* [PATCH 0/8] netfilter fixes for net
@ 2019-07-31 11:51 Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 1/8] netfilter: ebtables: fix a memory leak bug in compat Pablo Neira Ayuso
` (8 more replies)
0 siblings, 9 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for your net tree:
1) memleak in ebtables from the error path for the 32/64 compat layer,
from Florian Westphal.
2) Fix inverted meta ifname/ifidx matching when no interface is set
on either from the input/output path, from Phil Sutter.
3) Remove goto label in nft_meta_bridge, also from Phil.
4) Missing include guard in xt_connlabel, from Masahiro Yamada.
5) Two patch to fix ipset destination MAC matching coming from
Stephano Brivio, via Jozsef Kadlecsik.
6) Fix set rename and listing concurrency problem, from Shijie Luo.
Patch also coming via Jozsef Kadlecsik.
7) ebtables 32/64 compat missing base chain policy in rule count,
from Florian Westphal.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 0cea0e1148fe134a4a3aaf0b1496f09241fb943a:
net: phy: sfp: hwmon: Fix scaling of RX power (2019-07-21 11:51:50 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 7cdc4412284777c76c919e2ab33b3b8dbed18559:
Merge branch 'master' of git://blackhole.kfki.hu/nf (2019-07-30 13:39:20 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: ebtables: also count base chain policies
Jozsef Kadlecsik (1):
netfilter: ipset: Fix rename concurrency with listing
Masahiro Yamada (1):
netfilter: add include guard to xt_connlabel.h
Pablo Neira Ayuso (1):
Merge branch 'master' of git://blackhole.kfki.hu/nf
Phil Sutter (2):
netfilter: nf_tables: Make nft_meta expression more robust
netfilter: nft_meta_bridge: Eliminate 'out' label
Stefano Brivio (2):
netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too
netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets
Wenwen Wang (1):
netfilter: ebtables: fix a memory leak bug in compat
include/uapi/linux/netfilter/xt_connlabel.h | 6 ++++++
net/bridge/netfilter/ebtables.c | 32 ++++++++++++++++++-----------
net/bridge/netfilter/nft_meta_bridge.c | 10 ++-------
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 2 +-
net/netfilter/ipset/ip_set_hash_ipmac.c | 6 +-----
net/netfilter/nft_meta.c | 16 ++++-----------
7 files changed, 35 insertions(+), 39 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 1/8] netfilter: ebtables: fix a memory leak bug in compat
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 2/8] netfilter: nf_tables: Make nft_meta expression more robust Pablo Neira Ayuso
` (7 subsequent siblings)
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Wenwen Wang <wenwen@cs.uga.edu>
In compat_do_replace(), a temporary buffer is allocated through vmalloc()
to hold entries copied from the user space. The buffer address is firstly
saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then
the entries in this temporary buffer is copied to the internal kernel
structure through compat_copy_entries(). If this copy process fails,
compat_do_replace() should be terminated. However, the allocated temporary
buffer is not freed on this path, leading to a memory leak.
To fix the bug, free the buffer before returning from compat_do_replace().
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 963dfdc14827..fd84b48e48b5 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2261,8 +2261,10 @@ static int compat_do_replace(struct net *net, void __user *user,
state.buf_kern_len = size64;
ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
- if (WARN_ON(ret < 0))
+ if (WARN_ON(ret < 0)) {
+ vfree(entries_tmp);
goto out_unlock;
+ }
vfree(entries_tmp);
tmp.entries_size = size64;
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 2/8] netfilter: nf_tables: Make nft_meta expression more robust
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 1/8] netfilter: ebtables: fix a memory leak bug in compat Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 3/8] netfilter: nft_meta_bridge: Eliminate 'out' label Pablo Neira Ayuso
` (6 subsequent siblings)
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Phil Sutter <phil@nwl.cc>
nft_meta_get_eval()'s tendency to bail out setting NFT_BREAK verdict in
situations where required data is missing leads to unexpected behaviour
with inverted checks like so:
| meta iifname != eth0 accept
This rule will never match if there is no input interface (or it is not
known) which is not intuitive and, what's worse, breaks consistency of
iptables-nft with iptables-legacy.
