available.
3) Fix incorrect pointer math in nft_byteorder, from Dan Carpenter.
Problem has been there since 2016.
4) Fix bogus error in destroy set element command. Problem is there
since this new destroy command was added.
5) Fix race condition in ipset between swap and destroy commands and
add/del/test control plane. This problem is there since ipset was
merged.
6) Split async and sync catchall GC in two function to fix unsafe
iteration over RCU. This is a fix-for-fix that was included in
the previous pull request.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-11-15
Thanks.
----------------------------------------------------------------
The following changes since commit 4b7b492615cf3017190f55444f7016812b66611d:
af_unix: fix use-after-free in unix_stream_read_actor() (2023-11-14 10:51:13 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-11-15
for you to fetch changes up to 8837ba3e58ea1e3d09ae36db80b1e80853aada95:
netfilter: nf_tables: split async and sync catchall in two functions (2023-11-14 16:16:21 +0100)
----------------------------------------------------------------
netfilter pull request 23-11-15
----------------------------------------------------------------
Dan Carpenter (1):
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
Jozsef Kadlecsik (1):
netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
Linkui Xiao (1):
netfilter: nf_conntrack_bridge: initialize err to 0
Pablo Neira Ayuso (2):
netfilter: nf_tables: bogus ENOENT when destroying element which does not exist
netfilter: nf_tables: split async and sync catchall in two functions
Yang Li (1):
netfilter: nft_set_rbtree: Remove unused variable nft_net
include/net/netfilter/nf_tables.h | 4 +-
net/bridge/netfilter/nf_conntrack_bridge.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 14 +++----
net/netfilter/nf_tables_api.c | 60 ++++++++++++++++--------------
net/netfilter/nft_byteorder.c | 5 ++-
net/netfilter/nft_meta.c | 2 +-
net/netfilter/nft_set_rbtree.c | 2 -
7 files changed, 47 insertions(+), 42 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2023-07-05 23:04 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-07-05 23:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix missing overflow use refcount checks in nf_tables.
2) Do not set IPS_ASSURED for IPS_NAT_CLASH entries in GRE tracker,
from Florian Westphal.
3) Bail out if nf_ct_helper_hash is NULL before registering helper,
from Florent Revest.
4) Use siphash() instead siphash_4u64() to fix performance regression,
also from Florian.
5) Do not allow to add rules to removed chains via ID,
from Thadeu Lima de Souza Cascardo.
6) Fix oob read access in byteorder expression, also from Thadeu.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-07-06
Thanks.
----------------------------------------------------------------
The following changes since commit c451410ca7e3d8eeb31d141fc20c200e21754ba4:
Merge branch 'mptcp-fixes' (2023-07-05 10:51:14 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-07-06
for you to fetch changes up to caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd:
netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (2023-07-06 00:53:14 +0200)
----------------------------------------------------------------
netfilter pull request 23-07-06
----------------------------------------------------------------
Florent Revest (1):
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
Florian Westphal (2):
netfilter: conntrack: gre: don't set assured flag for clash entries
netfilter: conntrack: don't fold port numbers into addresses before hashing
Pablo Neira Ayuso (1):
netfilter: nf_tables: report use refcount overflow
Thadeu Lima de Souza Cascardo (2):
netfilter: nf_tables: do not ignore genmask when looking up chain by id
netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
include/net/netfilter/nf_conntrack_tuple.h | 3 +
include/net/netfilter/nf_tables.h | 31 ++++-
net/netfilter/nf_conntrack_core.c | 20 ++--
net/netfilter/nf_conntrack_helper.c | 4 +
net/netfilter/nf_conntrack_proto_gre.c | 10 +-
net/netfilter/nf_tables_api.c | 174 ++++++++++++++++++-----------
net/netfilter/nft_byteorder.c | 14 +--
net/netfilter/nft_flow_offload.c | 6 +-
net/netfilter/nft_immediate.c | 8 +-
net/netfilter/nft_objref.c | 8 +-
10 files changed, 178 insertions(+), 100 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2023-06-27 6:52 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-27 6:52 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Reset shift on Boyer-Moore string match for each block,
from Jeremy Sowden.
2) Fix acccess to non-linear area in DCCP conntrack helper,
from Florian Westphal.
3) Fix kernel-doc warnings, by Randy Dunlap.
