Netfilter/IPVS fixes for net
Subsystems (5)
Pablo Neira Ayuso
maintainercover Netfilter/IPVS fixes for net
Hi David,
The following patchset contains Netfilter/IPVS fixes for your net tree, they are:
1) Fix handling of simultaneous open TCP connection in conntrack, from Jozsef Kadlecsik.
2) Insufficient sanitify check of xtables extension names, from Florian Westphal.
3) Skip unnecessary synchronize_rcu() call when transaction log is already empty, from Florian Westphal.
4) Incorrect destination mac validation in ebt_stp, from Stephen Hemminger.
5) xtables module reference counter leak in nft_compat, from Florian Westphal.
6) Incorrect connection reference counting logic in IPVS one-packet scheduler, from Julian Anastasov.
7) Wrong stats for 32-bits CPU in IPVS, also from Julian.
8) Calm down sparse error in netfilter core, also from Florian.
9) Use nla_strlcpy to fix compilation warning in nfnetlink_acct and nfnetlink_cthelper, again from Florian.
10) Missing module alias in icmp and icmp6 xtables extensions, from Florian Westphal.
11) Base chain statistics in nf_tables may be unset/null, from Florian.
12) Fix handling of large matchinfo size in nft_compat, this includes one preparation for before this fix. From Florian.
13) Fix bogus EBUSY error when deleting chains due to incorrect reference counting from the preparation phase of the two-phase commit protocol.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 25eb0ea7174c6e84f21fa59dccbddd0318b17b12:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2018-04-25 22:55:33 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to f0dfd7a2b35b02030949100247d851b793cb275f:
netfilter: nf_tables: fix memory leak on error exit return (2018-05-14 00:21:59 +0200)
----------------------------------------------------------------
Colin Ian King (1):
netfilter: nf_tables: fix memory leak on error exit return
Florian Westphal (9):
netfilter: x_tables: check name length in find_match/target, too
netfilter: nf_tables: skip synchronize_rcu if transaction log is empty
netfilter: nf_tables: nft_compat: fix refcount leak on xt module
netfilter: core: add missing __rcu annotation
netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes
netfilter: x_tables: add module alias for icmp matches
netfilter: nf_tables: don't assume chain stats are set when jumplabel is set
netfilter: nft_compat: prepare for indirect info storage
netfilter: nft_compat: fix handling of large matchinfo size
Jozsef Kadlecsik (1):
netfilter: Fix handling simultaneous open in TCP conntrack
Julian Anastasov (2):
ipvs: fix refcount usage for conns in ops mode
ipvs: fix stats update from local clients
Pablo Neira Ayuso (1):
netfilter: nf_tables: bogus EBUSY in chain deletions
Stephen Hemminger (1):
netfilter: bridge: stp fix reference to uninitialized data
include/net/netfilter/nf_tables.h | 5 + include/uapi/linux/netfilter/nf_conntrack_tcp.h | 3 + net/bridge/netfilter/ebt_stp.c | 4 +- net/ipv4/netfilter/ip_tables.c | 1 + net/ipv6/netfilter/ip6_tables.c | 1 + net/netfilter/core.c | 3 +- net/netfilter/ipvs/ip_vs_conn.c | 17 +- net/netfilter/ipvs/ip_vs_core.c | 12 ++ net/netfilter/nf_conntrack_proto_tcp.c | 11 ++ net/netfilter/nf_tables_api.c | 77 +++++++-- net/netfilter/nf_tables_core.c | 21 ++- net/netfilter/nfnetlink_acct.c | 2 +- net/netfilter/nfnetlink_cthelper.c | 7 +- net/netfilter/nft_compat.c | 201 ++++++++++++++++++------ net/netfilter/nft_immediate.c | 15 +- net/netfilter/x_tables.c | 6 + 16 files changed, 299 insertions(+), 87 deletions(-)
Pablo Neira Ayuso
maintainerPATCH 1/15 netfilter: Fix handling simultaneous open in TCP conntrack
From: Jozsef Kadlecsik <[email protected]>
Dominique Martinet reported a TCP hang problem when simultaneous open was used. The problem is that the tcp_conntracks state table is not smart enough to handle the case. The state table could be fixed by introducing a new state, but that would require more lines of code compared to this patch, due to the required backward compatibility with ctnetlink.