Fix this by falling back to placing a value in dreg which never matches
(avoiding accidental matches), i.e. zero for interface index and an
empty string for interface name.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/nft_meta_bridge.c | 6 +-----
net/netfilter/nft_meta.c | 16 ++++------------
2 files changed, 5 insertions(+), 17 deletions(-)
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index bed66f536b34..a98dec2cf0cf 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -30,13 +30,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
switch (priv->key) {
case NFT_META_BRI_IIFNAME:
br_dev = nft_meta_get_bridge(in);
- if (!br_dev)
- goto err;
break;
case NFT_META_BRI_OIFNAME:
br_dev = nft_meta_get_bridge(out);
- if (!br_dev)
- goto err;
break;
case NFT_META_BRI_IIFPVID: {
u16 p_pvid;
@@ -64,7 +60,7 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
goto out;
}
- strncpy((char *)dest, br_dev->name, IFNAMSIZ);
+ strncpy((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);
return;
out:
return nft_meta_get_eval(expr, regs, pkt);
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index f1b1d948c07b..f69afb9ff3cb 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -60,24 +60,16 @@ void nft_meta_get_eval(const struct nft_expr *expr,
*dest = skb->mark;
break;
case NFT_META_IIF:
- if (in == NULL)
- goto err;
- *dest = in->ifindex;
+ *dest = in ? in->ifindex : 0;
break;
case NFT_META_OIF:
- if (out == NULL)
- goto err;
- *dest = out->ifindex;
+ *dest = out ? out->ifindex : 0;
break;
case NFT_META_IIFNAME:
- if (in == NULL)
- goto err;
- strncpy((char *)dest, in->name, IFNAMSIZ);
+ strncpy((char *)dest, in ? in->name : "", IFNAMSIZ);
break;
case NFT_META_OIFNAME:
- if (out == NULL)
- goto err;
- strncpy((char *)dest, out->name, IFNAMSIZ);
+ strncpy((char *)dest, out ? out->name : "", IFNAMSIZ);
break;
case NFT_META_IIFTYPE:
if (in == NULL)
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 3/8] netfilter: nft_meta_bridge: Eliminate 'out' label
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 1/8] netfilter: ebtables: fix a memory leak bug in compat Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 2/8] netfilter: nf_tables: Make nft_meta expression more robust Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 4/8] netfilter: add include guard to xt_connlabel.h Pablo Neira Ayuso
` (5 subsequent siblings)
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Phil Sutter <phil@nwl.cc>
The label is used just once and the code it points at is not reused, no
point in keeping it.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/nft_meta_bridge.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index a98dec2cf0cf..1804e867f715 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -57,13 +57,11 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
return;
}
default:
- goto out;
+ return nft_meta_get_eval(expr, regs, pkt);
}
strncpy((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);
return;
-out:
- return nft_meta_get_eval(expr, regs, pkt);
err:
regs->verdict.code = NFT_BREAK;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 4/8] netfilter: add include guard to xt_connlabel.h
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2019-07-31 11:51 ` [PATCH 3/8] netfilter: nft_meta_bridge: Eliminate 'out' label Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 5/8] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too Pablo Neira Ayuso
` (4 subsequent siblings)
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Add a header include guard just in case.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/xt_connlabel.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/uapi/linux/netfilter/xt_connlabel.h b/include/uapi/linux/netfilter/xt_connlabel.h
index 2312f0ec07b2..323f0dfc2a4e 100644
--- a/include/uapi/linux/netfilter/xt_connlabel.h
+++ b/include/uapi/linux/netfilter/xt_connlabel.h
@@ -1,4 +1,8 @@
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+
+#ifndef _UAPI_XT_CONNLABEL_H
+#define _UAPI_XT_CONNLABEL_H
+
#include <linux/types.h>
#define XT_CONNLABEL_MAXBIT 127
@@ -11,3 +15,5 @@ struct xt_connlabel_mtinfo {
__u16 bit;
__u16 options;
};
+
+#endif /* _UAPI_XT_CONNLABEL_H */
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 5/8] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2019-07-31 11:51 ` [PATCH 4/8] netfilter: add include guard to xt_connlabel.h Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 6/8] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets Pablo Neira Ayuso
` (3 subsequent siblings)
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Stefano Brivio <sbrivio@redhat.com>
In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
for mac and ipmac sets"), ipset.git commit 1543514c46a7, I removed the
KADT check that prevents matching on destination MAC addresses for
hash:mac sets, but forgot to remove the same check for hash:ip,mac set.
Drop this check: functionality is now commented in man pages and there's
no reason to restrict to source MAC address matching anymore.
Reported-by: Chen Yi <yiche@redhat.com>
Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
net/netfilter/ipset/ip_set_hash_ipmac.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index faf59b6a998f..eb1443408320 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -89,10 +89,6 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
- /* MAC can be src only */
- if (!(opt->flags & IPSET_DIM_TWO_SRC))
- return 0;
-
if (skb_mac_header(skb) < skb->head ||
(skb_mac_header(skb) + ETH_HLEN) > skb->data)
return -EINVAL;
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 6/8] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2019-07-31 11:51 ` [PATCH 5/8] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 7/8] netfilter: ipset: Fix rename concurrency with listing Pablo Neira Ayuso
` (2 subsequent siblings)
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Stefano Brivio <sbrivio@redhat.com>
In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the
KADT functions for sets matching on MAC addreses the copy of source or
destination MAC address depending on the configured match.
This was done correctly for hash:mac, but for hash:ip,mac and
bitmap:ip,mac, copying and pasting the same code block presents an
obvious problem: in these two set types, the MAC address is the second
dimension, not the first one, and we are actually selecting the MAC
address depending on whether the first dimension (IP address) specifies
source or destination.
Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags.
