* [PATCH net 0/3] Netfilter fixes for net
@ 2023-06-08 19:57 Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol Pablo Neira Ayuso
` (2 more replies)
0 siblings, 3 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-08 19:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Add commit and abort set operation to pipapo set abort path.
2) Bail out immediately in case of ENOMEM in nfnetlink batch.
3) Incorrect error path handling when creating a new rule leads to
dangling pointer in set transaction list.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-06-08
Thanks.
----------------------------------------------------------------
The following changes since commit ab39b113e74751958aac1b125a14ee42bd7d3efd:
Merge tag 'for-net-2023-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth (2023-06-06 21:36:57 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-06-08
for you to fetch changes up to 1240eb93f0616b21c675416516ff3d74798fdc97:
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (2023-06-08 21:49:26 +0200)
----------------------------------------------------------------
netfilter pull request 23-06-08
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nf_tables: integrate pipapo into commit protocol
netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
include/net/netfilter/nf_tables.h | 4 ++-
net/netfilter/nf_tables_api.c | 59 ++++++++++++++++++++++++++++++++++++++-
net/netfilter/nfnetlink.c | 3 +-
net/netfilter/nft_set_pipapo.c | 55 ++++++++++++++++++++++++++----------
4 files changed, 103 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol
2023-06-08 19:57 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
@ 2023-06-08 19:57 ` Pablo Neira Ayuso
2023-06-09 8:49 ` Simon Horman
2023-06-10 19:12 ` patchwork-bot+netdevbpf
2023-06-08 19:57 ` [PATCH net 2/3] netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 3/3] netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE Pablo Neira Ayuso
2 siblings, 2 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-08 19:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
The pipapo set backend follows copy-on-update approach, maintaining one
clone of the existing datastructure that is being updated. The clone
and current datastructures are swapped via rcu from the commit step.
The existing integration with the commit protocol is flawed because
there is no operation to clean up the clone if the transaction is
aborted. Moreover, the datastructure swap happens on set element
activation.
This patch adds two new operations for sets: commit and abort, these new
operations are invoked from the commit and abort steps, after the
transactions have been digested, and it updates the pipapo set backend
to use it.
This patch adds a new ->pending_update field to sets to maintain a list
of sets that require this new commit and abort operations.
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables.h | 4 ++-
net/netfilter/nf_tables_api.c | 56 +++++++++++++++++++++++++++++++
net/netfilter/nft_set_pipapo.c | 55 +++++++++++++++++++++---------
3 files changed, 99 insertions(+), 16 deletions(-)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 2e24ea1d744c..83db182decc8 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -462,7 +462,8 @@ struct nft_set_ops {
const struct nft_set *set,
const struct nft_set_elem *elem,
unsigned int flags);
-
+ void (*commit)(const struct nft_set *set);
+ void (*abort)(const struct nft_set *set);
u64 (*privsize)(const struct nlattr * const nla[],
const struct nft_set_desc *desc);
bool (*estimate)(const struct nft_set_desc *desc,
@@ -557,6 +558,7 @@ struct nft_set {
u16 policy;
u16 udlen;
unsigned char *udata;
+ struct list_head pending_update;
/* runtime data below here */
const struct nft_set_ops *ops ____cacheline_aligned;
u16 flags:14,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0519d45ede6b..3bb0800b3849 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4919,6 +4919,7 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
set->num_exprs = num_exprs;
set->handle = nf_tables_alloc_handle(table);
+ INIT_LIST_HEAD(&set->pending_update);
err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
if (err < 0)
@@ -9275,10 +9276,25 @@ static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation)
}
}
+static void nft_set_commit_update(struct list_head *set_update_list)
+{
+ struct nft_set *set, *next;
+
+ list_for_each_entry_safe(set, next, set_update_list, pending_update) {
+ list_del_init(&set->pending_update);
+
+ if (!set->ops->commit)
+ continue;
+
+ set->ops->commit(set);
+ }
+}
+
static int nf_tables_commit(struct net *net, struct sk_buff *skb)
{
struct nftables_pernet *nft_net = nft_pernet(net);
struct nft_trans *trans, *next;
+ LIST_HEAD(set_update_list);
struct nft_trans_elem *te;
struct nft_chain *chain;
struct nft_table *table;
@@ -9453,6 +9469,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
nf_tables_setelem_notify(&trans->ctx, te->set,
&te->elem,
NFT_MSG_NEWSETELEM);
+ if (te->set->ops->commit &&
+ list_empty(&te->set->pending_update)) {
+ list_add_tail(&te->set->pending_update,
+ &set_update_list);
+ }
nft_trans_destroy(trans);
break;
case NFT_MSG_DELSETELEM:
@@ -9467,6 +9488,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
atomic_dec(&te->set->nelems);
te->set->ndeact--;
}
+ if (te->set->ops->commit &&
+ list_empty(&te->set->pending_update)) {
+ list_add_tail(&te->set->pending_update,
+ &set_update_list);
+ }
break;
case NFT_MSG_NEWOBJ:
if (nft_trans_obj_update(trans)) {
@@ -9529,6 +9555,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
}
}
+ nft_set_commit_update(&set_update_list);
+
nft_commit_notify(net, NETLINK_CB(skb).portid);
nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
nf_tables_commit_audit_log(&adl, nft_net->base_seq);
@@ -9588,10 +9616,25 @@ static void nf_tables_abort_release(struct nft_trans *trans)
kfree(trans);
}
+static void nft_set_abort_update(struct list_head *set_update_list)
+{
+ struct nft_set *set, *next;
+
+ list_for_each_entry_safe(set, next, set_update_list, pending_update) {
+ list_del_init(&set->pending_update);
+
+ if (!set->ops->abort)
+ continue;
+
+ set->ops->abort(set);
+ }
+}
+
static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
{
struct nftables_pernet *nft_net = nft_pernet(net);
struct nft_trans *trans, *next;
+ LIST_HEAD(set_update_list);
struct nft_trans_elem *te;
if (action == NFNL_ABORT_VALIDATE &&
@@ -9701,6 +9744,12 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nft_setelem_remove(net, te->set, &te->elem);
if (!nft_setelem_is_catchall(te->set, &te->elem))
atomic_dec(&te->set->nelems);
+
+ if (te->set->ops->abort &&
+ list_empty(&te->set->pending_update)) {
+ list_add_tail(&te->set->pending_update,
+ &set_update_list);
+ }
break;
case NFT_MSG_DELSETELEM:
case NFT_MSG_DESTROYSETELEM:
@@ -9711,6 +9760,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
if (!nft_setelem_is_catchall(te->set, &te->elem))
te->set->ndeact--;
+ if (te->set->ops->abort &&
+ list_empty(&te->set->pending_update)) {
+ list_add_tail(&te->set->pending_update,
+ &set_update_list);
+ }
nft_trans_destroy(trans);
break;
case NFT_MSG_NEWOBJ:
@@ -9753,6 +9807,8 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
}
}
+ nft_set_abort_update(&set_update_list);
+
synchronize_rcu();
list_for_each_entry_safe_reverse(trans, next,
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 06d46d182634..15e451dc3fc4 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1600,17 +1600,10 @@ static void pipapo_free_fields(struct nft_pipapo_match *m)
}
}
-/**
- * pipapo_reclaim_match - RCU callback to free fields from old matching data
- * @rcu: RCU head
- */
-static void pipapo_reclaim_match(struct rcu_head *rcu)
+static void pipapo_free_match(struct nft_pipapo_match *m)
{
- struct nft_pipapo_match *m;
int i;
- m = container_of(rcu, struct nft_pipapo_match, rcu);
-
for_each_possible_cpu(i)
kfree(*per_cpu_ptr(m->scratch, i));
@@ -1625,7 +1618,19 @@ static void pipapo_reclaim_match(struct rcu_head *rcu)
}
/**
- * pipapo_commit() - Replace lookup data with current working copy
+ * pipapo_reclaim_match - RCU callback to free fields from old matching data
+ * @rcu: RCU head
+ */
+static void pipapo_reclaim_match(struct rcu_head *rcu)
+{
+ struct nft_pipapo_match *m;
+
+ m = container_of(rcu, struct nft_pipapo_match, rcu);
+ pipapo_free_match(m);
+}
+
+/**
+ * nft_pipapo_commit() - Replace lookup data with current working copy
* @set: nftables API set representation
*
* While at it, check if we should perform garbage collection on the working
@@ -1635,7 +1640,7 @@ static void pipapo_reclaim_match(struct rcu_head *rcu)
* We also need to create a new working copy for subsequent insertions and
* deletions.
