Skip to content

L
linux
Switch branch/tag
  1. 14 Feb, 2017 6 commits
  3. 13 Feb, 2017 23 commits
  5. 12 Feb, 2017 11 commits
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: honor NFT_SET_OBJECT in set backend selection · 7286ff7f
      Pablo Neira Ayuso authored 
      Check for NFT_SET_OBJECT feature flag, otherwise we may end up selecting
the wrong set backend.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      7286ff7f
    • Pablo Neira Ayuso's avatar
      netfilter: update MAINTAINERS · fc52497e
      Pablo Neira Ayuso authored 
      It's been a while since Patrick has been suspended as coreteam member [1].
Update this file to remove him.

While at this, remove references to all foo-tables variants, given the
project hosts more than just that, eg. ipset, conntrack, ...

[1] https://marc.info/?l=netfilter-devel&m=146887464512702Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      fc52497e
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add NFTA_RULE_ID attribute · 1a94e38d
      Pablo Neira Ayuso authored 
      This new attribute allows us to uniquely identify a rule in transaction.
Robots may trigger an insertion followed by deletion in a batch, in that
scenario we still don't have a public rule handle that we can use to
delete the rule. This is similar to the NFTA_SET_ID attribute that
allows us to refer to an anonymous set from a batch.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1a94e38d
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add check_genid to the nfnetlink subsystem · 74e8bcd2
      Pablo Neira Ayuso authored 
      This patch implements the check generation id as provided by nfnetlink.
This allows us to reject ruleset updates against stale baseline, so
userspace can retry update with a fresh ruleset cache.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      74e8bcd2
    • Pablo Neira Ayuso's avatar
      netfilter: nfnetlink: allow to check for generation ID · 8c4d4e8b
      Pablo Neira Ayuso authored 
      This patch allows userspace to specify the generation ID that has been
used to build an incremental batch update.

If userspace specifies the generation ID in the batch message as
attribute, then nfnetlink compares it to the current generation ID so
you make sure that you work against the right baseline. Otherwise, bail
out with ERESTART so userspace knows that its changeset is stale and
needs to respin. Userspace can do this transparently at the cost of
taking slightly more time to refresh caches and rework the changeset.

This check is optional, if there is no NFNL_BATCH_GENID attribute in the
batch begin message, then no check is performed.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      8c4d4e8b
    • Pablo Neira Ayuso's avatar
      netfilter: nfnetlink: add nfnetlink_rcv_skb_batch() · 48656835
      Pablo Neira Ayuso authored 
      Add new nfnetlink_rcv_skb_batch() to wrap initial nfnetlink batch
handling.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      48656835
    • Pablo Neira Ayuso's avatar
      netfilter: nfnetlink: get rid of u_intX_t types · b745d035
      Pablo Neira Ayuso authored 
      Use uX types instead.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      b745d035
    • Gao Feng's avatar
      netfilter: nf_ct_expect: nf_ct_expect_insert() returns void · 4dee62b1
      Gao Feng authored 
      Because nf_ct_expect_insert() always succeeds now, its return value can
be just void instead of int. And remove code that checks for its return
value.
Signed-off-by: default avatarGao Feng <fgao@ikuai8.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      4dee62b1
    • Gao Feng's avatar
      netfilter: nf_ct_sip: Use mod_timer_pending() · a96e66e7
      Gao Feng authored 
      timer_del() followed by timer_add() can be replaced by
mod_timer_pending().
Signed-off-by: default avatarGao Feng <fgao@ikuai8.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      a96e66e7
    • Eric Dumazet's avatar
      net_sched: fix error recovery at qdisc creation · 87b60cfa
      Eric Dumazet authored 
      Dmitry reported uses after free in qdisc code [1]

The problem here is that ops->init() can return an error.

qdisc_create_dflt() then call ops->destroy(),
while qdisc_create() does _not_ call it.

Four qdisc chose to call their own ops->destroy(), assuming their caller
would not.

This patch makes sure qdisc_create() calls ops->destroy()
and fixes the four qdisc to avoid double free.

[1]
BUG: KASAN: use-after-free in mq_destroy+0x242/0x290 net/sched/sch_mq.c:33 at addr ffff8801d415d440
Read of size 8 by task syz-executor2/5030
CPU: 0 PID: 5030 Comm: syz-executor2 Not tainted 4.3.5-smp-DEV #119
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000046 ffff8801b435b870 ffffffff81bbbed4 ffff8801db000400
 ffff8801d415d440 ffff8801d415dc40 ffff8801c4988510 ffff8801b435b898
 ffffffff816682b1 ffff8801b435b928 ffff8801d415d440 ffff8801c49880c0
Call Trace:
 [<ffffffff81bbbed4>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81bbbed4>] dump_stack+0x6c/0x98 lib/dump_stack.c:51
 [<ffffffff816682b1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:158
 [<ffffffff81668524>] print_address_description mm/kasan/report.c:196 [inline]
 [<ffffffff81668524>] kasan_report_error+0x1b4/0x4b0 mm/kasan/report.c:285
 [<ffffffff81668953>] kasan_report mm/kasan/report.c:305 [inline]
 [<ffffffff81668953>] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:326
 [<ffffffff82527b02>] mq_destroy+0x242/0x290 net/sched/sch_mq.c:33
 [<ffffffff82524bdd>] qdisc_destroy+0x12d/0x290 net/sched/sch_generic.c:953
 [<ffffffff82524e30>] qdisc_create_dflt+0xf0/0x120 net/sched/sch_generic.c:848
 [<ffffffff8252550d>] attach_default_qdiscs net/sched/sch_generic.c:1029 [inline]
 [<ffffffff8252550d>] dev_activate+0x6ad/0x880 net/sched/sch_generic.c:1064
 [<ffffffff824b1db1>] __dev_open+0x221/0x320 net/core/dev.c:1403
 [<ffffffff824b24ce>] __dev_change_flags+0x15e/0x3e0 net/core/dev.c:6858
 [<ffffffff824b27de>] dev_change_flags+0x8e/0x140 net/core/dev.c:6926
 [<ffffffff824f5bf6>] dev_ifsioc+0x446/0x890 net/core/dev_ioctl.c:260
 [<ffffffff824f61fa>] dev_ioctl+0x1ba/0xb80 net/core/dev_ioctl.c:546
 [<ffffffff82430509>] sock_do_ioctl+0x99/0xb0 net/socket.c:879
 [<ffffffff82430d30>] sock_ioctl+0x2a0/0x390 net/socket.c:958
 [<ffffffff816f3b68>] vfs_ioctl fs/ioctl.c:44 [inline]
 [<ffffffff816f3b68>] do_vfs_ioctl+0x8a8/0xe50 fs/ioctl.c:611
 [<ffffffff816f41a4>] SYSC_ioctl fs/ioctl.c:626 [inline]
 [<ffffffff816f41a4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:617
 [<ffffffff8123e357>] entry_SYSCALL_64_fastpath+0x12/0x17
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      87b60cfa
    • Ivan Khoronzhuk's avatar
      net: ethernet: ti: cpsw: return NET_XMIT_DROP if skb_padto failed · 1bf96050
      Ivan Khoronzhuk authored 
      If skb_padto failed the skb has been dropped already, so it was
consumed, but it doesn't mean it was sent, thus no need to update
queue tx time, etc. So, return NET_XMIT_DROP as more appropriate.
Signed-off-by: default avatarIvan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bf96050
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7