This way, mixing source and destination matches for the two dimensions
of ip,mac set types works as expected. With this setup:
ip netns add A
ip link add veth1 type veth peer name veth2 netns A
ip addr add 192.0.2.1/24 dev veth1
ip -net A addr add 192.0.2.2/24 dev veth2
ip link set veth1 up
ip -net A link set veth2 up
dst=$(ip netns exec A cat /sys/class/net/veth2/address)
ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16
ip netns exec A ipset add test_bitmap 192.0.2.1,${dst}
ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP
ip netns exec A ipset create test_hash hash:ip,mac
ip netns exec A ipset add test_hash 192.0.2.1,${dst}
ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP
ipset correctly matches a test packet:
# ping -c1 192.0.2.2 >/dev/null
# echo $?
0
Reported-by: Chen Yi <yiche@redhat.com>
Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
net/netfilter/ipset/ip_set_hash_ipmac.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index ca7ac4a25ada..1d4e63326e68 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -226,7 +226,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
e.id = ip_to_id(map, ip);
- if (opt->flags & IPSET_DIM_ONE_SRC)
+ if (opt->flags & IPSET_DIM_TWO_SRC)
ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
else
ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index eb1443408320..24d8f4df4230 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -93,7 +93,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
(skb_mac_header(skb) + ETH_HLEN) > skb->data)
return -EINVAL;
- if (opt->flags & IPSET_DIM_ONE_SRC)
+ if (opt->flags & IPSET_DIM_TWO_SRC)
ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
else
ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 7/8] netfilter: ipset: Fix rename concurrency with listing
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (5 preceding siblings ...)
2019-07-31 11:51 ` [PATCH 6/8] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 8/8] netfilter: ebtables: also count base chain policies Pablo Neira Ayuso
2019-07-31 15:50 ` [PATCH 0/8] netfilter fixes for net David Miller
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Jozsef Kadlecsik <kadlec@netfilter.org>
Shijie Luo reported that when stress-testing ipset with multiple concurrent
create, rename, flush, list, destroy commands, it can result
ipset <version>: Broken LIST kernel message: missing DATA part!
error messages and broken list results. The problem was the rename operation
was not properly handled with respect of listing. The patch fixes the issue.
Reported-by: Shijie Luo <luoshijie1@huawei.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
net/netfilter/ipset/ip_set_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 2e151856ad99..e64d5f9a89dd 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1161,7 +1161,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
return -ENOENT;
write_lock_bh(&ip_set_ref_lock);
- if (set->ref != 0) {
+ if (set->ref != 0 || set->ref_netlink != 0) {
ret = -IPSET_ERR_REFERENCED;
goto out;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH 8/8] netfilter: ebtables: also count base chain policies
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (6 preceding siblings ...)
2019-07-31 11:51 ` [PATCH 7/8] netfilter: ipset: Fix rename concurrency with listing Pablo Neira Ayuso
@ 2019-07-31 11:51 ` Pablo Neira Ayuso
2019-07-31 15:50 ` [PATCH 0/8] netfilter fixes for net David Miller
8 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-31 11:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
ebtables doesn't include the base chain policies in the rule count,
so we need to add them manually when we call into the x_tables core
to allocate space for the comapt offset table.
This lead syzbot to trigger:
WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649
xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649
Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com
Fixes: 2035f3ff8eaa ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index fd84b48e48b5..c8177a89f52c 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1770,20 +1770,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
return 0;
}
+static int ebt_compat_init_offsets(unsigned int number)
+{
+ if (number > INT_MAX)
+ return -EINVAL;
+
+ /* also count the base chain policies */
+ number += NF_BR_NUMHOOKS;
+
+ return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
+}
static int compat_table_info(const struct ebt_table_info *info,
struct compat_ebt_replace *newinfo)
{
unsigned int size = info->entries_size;
const void *entries = info->entries;
+ int ret;
newinfo->entries_size = size;
- if (info->nentries) {
- int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
- info->nentries);
- if (ret)
- return ret;
- }
+ ret = ebt_compat_init_offsets(info->nentries);
+ if (ret)
+ return ret;
return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
entries, newinfo);
@@ -2234,11 +2242,9 @@ static int compat_do_replace(struct net *net, void __user *user,
xt_compat_lock(NFPROTO_BRIDGE);
- if (tmp.nentries) {
- ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
- if (ret < 0)
- goto out_unlock;
- }
+ ret = ebt_compat_init_offsets(tmp.nentries);
+ if (ret < 0)
+ goto out_unlock;
ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
if (ret < 0)
--
2.11.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] netfilter fixes for net
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
` (7 preceding siblings ...)
2019-07-31 11:51 ` [PATCH 8/8] netfilter: ebtables: also count base chain policies Pablo Neira Ayuso
@ 2019-07-31 15:50 ` David Miller
8 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2019-07-31 15:50 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 31 Jul 2019 13:51:49 +0200
> The following patchset contains Netfilter fixes for your net tree:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks.