*/
-static void pipapo_commit(const struct nft_set *set)
+static void nft_pipapo_commit(const struct nft_set *set)
{
struct nft_pipapo *priv = nft_set_priv(set);
struct nft_pipapo_match *new_clone, *old;
@@ -1660,6 +1665,26 @@ static void pipapo_commit(const struct nft_set *set)
priv->clone = new_clone;
}
+static void nft_pipapo_abort(const struct nft_set *set)
+{
+ struct nft_pipapo *priv = nft_set_priv(set);
+ struct nft_pipapo_match *new_clone, *m;
+
+ if (!priv->dirty)
+ return;
+
+ m = rcu_dereference(priv->match);
+
+ new_clone = pipapo_clone(m);
+ if (IS_ERR(new_clone))
+ return;
+
+ priv->dirty = false;
+
+ pipapo_free_match(priv->clone);
+ priv->clone = new_clone;
+}
+
/**
* nft_pipapo_activate() - Mark element reference as active given key, commit
* @net: Network namespace
@@ -1667,8 +1692,7 @@ static void pipapo_commit(const struct nft_set *set)
* @elem: nftables API element representation containing key data
*
* On insertion, elements are added to a copy of the matching data currently
- * in use for lookups, and not directly inserted into current lookup data, so
- * we'll take care of that by calling pipapo_commit() here. Both
+ * in use for lookups, and not directly inserted into current lookup data. Both
* nft_pipapo_insert() and nft_pipapo_activate() are called once for each
* element, hence we can't purpose either one as a real commit operation.
*/
@@ -1684,8 +1708,6 @@ static void nft_pipapo_activate(const struct net *net,
nft_set_elem_change_active(net, set, &e->ext);
nft_set_elem_clear_busy(&e->ext);
-
- pipapo_commit(set);
}
/**
@@ -1931,7 +1953,6 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set,
if (i == m->field_count) {
priv->dirty = true;
pipapo_drop(m, rulemap);
- pipapo_commit(set);
return;
}
@@ -2230,6 +2251,8 @@ const struct nft_set_type nft_set_pipapo_type = {
.init = nft_pipapo_init,
.destroy = nft_pipapo_destroy,
.gc_init = nft_pipapo_gc_init,
+ .commit = nft_pipapo_commit,
+ .abort = nft_pipapo_abort,
.elemsize = offsetof(struct nft_pipapo_elem, ext),
},
};
@@ -2252,6 +2275,8 @@ const struct nft_set_type nft_set_pipapo_avx2_type = {
.init = nft_pipapo_init,
.destroy = nft_pipapo_destroy,
.gc_init = nft_pipapo_gc_init,
+ .commit = nft_pipapo_commit,
+ .abort = nft_pipapo_abort,
.elemsize = offsetof(struct nft_pipapo_elem, ext),
},
};
--
2.30.2
^ permalink raw reply related [flat|nested] 43+ messages in thread
* Re: [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol
2023-06-08 19:57 ` [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol Pablo Neira Ayuso
@ 2023-06-09 8:49 ` Simon Horman
2023-06-10 19:12 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 43+ messages in thread
From: Simon Horman @ 2023-06-09 8:49 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
On Thu, Jun 08, 2023 at 09:57:04PM +0200, Pablo Neira Ayuso wrote:
> The pipapo set backend follows copy-on-update approach, maintaining one
> clone of the existing datastructure that is being updated. The clone
> and current datastructures are swapped via rcu from the commit step.
>
> The existing integration with the commit protocol is flawed because
> there is no operation to clean up the clone if the transaction is
> aborted. Moreover, the datastructure swap happens on set element
> activation.
>
> This patch adds two new operations for sets: commit and abort, these new
> operations are invoked from the commit and abort steps, after the
> transactions have been digested, and it updates the pipapo set backend
> to use it.
>
> This patch adds a new ->pending_update field to sets to maintain a list
> of sets that require this new commit and abort operations.
>
> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Hi Pablo,
some suggestions of some trivial follow-up items from my side.
No need for these to hold up progress of the patchset.
> ---
> include/net/netfilter/nf_tables.h | 4 ++-
> net/netfilter/nf_tables_api.c | 56 +++++++++++++++++++++++++++++++
> net/netfilter/nft_set_pipapo.c | 55 +++++++++++++++++++++---------
> 3 files changed, 99 insertions(+), 16 deletions(-)
>
> diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
> index 2e24ea1d744c..83db182decc8 100644
> --- a/include/net/netfilter/nf_tables.h
> +++ b/include/net/netfilter/nf_tables.h
> @@ -462,7 +462,8 @@ struct nft_set_ops {
> const struct nft_set *set,
> const struct nft_set_elem *elem,
> unsigned int flags);
> -
> + void (*commit)(const struct nft_set *set);
> + void (*abort)(const struct nft_set *set);
As a follow-up, these could be added to the kdoc for nft_set_ops.
> u64 (*privsize)(const struct nlattr * const nla[],
> const struct nft_set_desc *desc);
> bool (*estimate)(const struct nft_set_desc *desc,
> @@ -557,6 +558,7 @@ struct nft_set {
> u16 policy;
> u16 udlen;
> unsigned char *udata;
> + struct list_head pending_update;
Likewise, as a follow-up, pending_update could be added to the kdoc for
nft_set.
> /* runtime data below here */
> const struct nft_set_ops *ops ____cacheline_aligned;
> u16 flags:14,
...
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol
2023-06-08 19:57 ` [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol Pablo Neira Ayuso
2023-06-09 8:49 ` Simon Horman
@ 2023-06-10 19:12 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 43+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-06-10 19:12 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
Hello:
This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Thu, 8 Jun 2023 21:57:04 +0200 you wrote:
> The pipapo set backend follows copy-on-update approach, maintaining one
> clone of the existing datastructure that is being updated. The clone
> and current datastructures are swapped via rcu from the commit step.
>
> The existing integration with the commit protocol is flawed because
> there is no operation to clean up the clone if the transaction is
> aborted. Moreover, the datastructure swap happens on set element
> activation.
>
> [...]
Here is the summary with links:
- [net,1/3] netfilter: nf_tables: integrate pipapo into commit protocol
https://git.kernel.org/netdev/net/c/212ed75dc5fb
- [net,2/3] netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
https://git.kernel.org/netdev/net/c/a1a64a151dae
- [net,3/3] netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
https://git.kernel.org/netdev/net/c/1240eb93f061
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 2/3] netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
2023-06-08 19:57 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol Pablo Neira Ayuso
@ 2023-06-08 19:57 ` Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 3/3] netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE Pablo Neira Ayuso
2 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-08 19:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
If caller reports ENOMEM, then stop iterating over the batch and send a
single netlink message to userspace to report OOM.
Fixes: cbb8125eb40b ("netfilter: nfnetlink: deliver netlink errors on batch completion")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index ae7146475d17..c9fbe0f707b5 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -533,7 +533,8 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
* processed, this avoids that the same error is
* reported several times when replaying the batch.
*/
- if (nfnl_err_add(&err_list, nlh, err, &extack) < 0) {
+ if (err == -ENOMEM ||
+ nfnl_err_add(&err_list, nlh, err, &extack) < 0) {
/* We failed to enqueue an error, reset the
* list of errors and send OOM to userspace
* pointing to the batch header.
--
2.30.2
^ permalink raw reply related [flat|nested] 43+ messages in thread
* [PATCH net 3/3] netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
2023-06-08 19:57 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 2/3] netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM Pablo Neira Ayuso
@ 2023-06-08 19:57 ` Pablo Neira Ayuso
2 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-08 19:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
In case of error when adding a new rule that refers to an anonymous set,
deactivate expressions via NFT_TRANS_PREPARE state, not NFT_TRANS_RELEASE.
Thus, the lookup expression marks anonymous sets as inactive in the next
generation to ensure it is not reachable in this transaction anymore and
decrement the set refcount as introduced by c1592a89942e ("netfilter:
nf_tables: deactivate anonymous set from preparation phase"). The abort
step takes care of undoing the anonymous set.
This is also consistent with rule deletion, where NFT_TRANS_PREPARE is
used. Note that this error path is exercised in the preparation step of
the commit protocol. This patch replaces nf_tables_rule_release() by the
deactivate and destroy calls, this time with NFT_TRANS_PREPARE.
Due to this incorrect error handling, it is possible to access a
dangling pointer to the anonymous set that remains in the transaction
list.