4) Bail out if expires= does not show in SIP helper message,
or make ct_sip_parse_numerical_param() tristate and report
error if expires= cannot be parsed.
5) Unbind non-anonymous set in case rule construction fails.
6) Fix underflow in chain reference counter in case set element
already exists or it cannot be created.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-06-27
Thanks.
----------------------------------------------------------------
The following changes since commit 6709d4b7bc2e079241fdef15d1160581c5261c10:
net: nfc: Fix use-after-free caused by nfc_llcp_find_local (2023-06-26 10:57:23 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-06-27
for you to fetch changes up to b389139f12f287b8ed2e2628b72df89a081f0b59:
netfilter: nf_tables: fix underflow in chain reference counter (2023-06-26 17:18:55 +0200)
----------------------------------------------------------------
netfilter pull request 23-06-27
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
Ilia.Gavrilov (1):
netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
Jeremy Sowden (1):
lib/ts_bm: reset initial match offset for every block of text
Pablo Neira Ayuso (2):
netfilter: nf_tables: unbind non-anonymous set if rule construction fails
netfilter: nf_tables: fix underflow in chain reference counter
Randy Dunlap (1):
linux/netfilter.h: fix kernel-doc warnings
include/linux/netfilter.h | 4 +--
lib/ts_bm.c | 4 ++-
net/netfilter/nf_conntrack_proto_dccp.c | 52 +++++++++++++++++++++++++++++++--
net/netfilter/nf_conntrack_sip.c | 2 +-
net/netfilter/nf_tables_api.c | 6 +++-
5 files changed, 60 insertions(+), 8 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2022-02-10 23:10 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-02-10 23:10 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Add selftest for nft_synproxy, from Florian Westphal.
2) xt_socket destroy path incorrectly disables IPv4 defrag for
IPv6 traffic (typo), from Eric Dumazet.
3) Fix exit value selftest nft_concat_range.sh, from Hangbin Liu.
4) nft_synproxy disables the IPv4 hooks if the IPv6 hooks fail
to be registered.
5) disable rp_filter on router in selftest nft_fib.sh, also
from Hangbin Liu.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 7db788ad627aabff2b74d4f1a3b68516d0fee0d7:
nfp: flower: fix ida_idx not being released (2022-02-08 21:06:35 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to bbe4c0896d25009a7c86285d2ab024eed4374eea:
selftests: netfilter: disable rp_filter on router (2022-02-11 00:01:04 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: xt_socket: fix a typo in socket_mt_destroy()
Florian Westphal (1):
selftests: netfilter: add synproxy test
Hangbin Liu (2):
selftests: netfilter: fix exit value for nft_concat_range
selftests: netfilter: disable rp_filter on router
Pablo Neira Ayuso (2):
netfilter: nft_synproxy: unregister hooks on init error path
selftests: netfilter: synproxy test requires nf_conntrack
net/netfilter/nft_synproxy.c | 4 +-
net/netfilter/xt_socket.c | 2 +-
tools/testing/selftests/netfilter/Makefile | 2 +-
.../selftests/netfilter/nft_concat_range.sh | 2 +-
tools/testing/selftests/netfilter/nft_fib.sh | 1 +
tools/testing/selftests/netfilter/nft_synproxy.sh | 117 +++++++++++++++++++++
6 files changed, 124 insertions(+), 4 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/nft_synproxy.sh
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2022-02-04 15:18 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2022-02-04 15:18 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Don't refresh timeout for SCTP flows in CLOSED state.
2) Don't allow access to transport header if fragment offset is set on.
3) Reinitialize internal conntrack state for retransmitted TCP
syn-ack packet.
4) Update MAINTAINER file to add the Netfilter group tree. Moving
forward, Florian Westphal has access to this tree so he can also
send pull requests.
5) Set on IPS_HELPER for entries created via ctnetlink, otherwise NAT
might zap it.