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2020-08-31 9:36 [PATCH 0/8] Netfilter " Pablo Neira Ayuso
@ 2020-08-31 18:22 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2020-08-31 18:22 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 31 Aug 2020 11:36:40 +0200
> The following patchset contains Netfilter fixes for net:
>
> 1) Do not delete clash entries on reply, let them expire instead,
> from Florian Westphal.
>
> 2) Do not report EAGAIN to nfnetlink, otherwise this enters a busy loop.
> Update nfnetlink_unicast() to translate EAGAIN to ENOBUFS.
>
> 3) Remove repeated words in code comments, from Randy Dunlap.
>
> 4) Several patches for the flowtable selftests, from Fabian Frederick.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2020-08-31 9:36 Pablo Neira Ayuso
2020-08-31 18:22 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-08-31 9:36 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Do not delete clash entries on reply, let them expire instead,
from Florian Westphal.
2) Do not report EAGAIN to nfnetlink, otherwise this enters a busy loop.
Update nfnetlink_unicast() to translate EAGAIN to ENOBUFS.
3) Remove repeated words in code comments, from Randy Dunlap.
4) Several patches for the flowtable selftests, from Fabian Frederick.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 5438dd45831ee33869779bd1919b05816ae4dbc9:
net_sched: fix error path in red_init() (2020-08-28 07:16:46 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to c46172147ebbeb70094db48d76ab7945d96c638b:
netfilter: conntrack: do not auto-delete clash entries on reply (2020-08-29 13:03:06 +0200)
----------------------------------------------------------------
Fabian Frederick (5):
selftests: netfilter: fix header example
selftests: netfilter: exit on invalid parameters
selftests: netfilter: remove unused variable in make_file()
selftests: netfilter: simplify command testing
selftests: netfilter: add command usage
Florian Westphal (1):
netfilter: conntrack: do not auto-delete clash entries on reply
Pablo Neira Ayuso (1):
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
Randy Dunlap (1):
netfilter: delete repeated words
include/linux/netfilter/nfnetlink.h | 3 +-
net/ipv4/netfilter/nf_nat_pptp.c | 2 +-
net/netfilter/nf_conntrack_pptp.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 26 ++++-----
net/netfilter/nf_tables_api.c | 61 ++++++++++----------
net/netfilter/nfnetlink.c | 11 +++-
net/netfilter/nfnetlink_log.c | 3 +-
net/netfilter/nfnetlink_queue.c | 2 +-
net/netfilter/nft_flow_offload.c | 2 +-
net/netfilter/xt_recent.c | 2 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 67 ++++++++++++----------
12 files changed, 92 insertions(+), 91 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2020-08-15 10:31 Pablo Neira Ayuso
@ 2020-08-16 23:05 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2020-08-16 23:05 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 15 Aug 2020 12:31:53 +0200
> The following patchset contains Netfilter fixes for net:
>
> 1) Endianness issue in IPv4 option support in nft_exthdr,
> from Stephen Suryaputra.
>
> 2) Removes the waitcount optimization in nft_compat,
> from Florian Westphal.
>
> 3) Remove ipv6 -> nf_defrag_ipv6 module dependency, from
> Florian Westphal.
>
> 4) Memleak in chain binding support, also from Florian.
>
> 5) Simplify nft_flowtable.sh selftest, from Fabian Frederick.
>
> 6) Optional MTU arguments for selftest nft_flowtable.sh,
> also from Fabian.
>
> 7) Remove noise error report when killing process in
> selftest nft_flowtable.sh, from Fabian Frederick.
>
> 8) Reject bogus getsockopt option length in ebtables,
> from Florian Westphal.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2020-08-15 10:31 Pablo Neira Ayuso
2020-08-16 23:05 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2020-08-15 10:31 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Endianness issue in IPv4 option support in nft_exthdr,
from Stephen Suryaputra.
2) Removes the waitcount optimization in nft_compat,
from Florian Westphal.
3) Remove ipv6 -> nf_defrag_ipv6 module dependency, from
Florian Westphal.
4) Memleak in chain binding support, also from Florian.
5) Simplify nft_flowtable.sh selftest, from Fabian Frederick.
6) Optional MTU arguments for selftest nft_flowtable.sh,
also from Fabian.
7) Remove noise error report when killing process in
selftest nft_flowtable.sh, from Fabian Frederick.