[1009.379054] BUG: KASAN: use-after-free in nft_set_lookup_global+0x147/0x1a0 [nf_tables]
[1009.379106] Read of size 8 at addr ffff88816c4c8020 by task nft-rule-add/137110
[1009.379116] CPU: 7 PID: 137110 Comm: nft-rule-add Not tainted 6.4.0-rc4+ #256
[1009.379128] Call Trace:
[1009.379132] <TASK>
[1009.379135] dump_stack_lvl+0x33/0x50
[1009.379146] ? nft_set_lookup_global+0x147/0x1a0 [nf_tables]
[1009.379191] print_address_description.constprop.0+0x27/0x300
[1009.379201] kasan_report+0x107/0x120
[1009.379210] ? nft_set_lookup_global+0x147/0x1a0 [nf_tables]
[1009.379255] nft_set_lookup_global+0x147/0x1a0 [nf_tables]
[1009.379302] nft_lookup_init+0xa5/0x270 [nf_tables]
[1009.379350] nf_tables_newrule+0x698/0xe50 [nf_tables]
[1009.379397] ? nf_tables_rule_release+0xe0/0xe0 [nf_tables]
[1009.379441] ? kasan_unpoison+0x23/0x50
[1009.379450] nfnetlink_rcv_batch+0x97c/0xd90 [nfnetlink]
[1009.379470] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]
[1009.379485] ? __alloc_skb+0xb8/0x1e0
[1009.379493] ? __alloc_skb+0xb8/0x1e0
[1009.379502] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
[1009.379509] ? unwind_get_return_address+0x2a/0x40
[1009.379517] ? write_profile+0xc0/0xc0
[1009.379524] ? avc_lookup+0x8f/0xc0
[1009.379532] ? __rcu_read_unlock+0x43/0x60
Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3bb0800b3849..69bceefaa5c8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3844,7 +3844,8 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
if (flow)
nft_flow_rule_destroy(flow);
err_release_rule:
- nf_tables_rule_release(&ctx, rule);
+ nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE);
+ nf_tables_rule_destroy(&ctx, rule);
err_release_expr:
for (i = 0; i < n; i++) {
if (expr_info[i].ops) {
--
2.30.2
^ permalink raw reply related [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-04-18 1:09 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-18 1:09 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 amends a missing spot where the set iterator type is unset.
This is fixing a issue in the previous pull request.
Patch #2 fixes the delete set command abort path by restoring state
of the elements. Reverse logic for the activate (abort) case
otherwise element state is not restored, this requires to move
the check for active/inactive elements to the set iterator
callback. From the deactivate path, toggle the next generation
bit and from the activate (abort) path, clear the next generation
bitmask.
Patch #3 skips elements already restored by delete set command from the
abort path in case there is a previous delete element command in
the batch. Check for the next generation bit just like it is done
via set iteration to restore maps.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-04-18
Thanks.
----------------------------------------------------------------
The following changes since commit 75ce9506ee3dc66648a7d74ab3b0acfa364d6d43:
octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation (2024-04-15 10:45:03 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-04-18
for you to fetch changes up to 86a1471d7cde792941109b93b558b5dc078b9ee9:
netfilter: nf_tables: fix memleak in map from abort path (2024-04-18 02:41:32 +0200)
----------------------------------------------------------------
netfilter pull request 24-04-18
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nf_tables: missing iterator type in lookup walk
netfilter: nf_tables: restore set elements when delete set fails
netfilter: nf_tables: fix memleak in map from abort path
net/netfilter/nf_tables_api.c | 60 +++++++++++++++++++++++++++++++++++++-----
net/netfilter/nft_lookup.c | 1 +
net/netfilter/nft_set_bitmap.c | 4 +--
net/netfilter/nft_set_hash.c | 8 ++----
net/netfilter/nft_set_pipapo.c | 8 +++---
net/netfilter/nft_set_rbtree.c | 4 +--
6 files changed, 62 insertions(+), 23 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-03-21 0:06 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-21 0:06 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net. There is a
larger batch of fixes still pending that will follow up asap, this is
what I deemed to be more urgent at this time:
1) Use clone view in pipapo set backend to release elements from destroy
path, otherwise it is possible to destroy elements twice.
2) Incorrect check for internal table flags lead to bogus transaction
objects.
3) Fix counters memleak in netdev basechain update error path,
from Quan Tian.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-21
Thanks.
----------------------------------------------------------------
The following changes since commit 9c6a59543a3965071d65b0f9ea43aa396ce2ed14:
Merge branch 'octeontx2-pf-mbox-fixes' (2024-03-20 10:49:08 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-21
for you to fetch changes up to 1c2e3b462542241d2e6f4d32f8356608ff51f487:
netfilter: nf_tables: Fix a memory leak in nf_tables_updchain (2024-03-21 00:46:03 +0100)
----------------------------------------------------------------
netfilter pull request 24-03-21
----------------------------------------------------------------
Pablo Neira Ayuso (2):
netfilter: nft_set_pipapo: release elements in clone only from destroy path
netfilter: nf_tables: do not compare internal table flags on updates
Quan Tian (1):
netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
net/netfilter/nf_tables_api.c | 29 +++++++++++++++--------------
net/netfilter/nft_set_pipapo.c | 5 +----
2 files changed, 16 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-02-29 0:01 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2024-02-29 0:01 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 restores NFPROTO_INET with nft_compat, from Ignat Korchagin.
Patch #2 fixes an issue with bridge netfilter and broadcast/multicast
packets.
There is a day 0 bug in br_netfilter when used with connection tracking.
Conntrack assumes that an nf_conn structure that is not yet added to
hash table ("unconfirmed"), is only visible by the current cpu that is
processing the sk_buff.
For bridge this isn't true, sk_buff can get cloned in between, and
clones can be processed in parallel on different cpu.
This patch disables NAT and conntrack helpers for multicast packets.
Patch #3 adds a selftest to cover for the br_netfilter bug.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-29
Thanks.
----------------------------------------------------------------
The following changes since commit 359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79:
l2tp: pass correct message length to ip6_append_data (2024-02-22 10:42:17 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-29
for you to fetch changes up to 6523cf516c55db164f8f73306027b1caebb5628e:
selftests: netfilter: add bridge conntrack + multicast test case (2024-02-29 00:22:48 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-29
----------------------------------------------------------------
Florian Westphal (2):
netfilter: bridge: confirm multicast packets before passing them up the stack
selftests: netfilter: add bridge conntrack + multicast test case
Ignat Korchagin (1):
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
include/linux/netfilter.h | 1 +
net/bridge/br_netfilter_hooks.c | 96 +++++++++++
net/bridge/netfilter/nf_conntrack_bridge.c | 30 ++++
net/netfilter/nf_conntrack_core.c | 1 +
net/netfilter/nft_compat.c | 20 +++
tools/testing/selftests/netfilter/Makefile | 3 +-
.../selftests/netfilter/bridge_netfilter.sh | 188 +++++++++++++++++++++
7 files changed, 338 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/netfilter/bridge_netfilter.sh
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-02-14 23:38 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2024-02-14 23:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following batch contains Netfilter fixes for net:
1) Missing : in kdoc field in nft_set_pipapo.
2) Restore default DNAT behavior When a DNAT rule is configured via
iptables with different port ranges, from Kyle Swenson.
3) Restore flowtable hardware offload for bidirectional flows
by setting NF_FLOW_HW_BIDIRECTIONAL flag, from Felix Fietkau.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-15
Thanks.
----------------------------------------------------------------
The following changes since commit 9b23fceb4158a3636ce4a2bda28ab03dcfa6a26f:
ethernet: cpts: fix function pointer cast warnings (2024-02-14 12:50:53 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-15
for you to fetch changes up to 84443741faab9045d53f022a9ac6a6633067a481:
netfilter: nf_tables: fix bidirectional offload regression (2024-02-15 00:20:00 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-15
----------------------------------------------------------------
Felix Fietkau (1):
netfilter: nf_tables: fix bidirectional offload regression
Kyle Swenson (1):
netfilter: nat: restore default DNAT behavior
Pablo Neira Ayuso (1):
netfilter: nft_set_pipapo: fix missing : in kdoc
net/netfilter/nf_nat_core.c | 5 ++++-
net/netfilter/nft_flow_offload.c | 1 +
net/netfilter/nft_set_pipapo.h | 4 ++--
3 files changed, 7 insertions(+), 3 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] netfilter fixes for net
@ 2023-07-26 15:23 Florian Westphal
0 siblings, 0 replies; 43+ messages in thread
From: Florian Westphal @ 2023-07-26 15:23 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel
Hello,
Here are three netfilter fixes for the *net* tree:
1. On-demand overlap detection in 'rbtree' set can cause memory leaks.
This is broken since 6.2.