All patches from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit ed14fc7a79ab43e9f2cb1fa9c1733fdc133bba30:
net: sparx5: Fix get_stat64 crash in tcpdump (2022-02-03 19:01:15 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to d1ca60efc53d665cf89ed847a14a510a81770b81:
netfilter: ctnetlink: disable helper autoassign (2022-02-04 05:39:57 +0100)
----------------------------------------------------------------
Florian Westphal (6):
netfilter: conntrack: don't refresh sctp entries in closed state
netfilter: nft_payload: don't allow th access for fragments
netfilter: conntrack: move synack init code to helper
netfilter: conntrack: re-init state for retransmitted syn-ack
MAINTAINERS: netfilter: update git links
netfilter: ctnetlink: disable helper autoassign
MAINTAINERS | 4 +-
include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
net/netfilter/nf_conntrack_netlink.c | 3 +-
net/netfilter/nf_conntrack_proto_sctp.c | 9 ++++
net/netfilter/nf_conntrack_proto_tcp.c | 59 +++++++++++++++-------
net/netfilter/nft_exthdr.c | 2 +-
net/netfilter/nft_payload.c | 9 ++--
7 files changed, 61 insertions(+), 27 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
* [PATCH net 0/6] Netfilter fixes for net
@ 2021-07-23 15:54 Pablo Neira Ayuso
0 siblings, 0 replies; 19+ messages in thread
From: Pablo Neira Ayuso @ 2021-07-23 15:54 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Memleak in commit audit error path, from Dongliang Mu.
2) Avoid possible false sharing for flowtable timeout updates
and nft_last use.
3) Adjust conntrack timestamp due to garbage collection delay,
from Florian Westphal.
4) Fix nft_nat without layer 3 address for the inet family.
5) Fix compilation warning in nfnl_hook when ingress support
is disabled, from Arnd Bergmann.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 5f119ba1d5771bbf46d57cff7417dcd84d3084ba:
net: decnet: Fix sleeping inside in af_decnet (2021-07-16 14:06:16 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 217e26bd87b2930856726b48a4e71c768b8c9bf5:
netfilter: nfnl_hook: fix unused variable warning (2021-07-23 14:45:03 +0200)
----------------------------------------------------------------
Arnd Bergmann (1):
netfilter: nfnl_hook: fix unused variable warning
Dongliang Mu (1):
netfilter: nf_tables: fix audit memory leak in nf_tables_commit
Florian Westphal (1):
netfilter: conntrack: adjust stop timestamp to real expiry value
Pablo Neira Ayuso (3):
netfilter: flowtable: avoid possible false sharing
netfilter: nft_last: avoid possible false sharing
netfilter: nft_nat: allow to specify layer 4 protocol NAT only
net/netfilter/nf_conntrack_core.c | 7 ++++++-
net/netfilter/nf_flow_table_core.c | 6 +++++-
net/netfilter/nf_tables_api.c | 12 ++++++++++++
net/netfilter/nfnetlink_hook.c | 2 ++
net/netfilter/nft_last.c | 20 +++++++++++++-------
net/netfilter/nft_nat.c | 4 +++-
6 files changed, 41 insertions(+), 10 deletions(-)
^ permalink raw reply [flat|nested] 19+ messages in thread
end of thread, other threads:[~2024-05-22 23:14 UTC | newest]
Thread overview: 19+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-04 10:43 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 1/6] netfilter: nf_tables: release batch on table validation from abort path Pablo Neira Ayuso
2024-04-04 16:50 ` patchwork-bot+netdevbpf
2024-04-04 10:43 ` [PATCH net 2/6] netfilter: nf_tables: release mutex after nft_gc_seq_end " Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 3/6] netfilter: nf_tables: flush pending destroy work before exit_net release Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 4/6] netfilter: nf_tables: reject new basechain after table flag update Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 5/6] netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() Pablo Neira Ayuso
2024-04-11 10:03 ` Pablo Neira Ayuso
2024-04-04 10:43 ` [PATCH net 6/6] netfilter: nf_tables: discard table flag update with pending basechain deletion Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2024-05-22 23:13 [PATCH net 0/6] Netfilter fixes for net Pablo Neira Ayuso
2024-01-31 22:59 Pablo Neira Ayuso
2024-01-24 19:12 Pablo Neira Ayuso
2023-12-06 18:03 Pablo Neira Ayuso
2023-11-15 18:45 Pablo Neira Ayuso
2023-07-05 23:04 Pablo Neira Ayuso
2023-06-27 6:52 Pablo Neira Ayuso
2022-02-10 23:10 Pablo Neira Ayuso
2022-02-04 15:18 Pablo Neira Ayuso
2021-07-23 15:54 Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.