8) Reject bogus getsockopt option length in ebtables,
from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 7c7ab580db49cc7befe5f4b91bb1920cd6b07575:
net: Convert to use the fallthrough macro (2020-08-08 14:29:09 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 5c04da55c754c44937b3d19c6522f9023fd5c5d5:
netfilter: ebtables: reject bogus getopt len value (2020-08-14 11:59:08 +0200)
----------------------------------------------------------------
Fabian Frederick (3):
selftests: netfilter: add checktool function
selftests: netfilter: add MTU arguments to flowtables
selftests: netfilter: kill running process only
Florian Westphal (4):
netfilter: nft_compat: remove flush counter optimization
netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
netfilter: nf_tables: free chain context when BINDING flag is missing
netfilter: ebtables: reject bogus getopt len value
Stephen Suryaputra (1):
netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian
include/linux/netfilter_ipv6.h | 18 ------
net/bridge/netfilter/ebtables.c | 4 ++
net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++-
net/ipv6/netfilter.c | 3 -
net/netfilter/nf_tables_api.c | 6 +-
net/netfilter/nft_compat.c | 37 +++++------
net/netfilter/nft_exthdr.c | 4 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 73 +++++++++++++---------
8 files changed, 73 insertions(+), 80 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2018-10-22 20:07 Pablo Neira Ayuso
@ 2018-10-23 3:21 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2018-10-23 3:21 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 22 Oct 2018 22:07:16 +0200
> The following patchset contains Netfilter fixes for your net tree:
>
> 1) rbtree lookup from control plane returns the left-hand side element
> of the range when the interval end flag is set on.
>
> 2) osf extension is not supported from the input path, reject this from
> the control plane, from Fernando Fernandez Mancera.
>
> 3) xt_TEE is leaving output interface unset due to a recent incorrect
> netns rework, from Taehee Yoo.
>
> 4) xt_TEE allows to select an interface which does not belong to this
> netnamespace, from Taehee Yoo.
>
> 5) Zero private extension area in nft_compat, just like we do in x_tables,
> otherwise we leak kernel memory to userspace.
>
> 6) Missing .checkentry and .destroy entries in new DNAT extensions breaks
> it since we never load nf_conntrack dependencies, from Paolo Abeni.
>
> 7) Do not remove flowtable hook from netns exit path, the netdevice handler
> already deals with this, also from Taehee Yoo.
>
> 8) Only cleanup flowtable entries that reside in this netnamespace, also
> from Taehee Yoo.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2018-10-22 20:07 Pablo Neira Ayuso
2018-10-23 3:21 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2018-10-22 20:07 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree:
1) rbtree lookup from control plane returns the left-hand side element
of the range when the interval end flag is set on.
2) osf extension is not supported from the input path, reject this from
the control plane, from Fernando Fernandez Mancera.
3) xt_TEE is leaving output interface unset due to a recent incorrect
netns rework, from Taehee Yoo.
4) xt_TEE allows to select an interface which does not belong to this
netnamespace, from Taehee Yoo.
5) Zero private extension area in nft_compat, just like we do in x_tables,
otherwise we leak kernel memory to userspace.
6) Missing .checkentry and .destroy entries in new DNAT extensions breaks
it since we never load nf_conntrack dependencies, from Paolo Abeni.
7) Do not remove flowtable hook from netns exit path, the netdevice handler
already deals with this, also from Taehee Yoo.
8) Only cleanup flowtable entries that reside in this netnamespace, also
from Taehee Yoo.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 9a4890bd6d6325a1c88564a20ab310b2d56f6094:
rds: RDS (tcp) hangs on sendto() to unresponding address (2018-10-10 22:19:52 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to a3fb3698cadf27dc142b24394c401625e14d80d0:
netfilter: nf_flow_table: do not remove offload when other netns's interface is down (2018-10-19 13:30:48 +0200)
----------------------------------------------------------------
Fernando Fernandez Mancera (1):
netfilter: nft_osf: usage from output path is not valid
Pablo Neira Ayuso (2):
netfilter: nft_set_rbtree: allow loose matching of closing element in interval
netfilter: nft_compat: do not dump private area
Paolo Abeni (1):
netfilter: xt_nat: fix DNAT target for shifted portmap ranges
Taehee Yoo (4):
netfilter: xt_TEE: fix wrong interface selection
netfilter: xt_TEE: add missing code to get interface index in checkentry.
netfilter: nf_flow_table: remove flowtable hook flush routine in netns exit routine
netfilter: nf_flow_table: do not remove offload when other netns's interface is down
net/netfilter/nf_flow_table_core.c | 9 +++--
net/netfilter/nf_tables_api.c | 3 --
net/netfilter/nft_compat.c | 24 +++++++++++-
net/netfilter/nft_osf.c | 10 +++++
net/netfilter/nft_set_rbtree.c | 10 ++++-
net/netfilter/xt_TEE.c | 76 +++++++++++++++++++++++++++++---------
net/netfilter/xt_nat.c | 2 +
7 files changed, 107 insertions(+), 27 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2017-03-29 12:14 Pablo Neira Ayuso
@ 2017-03-29 21:39 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2017-03-29 21:39 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 29 Mar 2017 14:14:02 +0200
> Hi David,
>
> The following patchset contains a rather large update with Netfilter
> fixes, specifically targeted to incorrect RCU usage in several spots and
> the userspace conntrack helper infrastructure (nfnetlink_cthelper),
> more specifically they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2017-03-29 12:14 Pablo Neira Ayuso
2017-03-29 21:39 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2017-03-29 12:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains a rather large update with Netfilter
fixes, specifically targeted to incorrect RCU usage in several spots and
the userspace conntrack helper infrastructure (nfnetlink_cthelper),
more specifically they are:
1) expect_class_max is incorrect set via cthelper, as in kernel semantics
mandate that this represents the array of expectation classes minus 1.