2. An earlier fix in 6.4 to address an imbalance in refcounts during
transaction error unwinding was incomplete, from Pablo Neira.
3. Disallow adding a rule to a deleted chain, also from Pablo.
Broken since 5.9.
The following changes since commit d4a7ce642100765119a872d4aba1bf63e3a22c8a:
igc: Fix Kernel Panic during ndo_tx_timeout callback (2023-07-26 09:54:40 +0100)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-07-26
for you to fetch changes up to 0ebc1064e4874d5987722a2ddbc18f94aa53b211:
netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (2023-07-26 16:48:49 +0200)
----------------------------------------------------------------
netfilter pull request 2023-07-26
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_set_rbtree: fix overlap expiration walk
Pablo Neira Ayuso (2):
netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
net/netfilter/nf_tables_api.c | 5 +++--
net/netfilter/nft_immediate.c | 27 ++++++++++++++++++---------
net/netfilter/nft_set_rbtree.c | 20 ++++++++++++++------
3 files changed, 35 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-05-17 12:37 Florian Westphal
0 siblings, 0 replies; 43+ messages in thread
From: Florian Westphal @ 2023-05-17 12:37 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel
Hi,
This PR has three patches for your *net* tree:
1. Silence warning about unused variable when CONFIG_NF_NAT=n, from Tom Rix.
2. nftables: Fix possible out-of-bounds access, from myself.
3. nftables: fix null deref+UAF during element insertion into rbtree,
also from myself.
The following changes since commit ab87603b251134441a67385ecc9d3371be17b7a7:
net: wwan: t7xx: Ensure init is completed before system sleep (2023-05-17 13:02:25 +0100)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-05-17
for you to fetch changes up to 61ae320a29b0540c16931816299eb86bf2b66c08:
netfilter: nft_set_rbtree: fix null deref on element insertion (2023-05-17 14:18:28 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_tables: fix nft_trans type confusion
netfilter: nft_set_rbtree: fix null deref on element insertion
Tom Rix (1):
netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
net/netfilter/nf_conntrack_netlink.c | 4 ++++
net/netfilter/nf_tables_api.c | 4 +---
net/netfilter/nft_set_rbtree.c | 20 +++++++++++++-------
--
2.39.3
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-05-03 6:32 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-05-03 6:32 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Hit ENOENT when trying to update an unexisting base chain.
2) Fix libmnl pkg-config usage in selftests, from Jeremy Sowden.
3) KASAN reports use-after-free when deleting a set element for an
anonymous set that was already removed in the same transaction,
reported by P. Sondej and P. Krysiuk.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit c6d96df9fa2c1d19525239d4262889cce594ce6c:
net: ethernet: mtk_eth_soc: drop generic vlan rx offload, only use DSA untagging (2023-05-02 20:19:52 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-05-03
for you to fetch changes up to c1592a89942e9678f7d9c8030efa777c0d57edab:
netfilter: nf_tables: deactivate anonymous set from preparation phase (2023-05-03 08:24:32 +0200)
----------------------------------------------------------------
netfilter pull request 23-05-03
----------------------------------------------------------------
Jeremy Sowden (1):
selftests: netfilter: fix libmnl pkg-config usage
Pablo Neira Ayuso (2):
netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update with missing attributes
netfilter: nf_tables: deactivate anonymous set from preparation phase
include/net/netfilter/nf_tables.h | 1 +
net/netfilter/nf_tables_api.c | 41 +++++++++++++++++++++---------
net/netfilter/nft_dynset.c | 2 +-
net/netfilter/nft_lookup.c | 2 +-
net/netfilter/nft_objref.c | 2 +-
tools/testing/selftests/netfilter/Makefile | 7 +++--
6 files changed, 38 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-03-07 10:04 Pablo Neira Ayuso
2023-03-07 12:57 ` Paolo Abeni
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-07 10:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Restore ctnetlink zero mark in events and dump, from Ivan Delalande.
2) Fix deadlock due to missing disabled bh in tproxy, from Florian Westphal.
3) Safer maximum chain load in conntrack, from Eric Dumazet.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c77737b736ceb50fdf150434347dbd81ec76dbb1:
netfilter: conntrack: adopt safer max chain length (2023-03-07 10:58:06 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: conntrack: adopt safer max chain length
Florian Westphal (1):
netfilter: tproxy: fix deadlock due to missing BH disable
Ivan Delalande (1):
netfilter: ctnetlink: revert to dumping mark regardless of event type
include/net/netfilter/nf_tproxy.h | 7 +++++++
net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +-
net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +-
net/netfilter/nf_conntrack_core.c | 4 ++--
net/netfilter/nf_conntrack_netlink.c | 14 +++++++-------
5 files changed, 18 insertions(+), 11 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-03-07 10:04 Pablo Neira Ayuso
@ 2023-03-07 12:57 ` Paolo Abeni
2023-03-07 17:26 ` Jakub Kicinski
0 siblings, 1 reply; 43+ messages in thread
From: Paolo Abeni @ 2023-03-07 12:57 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: davem, netdev, kuba, edumazet
On Tue, 2023-03-07 at 11:04 +0100, Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Restore ctnetlink zero mark in events and dump, from Ivan Delalande.
>
> 2) Fix deadlock due to missing disabled bh in tproxy, from Florian Westphal.
>
> 3) Safer maximum chain load in conntrack, from Eric Dumazet.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
>
> Thanks.
>
> ----------------------------------------------------------------
>
> The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
>
> Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
It's not clear to me the root cause, but pulling from the above ref.
yields nothing. I have to replace 'HEAD' with main to get the expected
patches.
Cheers,
Paolo
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-03-07 12:57 ` Paolo Abeni
@ 2023-03-07 17:26 ` Jakub Kicinski
2023-03-08 9:34 ` Pablo Neira Ayuso
0 siblings, 1 reply; 43+ messages in thread
From: Jakub Kicinski @ 2023-03-07 17:26 UTC (permalink / raw)
To: Paolo Abeni, Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, edumazet
On Tue, 07 Mar 2023 13:57:07 +0100 Paolo Abeni wrote:
> On Tue, 2023-03-07 at 11:04 +0100, Pablo Neira Ayuso wrote:
> > The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
> >
> > Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
> >
> > are available in the Git repository at:
> >
> > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
>
> It's not clear to me the root cause, but pulling from the above ref.
> yields nothing. I have to replace 'HEAD' with main to get the expected
> patches.
Possibly netfilter folks did not update HEAD to point to main?
ssh git@gitolite.kernel.org symbolic-ref \
pub/scm/linux/kernel/git/netfilter/nf \
HEAD refs/heads/main
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-03-07 17:26 ` Jakub Kicinski
@ 2023-03-08 9:34 ` Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-08 9:34 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Paolo Abeni, netfilter-devel, davem, netdev, edumazet
On Tue, Mar 07, 2023 at 09:26:04AM -0800, Jakub Kicinski wrote:
> On Tue, 07 Mar 2023 13:57:07 +0100 Paolo Abeni wrote:
> > On Tue, 2023-03-07 at 11:04 +0100, Pablo Neira Ayuso wrote:
> > > The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
> > >
> > > Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
> > >
> > > are available in the Git repository at:
> > >
> > > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
> >
> > It's not clear to me the root cause, but pulling from the above ref.
> > yields nothing. I have to replace 'HEAD' with main to get the expected
> > patches.
>
> Possibly netfilter folks did not update HEAD to point to main?
>
> ssh git@gitolite.kernel.org symbolic-ref \
> pub/scm/linux/kernel/git/netfilter/nf \
> HEAD refs/heads/main
Fixed, thanks.
I will also review my pull request scripts to check if someone got
unadjusted after the switch to the main branch.
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-03-01 22:20 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-01 22:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix bogus error report in selftests/netfilter/nft_nat.sh,
from Hangbin Liu.
2) Initialize last and quota expressions from template when
expr_ops::clone is called, otherwise, states are not restored
accordingly when loading a dynamic set with elements using
these two expressions.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8f9850dd8d23c1290cb642ce9548a440da5771ec:
net: phy: unlock on error in phy_probe() (2023-02-28 12:40:12 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to aabef97a35160461e9c576848ded737558d89055:
netfilter: nft_quota: copy content when cloning expression (2023-03-01 17:23:23 +0100)
----------------------------------------------------------------
Hangbin Liu (1):
selftests: nft_nat: ensuring the listening side is up before starting the client
Pablo Neira Ayuso (2):
netfilter: nft_last: copy content when cloning expression
netfilter: nft_quota: copy content when cloning expression
net/netfilter/nft_last.c | 4 ++++
net/netfilter/nft_quota.c | 6 +++++-
tools/testing/selftests/netfilter/nft_nat.sh | 2 ++
3 files changed, 11 insertions(+), 1 deletion(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-01-13 16:41 Pablo Neira Ayuso
2023-01-18 3:03 ` Jakub Kicinski
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-13 16:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
[ Resend Cc'ing netdev, previous PR did not CC netdev accidentally. ]
Hi,
The following patchset contains Netfilter fixes for net:
1) Increase timeout to 120 seconds for netfilter selftests to fix
nftables transaction tests, from Florian Westphal.