Patch from Liping Zhang.
2) Expectation policy updates via cthelper are currently broken for several
reasons: This code allows illegal changes in the policy such as changing
the number of expeciation classes, it is leaking the updated policy and
such update occurs with no RCU protection at all. Fix this by adding a
new nfnl_cthelper_update_policy() that describes what is really legal on
the update path.
3) Fix several memory leaks in cthelper, from Jeffy Chen.
4) synchronize_rcu() is missing in the removal path of several modules,
this may lead to races since CPU may still be running on code that has
just gone. Also from Liping Zhang.
5) Don't use the helper hashtable from cthelper, it is not safe to walk
over those bits without the helper mutex. Fix this by introducing a
new independent list for userspace helpers. From Liping Zhang.
6) nf_ct_extend_unregister() needs synchronize_rcu() to make sure no
packets are walking on any conntrack extension that is gone after
module removal, again from Liping.
7) nf_nat_snmp may crash if we fail to unregister the helper due to
accidental leftover code, from Gao Feng.
8) Fix leak in nfnetlink_queue with secctx support, from Liping Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit db7f00b8dba6d687b6ab1f2e9309acfd214fcb4b:
tcp: tcp_get_info() should read tcp_time_stamp later (2017-03-16 21:37:13 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 77c1c03c5b8ef28e55bb0aff29b1e006037ca645:
netfilter: nfnetlink_queue: fix secctx memory leak (2017-03-29 12:20:50 +0200)
----------------------------------------------------------------
Gao Feng (1):
netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
Jeffy Chen (1):
netfilter: nfnl_cthelper: Fix memory leak
Liping Zhang (5):
netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
netfilter: nfnetlink_queue: fix secctx memory leak
Pablo Neira Ayuso (1):
netfilter: nfnl_cthelper: fix runtime expectation policy updates
net/ipv4/netfilter/nf_nat_snmp_basic.c | 20 +--
net/netfilter/nf_conntrack_ecache.c | 2 +
net/netfilter/nf_conntrack_extend.c | 13 +-
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_nat_core.c | 2 +
net/netfilter/nfnetlink_cthelper.c | 287 +++++++++++++++++++++------------
net/netfilter/nfnetlink_cttimeout.c | 2 +-
net/netfilter/nfnetlink_queue.c | 9 +-
8 files changed, 206 insertions(+), 130 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2017-02-23 11:14 Pablo Neira Ayuso
@ 2017-02-23 16:00 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2017-02-23 16:00 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 23 Feb 2017 12:14:01 +0100
> The following patchset contains Netfilter fixes for your net tree,
> they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks a lot!
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2017-02-23 11:14 Pablo Neira Ayuso
2017-02-23 16:00 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2017-02-23 11:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Revisit warning logic when not applying default helper assignment.
Jiri Kosina considers we are breaking existing setups and not warning
our users accordinly now that automatic helper assignment has been
turned off by default. So let's make him happy by spotting the warning
by when we find a helper but we cannot attach, instead of warning on the
former deprecated behaviour. Patch from Jiri Kosina.
2) Two patches to fix regression in ctnetlink interfaces with
nfnetlink_queue. Specifically, perform more relaxed in CTA_STATUS
and do not bail out if CTA_HELP indicates the same helper that we
already have. Patches from Kevin Cernekee.
3) A couple of bugfixes for ipset via Jozsef Kadlecsik. Due to wrong
index logic in hash set types and null pointer exception in the
list:set type.
4) hashlimit bails out with correct userspace parameters due to wrong
arithmetics in the code that avoids "divide by zero" when
transforming the userspace timing in milliseconds to token credits.
Patch from Alban Browaeys.
5) Fix incorrect NFQA_VLAN_MAX definition, patch from
Ken-ichirou MATSUZAWA.
6) Don't not declare nfnetlink batch error list as static, since this
may be used by several subsystems at the same time. Patch from
Liping Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit cafe8df8b9bc9aa3dffa827c1a6757c6cd36f657:
net: phy: Fix lack of reference count on PHY driver (2017-02-02 22:59:43 -0500)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 3ef767e5cbd405abfd01339c7e5daaf98e037be2:
Merge branch 'master' of git://blackhole.kfki.hu/nf (2017-02-21 14:01:05 +0100)
----------------------------------------------------------------
Alban Browaeys (1):
netfilter: xt_hashlimit: Fix integer divide round to zero.
Jiri Kosina (1):
netfilter: nf_ct_helper: warn when not applying default helper assignment
Jozsef Kadlecsik (1):
Fix bug: sometimes valid entries in hash:* types of sets were evicted
Ken-ichirou MATSUZAWA (1):
netfilter: nfnetlink_queue: fix NFQA_VLAN_MAX definition
Kevin Cernekee (2):
netfilter: ctnetlink: Fix regression in CTA_STATUS processing
netfilter: ctnetlink: Fix regression in CTA_HELP processing
Liping Zhang (1):
netfilter: nfnetlink: remove static declaration from err_list
Pablo Neira Ayuso (1):
Merge branch 'master' of git://blackhole.kfki.hu/nf
Vishwanath Pai (1):
netfilter: ipset: Null pointer exception in ipset list:set
include/uapi/linux/netfilter/nf_conntrack_common.h | 4 ++
include/uapi/linux/netfilter/nfnetlink_queue.h | 2 +-
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 9 +++--
net/netfilter/nf_conntrack_helper.c | 39 +++++++++++++-------
net/netfilter/nf_conntrack_netlink.c | 43 +++++++++++++++++++---
net/netfilter/nfnetlink.c | 2 +-
net/netfilter/xt_hashlimit.c | 25 +++++--------
8 files changed, 86 insertions(+), 40 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH 0/8] Netfilter fixes for net
2014-10-27 21:37 Pablo Neira Ayuso
@ 2014-10-27 22:49 ` David Miller
0 siblings, 0 replies; 24+ messages in thread
From: David Miller @ 2014-10-27 22:49 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 27 Oct 2014 22:37:59 +0100
> The following patchset contains Netfilter fixes for your net tree,
> they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks a lot Pablo!
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] Netfilter fixes for net
@ 2014-10-27 21:37 Pablo Neira Ayuso
2014-10-27 22:49 ` David Miller
0 siblings, 1 reply; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-10-27 21:37 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Allow to recycle a TCP port in conntrack when the change role from
server to client, from Marcelo Leitner.
2) Fix possible off by one access in ip_set_nfnl_get_byindex(), patch
from Dan Carpenter.
3) alloc_percpu returns NULL on error, no need for IS_ERR() in nf_tables
chain statistic updates. From Sabrina Dubroca.
4) Don't compile ip options in bridge netfilter, this mangles the packet
and bridge should not alter layer >= 3 headers when forwarding packets.
Patch from Herbert Xu and tested by Florian Westphal.
5) Account the final NLMSG_DONE message when calculating the size of the
nflog netlink batches. Patch from Florian Westphal.
6) Fix a possible netlink attribute length overflow with large packets.
Again from Florian Westphal.
7) Release the skbuff if nfnetlink_log fails to put the final
NLMSG_DONE message. This fixes a leak on error. This shouldn't ever
happen though, otherwise this means we miscalculate the netlink batch
size, so spot a warning if this ever happens so we can track down the
problem. This patch from Houcheng Lin.
8) Look at the right list when recycling targets in the nft_compat,
patch from Arturo Borrero.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 7c1c97d54f9bfc810908d3903cb8bcacf734df18:
net: sched: initialize bstats syncp (2014-10-21 21:45:21 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 7965ee93719921ea5978f331da653dfa2d7b99f5:
netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops() (2014-10-27 22:17:46 +0100)
----------------------------------------------------------------
Arturo Borrero (1):
netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops()
Dan Carpenter (1):
netfilter: ipset: off by one in ip_set_nfnl_get_byindex()
Florian Westphal (2):
netfilter: nf_log: account for size of NLMSG_DONE attribute
netfilter: nfnetlink_log: fix maximum packet length logged to userspace
Herbert Xu (1):
bridge: Do not compile options in br_parse_ip_options
Houcheng Lin (1):
netfilter: nf_log: release skbuff on nlmsg put failure
Marcelo Leitner (1):
netfilter: nf_conntrack: allow server to become a client in TW handling
Sabrina Dubroca (1):
netfilter: nf_tables: check for NULL in nf_tables_newchain pcpu stats allocation
net/bridge/br_netfilter.c | 24 +++++-------------------
net/netfilter/ipset/ip_set_core.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 4 ++--
net/netfilter/nf_tables_api.c | 4 ++--
net/netfilter/nfnetlink_log.c | 31 ++++++++++++++++---------------
net/netfilter/nft_compat.c | 2 +-
6 files changed, 27 insertions(+), 40 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] netfilter fixes for net
@ 2014-04-05 16:21 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Resending the cover letter, sent the wrong template, sorry
-o-
Hi,
The following patchset contains Netfilter fixes for your net tree, they
are:
* Use 16-bits offset and length fields instead of 8-bits in the conntrack
extension to avoid an overflow when many conntrack extension are used,
from Andrey Vagin.
* Allow to use cgroup match from LOCAL_IN, there is no apparent reason
for not allowing this, from Alexey Perevalov.
* Fix build of the connlimit match after recent changes to let it scale
up that result in a divide by zero compilation error in UP, from
Florian Westphal.
* Move the lock out of the structure connlimit_data to avoid a false
sharing spotted by Eric Dumazet and Jesper D. Brouer, this needed as
part of the recent connlimit scalability improvements, also from
Florian Westphal.