2) Fix overflow in bitmap_ip_create() due to integer arithmetics
in a 64-bit bitmask, from Gavrilov Ilia.
3) Fix incorrect arithmetics in nft_payload with double-tagged
vlan matching.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef:
Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2023-01-11 12:55:09 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 696e1a48b1a1b01edad542a1ef293665864a4dd0:
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (2023-01-11 19:18:04 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia (1):
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Pablo Neira Ayuso (1):
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
net/netfilter/nft_payload.c | 2 +-
tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
4 files changed, 13 insertions(+), 10 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-01-13 16:41 Pablo Neira Ayuso
@ 2023-01-18 3:03 ` Jakub Kicinski
0 siblings, 0 replies; 43+ messages in thread
From: Jakub Kicinski @ 2023-01-18 3:03 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, pabeni, edumazet
On Fri, 13 Jan 2023 17:41:03 +0100 Pablo Neira Ayuso wrote:
> 1) Increase timeout to 120 seconds for netfilter selftests to fix
> nftables transaction tests, from Florian Westphal.
>
> 2) Fix overflow in bitmap_ip_create() due to integer arithmetics
> in a 64-bit bitmask, from Gavrilov Ilia.
>
> 3) Fix incorrect arithmetics in nft_payload with double-tagged
> vlan matching.
FWIW pulled yesterday, thanks!
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-01-11 21:22 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-11 21:22 UTC (permalink / raw)
To: netfilter-devel
Hi,
The following patchset contains Netfilter fixes for net:
1) Increase timeout to 120 seconds for netfilter selftests to fix
nftables transaction tests, from Florian Westphal.
2) Fix overflow in bitmap_ip_create() due to integer arithmetics
in a 64-bit bitmask, from Gavrilov Ilia.
3) Fix incorrect arithmetics in nft_payload with double-tagged
vlan matching.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef:
Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2023-01-11 12:55:09 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 696e1a48b1a1b01edad542a1ef293665864a4dd0:
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (2023-01-11 19:18:04 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia (1):
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Pablo Neira Ayuso (1):
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
net/netfilter/nft_payload.c | 2 +-
tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
4 files changed, 13 insertions(+), 10 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-11-22 21:28 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-22 21:28 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patch contains another round of Netfilter fixes for net:
1) Fix regression in ipset hash:ip with IPv4 range, from Vishwanath Pai.
This is fixing up a bug introduced in the 6.0 release.
2) The "netfilter: ipset: enforce documented limit to prevent allocating
huge memory" patch contained a wrong condition which makes impossible to
add up to 64 clashing elements to a hash:net,iface type of set while it
is the documented feature of the set type. The patch fixes the condition
and thus makes possible to add the elements while keeps preventing
allocating huge memory, from Jozsef Kadlecsik. This has been broken
for several releases.
3) Missing locking when updating the flow block list which might lead
a reader to crash. This has been broken since the introduction of the
flowtable hardware offload support.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit badbda1a01860c80c6ab60f329ef46c713653a27:
octeontx2-af: cn10k: mcs: Fix copy and paste bug in mcs_bbe_intr_handler() (2022-11-21 13:04:28 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to bcd9e3c1656d0f7dd9743598c65c3ae24efb38d0:
netfilter: flowtable_offload: add missing locking (2022-11-22 22:17:12 +0100)
----------------------------------------------------------------
Felix Fietkau (1):
netfilter: flowtable_offload: add missing locking
Jozsef Kadlecsik (1):
netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
Vishwanath Pai (1):
netfilter: ipset: regression in ip_set_hash_ip.c
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
net/netfilter/ipset/ip_set_hash_ip.c | 8 +++-----
net/netfilter/nf_flow_table_offload.c | 4 ++++
3 files changed, 8 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-11-09 11:28 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-09 11:28 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix deadlock in nfnetlink due to missing mutex release in error path,
from Ziyang Xuan.
2) Clean up pending autoload module list from nf_tables_exit_net() path,
from Shigeru Yoshida.
3) Fixes for the netfilter's reverse path selftest, from Phil Sutter.
All of these bugs have been around for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit ce9e57feeed81d17d5e80ed86f516ff0d39c3867:
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (2022-11-08 15:15:55 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 58bb78ce02269c0cf5b1f2bd2e4a605500b44c6b:
selftests: netfilter: Fix and review rpath.sh (2022-11-09 10:29:57 +0100)
----------------------------------------------------------------
Phil Sutter (1):
selftests: netfilter: Fix and review rpath.sh
Shigeru Yoshida (1):
netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()
Ziyang Xuan (1):
netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg()
net/netfilter/nf_tables_api.c | 3 ++-
net/netfilter/nfnetlink.c | 1 +
tools/testing/selftests/netfilter/rpath.sh | 14 ++++++++------
3 files changed, 11 insertions(+), 7 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] netfilter fixes for net
@ 2022-10-12 12:18 Florian Westphal
0 siblings, 0 replies; 43+ messages in thread
From: Florian Westphal @ 2022-10-12 12:18 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, Eric Dumazet, David S. Miller, Jakub Kicinski,
netfilter-devel, Florian Westphal
Hello,
This series from Phil Sutter for the *net* tree fixes a problem with a change
from the 6.1 development phase: the change to nft_fib should have used
the more recent flowic_l3mdev field. Pointed out by Guillaume Nault.
This also makes the older iptables module follow the same pattern.
Also add selftest case and avoid test failure in nft_fib.sh when the
host environment has set rp_filter=1.
Please consider pulling this from
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git master
----------------------------------------------------------------
The following changes since commit 739cfa34518ef3a6789f5f77239073972a387359:
net/mlx5: Make ASO poll CQ usable in atomic context (2022-10-12 09:16:05 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git master
for you to fetch changes up to 6a91e7270936c5a504af7e0a197d7021e169d281:
selftests: netfilter: Fix nft_fib.sh for all.rp_filter=1 (2022-10-12 14:08:15 +0200)
----------------------------------------------------------------
Phil Sutter (3):
selftests: netfilter: Test reverse path filtering
netfilter: rpfilter/fib: Populate flowic_l3mdev field
selftests: netfilter: Fix nft_fib.sh for all.rp_filter=1
net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
net/ipv4/netfilter/nft_fib_ipv4.c | 2 +-
net/ipv6/netfilter/ip6t_rpfilter.c | 9 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 5 +-
tools/testing/selftests/netfilter/Makefile | 2 +-
tools/testing/selftests/netfilter/nft_fib.sh | 1 +
tools/testing/selftests/netfilter/rpath.sh | 147 +++++++++++++++++++++++++++
7 files changed, 156 insertions(+), 12 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/rpath.sh
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-07-11 9:33 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-07-11 9:33 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) refcount_inc_not_zero() is not semantically equivalent to
atomic_int_not_zero(), from Florian Westphal. My understanding was
that refcount_*() API provides a wrapper to easier debugging of
reference count leaks, however, there are semantic differences
between these two APIs, where refcount_inc_not_zero() needs a barrier.
Reason for this subtle difference to me is unknown.
2) packet logging is not correct for ARP and IP packets, from the
ARP family and netdev/egress respectively. Use skb_network_offset()
to reach the headers accordingly.
3) set element extension length have been growing over time, replace
a BUG_ON by EINVAL which might be triggerable from userspace.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 280e3a857d96f9ca8e24632788e1e7a0fec4e9f7:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2022-07-03 12:29:18 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c39ba4de6b0a843bec5d46c2b6f2064428dada5e:
netfilter: nf_tables: replace BUG_ON by element length check (2022-07-09 16:25:09 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: fix crash due to confirmed bit load reordering
Pablo Neira Ayuso (2):
netfilter: nf_log: incorrect offset to network header
netfilter: nf_tables: replace BUG_ON by element length check
include/net/netfilter/nf_tables.h | 14 ++++---
net/netfilter/nf_conntrack_core.c | 22 ++++++++++
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_conntrack_standalone.c | 3 ++
net/netfilter/nf_log_syslog.c | 8 ++--
net/netfilter/nf_tables_api.c | 72 +++++++++++++++++++++++----------
6 files changed, 90 insertions(+), 30 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-06-29 17:13 Pablo Neira Ayuso
2022-06-30 3:20 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-06-29 17:13 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Restore set counter when one of the CPU loses race to add elements
to sets.
2) After NF_STOLEN, skb might be there no more, update nftables trace
infra to avoid access to skb in this case. From Florian Westphal.
3) nftables bridge might register a prerouting hook with zero priority,
br_netfilter incorrectly skips it. Also from Florian.
Florian Westphal (2):
netfilter: nf_tables: avoid skb access on nf_stolen
netfilter: br_netfilter: do not skip all hooks with 0 priority
Pablo Neira Ayuso (1):
netfilter: nft_dynset: restore set element counter when failing to update
include/net/netfilter/nf_tables.h | 16 ++++++-----
net/bridge/br_netfilter_hooks.c | 21 ++++++++++++---
net/netfilter/nf_tables_core.c | 24 ++++++++++++++---
net/netfilter/nf_tables_trace.c | 44 +++++++++++++++++--------------
net/netfilter/nft_set_hash.c | 2 ++
5 files changed, 75 insertions(+), 32 deletions(-)
--
2.30.2
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit cb8092d70a6f5f01ec1490fce4d35efed3ed996c:
tipc: move bc link creation back to tipc_node_create (2022-06-27 11:51:56 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c2577862eeb0be94f151f2f1fff662b028061b00:
netfilter: br_netfilter: do not skip all hooks with 0 priority (2022-06-27 19:23:27 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_tables: avoid skb access on nf_stolen
netfilter: br_netfilter: do not skip all hooks with 0 priority
Pablo Neira Ayuso (1):
netfilter: nft_dynset: restore set element counter when failing to update
include/net/netfilter/nf_tables.h | 16 ++++++++------
net/bridge/br_netfilter_hooks.c | 21 ++++++++++++++++---
net/netfilter/nf_tables_core.c | 24 ++++++++++++++++++---
net/netfilter/nf_tables_trace.c | 44 +++++++++++++++++++++------------------
net/netfilter/nft_set_hash.c | 2 ++
5 files changed, 75 insertions(+), 32 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-06-29 17:13 Pablo Neira Ayuso
@ 2022-06-30 3:20 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 43+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-06-30 3:20 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Wed, 29 Jun 2022 19:13:51 +0200 you wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Restore set counter when one of the CPU loses race to add elements
> to sets.
>
> [...]
Here is the summary with links:
- [net,1/3] netfilter: nft_dynset: restore set element counter when failing to update
https://git.kernel.org/netdev/net/c/05907f10e235
- [net,2/3] netfilter: nf_tables: avoid skb access on nf_stolen
https://git.kernel.org/netdev/net/c/e34b9ed96ce3
- [net,3/3] netfilter: br_netfilter: do not skip all hooks with 0 priority
https://git.kernel.org/netdev/net/c/c2577862eeb0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-04-28 14:21 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-28 14:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
This patchset contains Netfilter fixes for net:
1) Fix incorrect TCP connection tracking window reset for non-syn
packets, from Florian Westphal.
2) Incorrect dependency on CONFIG_NFT_FLOW_OFFLOAD, from Volodymyr Mytnyk.
3) Fix nft_socket from the output path, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit a1bde8c92d27d178a988bfd13d229c170b8135aa:
Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net -queue (2022-04-27 10:58:39 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 743b83f15d4069ea57c3e40996bf4a1077e0cdc1:
netfilter: nft_socket: only do sk lookups when indev is available (2022-04-28 16:15:23 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_conntrack_tcp: re-init for syn packets only
netfilter: nft_socket: only do sk lookups when indev is available
Volodymyr Mytnyk (1):
netfilter: conntrack: fix udp offload timeout sysctl
net/netfilter/nf_conntrack_proto_tcp.c | 21 ++++---------
net/netfilter/nf_conntrack_standalone.c | 2 +-
net/netfilter/nft_socket.c | 52 ++++++++++++++++++++++++---------
3 files changed, 45 insertions(+), 30 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-03-28 8:20 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-28 8:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Incorrect output device in nf_egress hook, from Phill Sutter.
2) Preserve liberal flag in TCP conntrack state, reported by Sven Auhagen.
3) Use GFP_KERNEL_ACCOUNT flag for nf_tables objects, from Vasily Averin.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f92fcb5c00dc924a4661d5bf68de7937040f26b8:
Merge branch 'ice-avoid-sleeping-scheduling-in-atomic-contexts' (2022-03-23 10:40:44 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 33758c891479ea1c736abfee64b5225925875557:
memcg: enable accounting for nft objects (2022-03-28 10:11:23 +0200)
----------------------------------------------------------------
Pablo Neira Ayuso (1):
netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
Phil Sutter (1):
netfilter: egress: Report interface as outgoing
Vasily Averin (1):
memcg: enable accounting for nft objects
include/linux/netfilter_netdev.h | 2 +-
net/netfilter/core.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++----
net/netfilter/nf_tables_api.c | 44 +++++++++++++++++-----------------
4 files changed, 37 insertions(+), 28 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-03-17 20:25 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-17 20:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix PPPoE and QinQ with flowtable inet family.
2) Missing register validation in nf_tables.
3) Initialize registers to avoid stack memleak to userspace.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit dea2d93a8ba437460c5f21bdfa4ada57fa1d2179:
Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue (2022-03-16 10:07:43 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 4c905f6740a365464e91467aa50916555b28213d:
netfilter: nf_tables: initialize registers in nft_do_chain() (2022-03-17 15:50:27 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: flowtable: Fix QinQ and pppoe support for inet table
netfilter: nf_tables: validate registers coming from userspace.
netfilter: nf_tables: initialize registers in nft_do_chain()
include/net/netfilter/nf_flow_table.h | 18 ++++++++++++++++++
net/netfilter/nf_flow_table_inet.c | 17 +++++++++++++++++
net/netfilter/nf_flow_table_ip.c | 18 ------------------
net/netfilter/nf_tables_api.c | 22 +++++++++++++++++-----
net/netfilter/nf_tables_core.c | 2 +-
5 files changed, 53 insertions(+), 24 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-03-12 22:03 Pablo Neira Ayuso
2022-03-14 22:54 ` Jakub Kicinski
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-12 22:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net coming late
in the 5.17-rc process:
1) Revert port remap to mitigate shadowing service ports, this is causing
problems in existing setups and this mitigation can be achieved with
explicit ruleset, eg.
... tcp sport < 16386 tcp dport >= 32768 masquerade random
This patches provided a built-in policy similar to the one described above.
2) Disable register tracking infrastructure in nf_tables. Florian reported
two issues:
- Existing expressions with no implemented .reduce interface
that causes data-store on register should cancel the tracking.
- Register clobbering might be possible storing data on registers that
are larger than 32-bits.
This might lead to generating incorrect ruleset bytecode. These two
issues are scheduled to be addressed in the next release cycle.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f8e9bd34cedd89b93b1167aa32ab8ecd6c2ccf4a:
Merge branch 'smc-fix' (2022-03-03 10:34:18 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to ed5f85d4229010235eab1e3d9acf6970d9304963:
netfilter: nf_tables: disable register tracking (2022-03-12 16:07:38 +0100)
----------------------------------------------------------------
Florian Westphal (2):
Revert "netfilter: nat: force port remap to prevent shadowing well-known ports"
Revert "netfilter: conntrack: tag conntracks picked up in local out hook"
Pablo Neira Ayuso (1):
netfilter: nf_tables: disable register tracking
include/net/netfilter/nf_conntrack.h | 1 -
net/netfilter/nf_conntrack_core.c | 3 --
net/netfilter/nf_nat_core.c | 43 ++--------------------------
net/netfilter/nf_tables_api.c | 9 ++++--
tools/testing/selftests/netfilter/nft_nat.sh | 5 ++--
5 files changed, 12 insertions(+), 49 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-03-12 22:03 Pablo Neira Ayuso
@ 2022-03-14 22:54 ` Jakub Kicinski
2022-03-14 23:07 ` Florian Westphal
0 siblings, 1 reply; 43+ messages in thread
From: Jakub Kicinski @ 2022-03-14 22:54 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Sat, 12 Mar 2022 23:03:12 +0100 Pablo Neira Ayuso wrote:
> 1) Revert port remap to mitigate shadowing service ports, this is causing
> problems in existing setups and this mitigation can be achieved with
> explicit ruleset, eg.
>
> ... tcp sport < 16386 tcp dport >= 32768 masquerade random
>
> This patches provided a built-in policy similar to the one described above.