* Add missing module aliases in xt_osf to fix loading of rules using
this match, from Kirill Tkhai.
* Restrict set names in nf_tables to 15 characters instead of silently
trimming them off, from me.
* Fix wrong format in nf_tables request module call for chain types,
spotted by Florian Westphal, patch from me.
* Fix crash in xtables when it fails to copy the counters back to userspace
after having replaced the table already.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
Thanks.
----------------------------------------------------------------
The following changes since commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb:
net-gro: reset skb->truesize in napi_reuse_skb() (2014-04-03 16:17:52 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to c58dd2dd443c26d856a168db108a0cd11c285bf3:
netfilter: Can't fail and free after table replacement (2014-04-05 17:46:22 +0200)
----------------------------------------------------------------
Alexey Perevalov (1):
netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks
Andrey Vagin (1):
netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len
Florian Westphal (2):
netfilter: connlimit: fix UP build
netfilter: connlimit: move lock array out of struct connlimit_data
Kirill Tkhai (1):
netfilter: Add {ipt,ip6t}_osf aliases for xt_osf
Pablo Neira Ayuso (2):
netfilter: nf_tables: set names cannot be larger than 15 bytes
netfilter: nf_tables: fix wrong format in request_module()
Thomas Graf (1):
netfilter: Can't fail and free after table replacement
include/net/netfilter/nf_conntrack_extend.h | 4 ++--
net/bridge/netfilter/ebtables.c | 5 ++---
net/ipv4/netfilter/arp_tables.c | 6 ++++--
net/ipv4/netfilter/ip_tables.c | 6 ++++--
net/ipv6/netfilter/ip6_tables.c | 6 ++++--
net/netfilter/nf_tables_api.c | 7 ++++---
net/netfilter/xt_cgroup.c | 3 ++-
net/netfilter/xt_connlimit.c | 25 ++++++++++++++++---------
net/netfilter/xt_osf.c | 2 ++
9 files changed, 40 insertions(+), 24 deletions(-)
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH 0/8] netfilter fixes for net
@ 2014-04-05 16:03 Pablo Neira Ayuso
0 siblings, 0 replies; 24+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-05 16:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for your net tree, they
are:
* Use 16-bits offset and length fields instead of 8-bits in the conntrack
extension to avoid an overflow when many conntrack extension are used,
from Andrey Vagin.
* Allow to use cgroup match from LOCAL_IN, there is no apparent reason
for not allowing this, from Alexey Perevalov.
* Fix build of the connlimit match after recent changes to let it scale
up that result in a divide by zero compilation error in UP, from
Florian Westphal.
* Move the lock out of the structure connlimit_data to avoid a false
sharing spotted by Eric Dumazet and Jesper D. Brouer, this needed as
part of the recent connlimit scalability improvements, also from
Florian Westphal.
* Add missing module aliases in xt_osf to fix loading of rules using
this match, from Kirill Tkhai.
* Restrict set names in nf_tables to 15 characters instead of silently
trimming them off, from me.
* Fix wrong format in nf_tables request module call for chain types,
spotted by Florian Westphal, patch from me.
* Fix crash in xtables when it fails to copy the counters back to userspace
after having replaced the table already.
You can pull these changes from:
^ permalink raw reply [flat|nested] 24+ messages in thread
end of thread, other threads:[~2020-08-31 18:23 UTC | newest]
Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-31 11:51 [PATCH 0/8] netfilter fixes for net Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 1/8] netfilter: ebtables: fix a memory leak bug in compat Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 2/8] netfilter: nf_tables: Make nft_meta expression more robust Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 3/8] netfilter: nft_meta_bridge: Eliminate 'out' label Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 4/8] netfilter: add include guard to xt_connlabel.h Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 5/8] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 6/8] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 7/8] netfilter: ipset: Fix rename concurrency with listing Pablo Neira Ayuso
2019-07-31 11:51 ` [PATCH 8/8] netfilter: ebtables: also count base chain policies Pablo Neira Ayuso
2019-07-31 15:50 ` [PATCH 0/8] netfilter fixes for net David Miller
-- strict thread matches above, loose matches on Subject: below --
2020-08-31 9:36 [PATCH 0/8] Netfilter " Pablo Neira Ayuso
2020-08-31 18:22 ` David Miller
2020-08-15 10:31 Pablo Neira Ayuso
2020-08-16 23:05 ` David Miller
2018-10-22 20:07 Pablo Neira Ayuso
2018-10-23 3:21 ` David Miller
2017-03-29 12:14 Pablo Neira Ayuso
2017-03-29 21:39 ` David Miller
2017-02-23 11:14 Pablo Neira Ayuso
2017-02-23 16:00 ` David Miller
2014-10-27 21:37 Pablo Neira Ayuso
2014-10-27 22:49 ` David Miller
2014-04-05 16:21 [PATCH 0/8] netfilter " Pablo Neira Ayuso
2014-04-05 16:03 Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).