>
> 2) Disable register tracking infrastructure in nf_tables. Florian reported
> two issues:
>
> - Existing expressions with no implemented .reduce interface
> that causes data-store on register should cancel the tracking.
> - Register clobbering might be possible storing data on registers that
> are larger than 32-bits.
>
> This might lead to generating incorrect ruleset bytecode. These two
> issues are scheduled to be addressed in the next release cycle.
Minor nit for the future - it'd still be useful to have Fixes tags even
for reverts or current release fixes so that lowly backporters (myself
included) do not have to dig into history to double confirm patches
are not needed in the production kernels we maintain. Thanks!
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-03-14 22:54 ` Jakub Kicinski
@ 2022-03-14 23:07 ` Florian Westphal
2022-03-14 23:18 ` Jakub Kicinski
0 siblings, 1 reply; 43+ messages in thread
From: Florian Westphal @ 2022-03-14 23:07 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Pablo Neira Ayuso, netfilter-devel, davem, netdev
Jakub Kicinski <kuba@kernel.org> wrote:
> Minor nit for the future - it'd still be useful to have Fixes tags even
> for reverts or current release fixes so that lowly backporters (myself
> included) do not have to dig into history to double confirm patches
> are not needed in the production kernels we maintain. Thanks!
Understood, will do so next time.
For the record, the tags would have been:
Fixes: 878aed8db324 ("netfilter: nat: force port remap to prevent shadowing well-known ports")
Fixes: 4a6fbdd801e8 ("netfilter: conntrack: tag conntracks picked up in local out hook")
Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
... all were merged v5.17-rc1 onwards.
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-03-14 23:07 ` Florian Westphal
@ 2022-03-14 23:18 ` Jakub Kicinski
0 siblings, 0 replies; 43+ messages in thread
From: Jakub Kicinski @ 2022-03-14 23:18 UTC (permalink / raw)
To: Florian Westphal; +Cc: Pablo Neira Ayuso, netfilter-devel, davem, netdev
On Tue, 15 Mar 2022 00:07:19 +0100 Florian Westphal wrote:
> Jakub Kicinski <kuba@kernel.org> wrote:
> > Minor nit for the future - it'd still be useful to have Fixes tags even
> > for reverts or current release fixes so that lowly backporters (myself
> > included) do not have to dig into history to double confirm patches
> > are not needed in the production kernels we maintain. Thanks!
>
> Understood, will do so next time.
>
> For the record, the tags would have been:
>
> Fixes: 878aed8db324 ("netfilter: nat: force port remap to prevent shadowing well-known ports")
> Fixes: 4a6fbdd801e8 ("netfilter: conntrack: tag conntracks picked up in local out hook")
> Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
>
> ... all were merged v5.17-rc1 onwards.
Thanks!
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-12-17 8:53 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-12-17 8:53 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 1578 bytes --]
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix UAF in set catch-all element, from Eric Dumazet.
2) Fix MAC mangling for multicast/loopback traffic in nfnetlink_queue
and nfnetlink_log, from Ignacy Gawędzki.
3) Remove expired entries from ctnetlink dump path regardless the tuple
direction, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1d1c950faa81e1c287c9e14f307f845b190eb578:
Merge tag 'wireless-drivers-2021-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers (2021-12-15 14:43:07 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 76f12e632a15a20c8de3532d64a0708cf0e32f11:
netfilter: ctnetlink: remove expired entries first (2021-12-16 14:10:52 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
Florian Westphal (1):
netfilter: ctnetlink: remove expired entries first
Ignacy Gawędzki (1):
netfilter: fix regression in looped (broad|multi)cast's MAC handling
net/netfilter/nf_conntrack_netlink.c | 5 +++--
net/netfilter/nf_tables_api.c | 4 ++--
net/netfilter/nfnetlink_log.c | 3 ++-
net/netfilter/nfnetlink_queue.c | 3 ++-
4 files changed, 9 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-06-10 16:54 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-06-10 16:54 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix a crash when stateful expression with its own gc callback
is used in a set definition.
2) Skip IPv6 packets from any link-local address in IPv6 fib expression.
Add a selftest for this scenario, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you!
----------------------------------------------------------------
The following changes since commit f2386cf7c5f4ff5d7b584f5d92014edd7df6c676:
net: lantiq: disable interrupt before sheduling NAPI (2021-06-08 19:16:32 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 12f36e9bf678a81d030ca1b693dcda62b55af7c5:
netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local (2021-06-09 21:11:03 +0200)
----------------------------------------------------------------
Florian Westphal (2):
selftests: netfilter: add fib test case
netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
Pablo Neira Ayuso (1):
netfilter: nf_tables: initialize set before expression setup
net/ipv6/netfilter/nft_fib_ipv6.c | 22 ++-
net/netfilter/nf_tables_api.c | 85 ++++++-----
tools/testing/selftests/netfilter/Makefile | 2 +-
tools/testing/selftests/netfilter/nft_fib.sh | 221 +++++++++++++++++++++++++++
4 files changed, 283 insertions(+), 47 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/nft_fib.sh
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-02-02 15:21 Pablo Neira Ayuso
2021-02-02 15:25 ` Pablo Neira Ayuso
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-02 15:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
Hi,
The following patchset contains Netfilter fixes for net:
1) Honor stateful expressions defined in the set from the dynset
extension. The set definition provides a stateful expression
that must be used by the dynset expression in case it is specified.
2) Missing timeout extension in the set element in the dynset
extension leads to inconsistent ruleset listing, not allowing
the user to restore timeout and expiration on ruleset reload.
3) Do not dump the stateful expression from the dynset extension
if it coming from the set definition.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit c8a8ead01736419a14c3106e1f26a79d74fc84c7:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2021-01-12 20:25:29 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to ce5379963b2884e9d23bea0c5674a7251414c84b:
netfilter: nft_dynset: dump expressions when set definition contains no expressions (2021-01-16 19:54:42 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nft_dynset: honor stateful expressions in set definition
netfilter: nft_dynset: add timeout extension to template
netfilter: nft_dynset: dump expressions when set definition contains no expressions
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/nf_tables_api.c | 5 ++---
net/netfilter/nft_dynset.c | 41 +++++++++++++++++++++++++--------------
3 files changed, 30 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2021-02-02 15:21 Pablo Neira Ayuso
@ 2021-02-02 15:25 ` Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-02 15:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
Please, scratch this.
My robot resent an old pull request that was stale on my submission
folder.
Sorry for the noise.
On Tue, Feb 02, 2021 at 04:21:52PM +0100, Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Honor stateful expressions defined in the set from the dynset
> extension. The set definition provides a stateful expression
> that must be used by the dynset expression in case it is specified.
>
> 2) Missing timeout extension in the set element in the dynset
> extension leads to inconsistent ruleset listing, not allowing
> the user to restore timeout and expiration on ruleset reload.
>
> 3) Do not dump the stateful expression from the dynset extension
> if it coming from the set definition.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
>
> Thanks!
>
> ----------------------------------------------------------------
>
> The following changes since commit c8a8ead01736419a14c3106e1f26a79d74fc84c7:
>
> Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2021-01-12 20:25:29 -0800)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
>
> for you to fetch changes up to ce5379963b2884e9d23bea0c5674a7251414c84b:
>
> netfilter: nft_dynset: dump expressions when set definition contains no expressions (2021-01-16 19:54:42 +0100)
>
> ----------------------------------------------------------------
> Pablo Neira Ayuso (3):
> netfilter: nft_dynset: honor stateful expressions in set definition
> netfilter: nft_dynset: add timeout extension to template
> netfilter: nft_dynset: dump expressions when set definition contains no expressions
>
> include/net/netfilter/nf_tables.h | 2 ++
> net/netfilter/nf_tables_api.c | 5 ++---
> net/netfilter/nft_dynset.c | 41 +++++++++++++++++++++++++--------------
> 3 files changed, 30 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-01-27 13:25 Pablo Neira Ayuso
0 siblings, 0 replies; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-01-27 13:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Honor stateful expressions defined in the set from the dynset
extension. The set definition provides a stateful expression
that must be used by the dynset expression in case it is specified.
2) Missing timeout extension in the set element in the dynset
extension leads to inconsistent ruleset listing, not allowing
the user to restore timeout and expiration on ruleset reload.
3) Do not dump the stateful expression from the dynset extension
if it coming from the set definition.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit c8a8ead01736419a14c3106e1f26a79d74fc84c7:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2021-01-12 20:25:29 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to ce5379963b2884e9d23bea0c5674a7251414c84b:
netfilter: nft_dynset: dump expressions when set definition contains no expressions (2021-01-16 19:54:42 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nft_dynset: honor stateful expressions in set definition
netfilter: nft_dynset: add timeout extension to template
netfilter: nft_dynset: dump expressions when set definition contains no expressions
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/nf_tables_api.c | 5 ++---
net/netfilter/nft_dynset.c | 41 +++++++++++++++++++++++++--------------
3 files changed, 30 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-01-12 22:20 Pablo Neira Ayuso
2021-01-13 4:26 ` Jakub Kicinski
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-01-12 22:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Pass conntrack -f to specify family in netfilter conntrack helper
selftests, from Chen Yi.
2) Honor hashsize modparam from nf_conntrack_buckets sysctl,
from Jesper D. Brouer.
3) Fix memleak in nf_nat_init() error path, from Dinghao Liu.
Chen Yi (1):
selftests: netfilter: Pass family parameter "-f" to conntrack tool
Dinghao Liu (1):
netfilter: nf_nat: Fix memleak in nf_nat_init
Jesper Dangaard Brouer (1):
netfilter: conntrack: fix reading nf_conntrack_buckets
net/netfilter/nf_conntrack_standalone.c | 3 +++
net/netfilter/nf_nat_core.c | 1 +
.../selftests/netfilter/nft_conntrack_helper.sh | 12 +++++++++---
3 files changed, 13 insertions(+), 3 deletions(-)
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit c49243e8898233de18edfaaa5b7b261ea457f221:
Merge branch 'net-fix-issues-around-register_netdevice-failures' (2021-01-08 19:27:44 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 869f4fdaf4ca7bb6e0d05caf6fa1108dddc346a7:
netfilter: nf_nat: Fix memleak in nf_nat_init (2021-01-11 00:34:11 +0100)
----------------------------------------------------------------
Chen Yi (1):
selftests: netfilter: Pass family parameter "-f" to conntrack tool
Dinghao Liu (1):
netfilter: nf_nat: Fix memleak in nf_nat_init
Jesper Dangaard Brouer (1):
netfilter: conntrack: fix reading nf_conntrack_buckets
net/netfilter/nf_conntrack_standalone.c | 3 +++
net/netfilter/nf_nat_core.c | 1 +
tools/testing/selftests/netfilter/nft_conntrack_helper.sh | 12 +++++++++---
3 files changed, 13 insertions(+), 3 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2021-01-12 22:20 Pablo Neira Ayuso
@ 2021-01-13 4:26 ` Jakub Kicinski
0 siblings, 0 replies; 43+ messages in thread
From: Jakub Kicinski @ 2021-01-13 4:26 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Tue, 12 Jan 2021 23:20:30 +0100 Pablo Neira Ayuso wrote:
> The following patchset contains Netfilter fixes for net:
>
> 1) Pass conntrack -f to specify family in netfilter conntrack helper
> selftests, from Chen Yi.
>
> 2) Honor hashsize modparam from nf_conntrack_buckets sysctl,
> from Jesper D. Brouer.
>
> 3) Fix memleak in nf_nat_init() error path, from Dinghao Liu.
Pulled, thanks!
^ permalink raw reply [flat|nested] 43+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-01-03 19:29 Pablo Neira Ayuso
2021-01-04 23:04 ` Jakub Kicinski
0 siblings, 1 reply; 43+ messages in thread
From: Pablo Neira Ayuso @ 2021-01-03 19:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub, David,
The following patchset contains Netfilter fixes for net:
1) Missing sanitization of rateest userspace string, bug has been
triggered by syzbot, patch from Florian Westphal.
2) Report EOPNOTSUPP on missing set features in nft_dynset, otherwise
error reporting to userspace via EINVAL is misleading since this is
reserved for malformed netlink requests.
3) New binaries with old kernels might silently accept several set
element expressions. New binaries set on the NFT_SET_EXPR and
NFT_DYNSET_F_EXPR flags to request for several expressions per
element, hence old kernels which do not support for this bail out
with EOPNOTSUPP.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
P.S: Best wishes for 2021.
----------------------------------------------------------------
The following changes since commit 1f45dc22066797479072978feeada0852502e180:
ibmvnic: continue fatal error reset after passive init (2020-12-23 12:56:10 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to b4e70d8dd9ea6bd5d5fb3122586f652326ca09cd:
netfilter: nftables: add set expression flags (2020-12-28 10:50:26 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: xt_RATEEST: reject non-null terminated string from userspace
Pablo Neira Ayuso (2):
netfilter: nft_dynset: report EOPNOTSUPP on missing set feature
netfilter: nftables: add set expression flags
include/uapi/linux/netfilter/nf_tables.h | 3 +++
net/netfilter/nf_tables_api.c | 6 +++++-
net/netfilter/nft_dynset.c | 15 ++++++++++-----
net/netfilter/xt_RATEEST.c | 3 +++
4 files changed, 21 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 43+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2021-01-03 19:29 Pablo Neira Ayuso
@ 2021-01-04 23:04 ` Jakub Kicinski
0 siblings, 0 replies; 43+ messages in thread
From: Jakub Kicinski @ 2021-01-04 23:04 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Sun, 3 Jan 2021 20:29:17 +0100 Pablo Neira Ayuso wrote:
> Hi Jakub, David,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Missing sanitization of rateest userspace string, bug has been
> triggered by syzbot, patch from Florian Westphal.
>
> 2) Report EOPNOTSUPP on missing set features in nft_dynset, otherwise
> error reporting to userspace via EINVAL is misleading since this is
> reserved for malformed netlink requests.
>
> 3) New binaries with old kernels might silently accept several set
> element expressions. New binaries set on the NFT_SET_EXPR and
> NFT_DYNSET_F_EXPR flags to request for several expressions per
> element, hence old kernels which do not support for this bail out
> with EOPNOTSUPP.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks!
> P.S: Best wishes for 2021.
Happy 2021!
^ permalink raw reply [flat|nested] 43+ messages in thread
end of thread, other threads:[~2024-04-18 1:09 UTC | newest]
Thread overview: 43+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-08 19:57 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 1/3] netfilter: nf_tables: integrate pipapo into commit protocol Pablo Neira Ayuso
2023-06-09 8:49 ` Simon Horman
2023-06-10 19:12 ` patchwork-bot+netdevbpf
2023-06-08 19:57 ` [PATCH net 2/3] netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM Pablo Neira Ayuso
2023-06-08 19:57 ` [PATCH net 3/3] netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2024-04-18 1:09 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2024-03-21 0:06 Pablo Neira Ayuso
2024-02-29 0:01 Pablo Neira Ayuso
2024-02-14 23:38 Pablo Neira Ayuso
2023-07-26 15:23 [PATCH net 0/3] netfilter " Florian Westphal
2023-05-17 12:37 [PATCH net 0/3] Netfilter " Florian Westphal
2023-05-03 6:32 Pablo Neira Ayuso
2023-03-07 10:04 Pablo Neira Ayuso
2023-03-07 12:57 ` Paolo Abeni
2023-03-07 17:26 ` Jakub Kicinski
2023-03-08 9:34 ` Pablo Neira Ayuso
2023-03-01 22:20 Pablo Neira Ayuso
2023-01-13 16:41 Pablo Neira Ayuso
2023-01-18 3:03 ` Jakub Kicinski
2023-01-11 21:22 Pablo Neira Ayuso
2022-11-22 21:28 Pablo Neira Ayuso
2022-11-09 11:28 Pablo Neira Ayuso
2022-10-12 12:18 [PATCH net 0/3] netfilter " Florian Westphal
2022-07-11 9:33 [PATCH net 0/3] Netfilter " Pablo Neira Ayuso
2022-06-29 17:13 Pablo Neira Ayuso
2022-06-30 3:20 ` patchwork-bot+netdevbpf
2022-04-28 14:21 Pablo Neira Ayuso
2022-03-28 8:20 Pablo Neira Ayuso
2022-03-17 20:25 Pablo Neira Ayuso
2022-03-12 22:03 Pablo Neira Ayuso
2022-03-14 22:54 ` Jakub Kicinski
2022-03-14 23:07 ` Florian Westphal
2022-03-14 23:18 ` Jakub Kicinski
2021-12-17 8:53 Pablo Neira Ayuso
2021-06-10 16:54 Pablo Neira Ayuso
2021-02-02 15:21 Pablo Neira Ayuso
2021-02-02 15:25 ` Pablo Neira Ayuso
2021-01-27 13:25 Pablo Neira Ayuso
2021-01-12 22:20 Pablo Neira Ayuso
2021-01-13 4:26 ` Jakub Kicinski
2021-01-03 19:29 Pablo Neira Ayuso
2021-01-04 23:04 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).