--- include/uapi/linux/netfilter/nf_conntrack_tcp.h | 3 +++ net/netfilter/nf_conntrack_proto_tcp.c | 11 +++++++++++ 2 files changed, 14 insertions(+)
include/uapi/linux/netfilter/nf_conntrack_tcp.h +3 -0
@@ -46,6 +46,9 @@ enum tcp_conntrack {/* Marks possibility for expected RFC5961 challenge ACK */ #define IP_CT_EXP_CHALLENGE_ACK 0x40 +/* Simultaneous open initialized */ +#define IP_CT_TCP_SIMULTANEOUS_OPEN 0x80 +struct nf_ct_tcp_flags {__u8 flags;__u8 mask;
net/netfilter/nf_conntrack_proto_tcp.c +11 -0
@@ -981,6 +981,17 @@ static int tcp_packet(struct nf_conn *ct,return NF_ACCEPT ;/* Don't change state */ }break ; +case TCP_CONNTRACK_SYN_SENT2 : +/* tcp_conntracks table is not smart enough to handle +* simultaneous open. +*/ + ct->proto.tcp.last_flags |=IP_CT_TCP_SIMULTANEOUS_OPEN ; +break ; +case TCP_CONNTRACK_SYN_RECV : +if (dir ==IP_CT_DIR_REPLY && index ==TCP_ACK_SET && + ct->proto.tcp.last_flags &IP_CT_TCP_SIMULTANEOUS_OPEN ) + new_state =TCP_CONNTRACK_ESTABLISHED ; +break ;case TCP_CONNTRACK_CLOSE :if (index ==TCP_RST_SET && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 2/15 netfilter: x_tables: check name length in find_match/target, too
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
ebtables uses find_match() rather than find_request_match in one case (see bcf4934288402be3464110109a4dae3bd6fb3e93,
"netfilter: ebtables: Fix extension lookup with identical name"), so extend the check on name length to those functions too.
--- net/netfilter/x_tables.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/x_tables.c +6 -0
@@ -183,6 +183,9 @@ struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)struct xt_match *m;int err = -ENOENT ; +if (strnlen (name,XT_EXTENSION_MAXNAMELEN ) ==XT_EXTENSION_MAXNAMELEN ) +return ERR_PTR (-EINVAL ); +mutex_lock (&xt[af].mutex);list_for_each_entry (m, &xt[af].match, list) {if (strcmp (m->name, name) ==0 ) {
@@ -229,6 +232,9 @@ struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)struct xt_target *t;int err = -ENOENT ; +if (strnlen (name,XT_EXTENSION_MAXNAMELEN ) ==XT_EXTENSION_MAXNAMELEN ) +return ERR_PTR (-EINVAL ); +mutex_lock (&xt[af].mutex);list_for_each_entry (t, &xt[af].target, list) {if (strcmp (t->name, name) ==0 ) {
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 3/15 netfilter: nf_tables: skip synchronize_rcu if transaction log is empty
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
After processing the transaction log, the remaining entries of the log need to be released.
However, in some cases no entries remain, e.g. because the transaction did not remove anything.
--- net/netfilter/nf_tables_api.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
net/netfilter/nf_tables_api.c +17 -8
@@ -5761,7 +5761,7 @@ static void nft_chain_commit_update(struct nft_trans *trans) } } -static void nf_tables_commit_release (struct nft_trans *trans) +static void nft_commit_release (struct nft_trans *trans) {switch (trans->msg_type) {case NFT_MSG_DELTABLE :
@@ -5790,6 +5790,21 @@ static void nf_tables_commit_release(struct nft_trans *trans)kfree (trans); } +static void nf_tables_commit_release (struct net *net) +{ +struct nft_trans *trans, *next; + +if (list_empty (&net->nft.commit_list)) +return ; + +synchronize_rcu (); + +list_for_each_entry_safe (trans, next, &net->nft.commit_list, list) { +list_del (&trans->list); +nft_commit_release (trans); + } +} +static int nf_tables_commit (struct net *net,struct sk_buff *skb) {struct nft_trans *trans, *next;
@@ -5920,13 +5935,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) } } -synchronize_rcu (); - -list_for_each_entry_safe (trans, next, &net->nft.commit_list, list) { -list_del (&trans->list); -nf_tables_commit_release (trans); - } - +nf_tables_commit_release (net);nf_tables_gen_notify (net, skb,NFT_MSG_NEWGEN );return 0 ;
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 4/15 netfilter: bridge: stp fix reference to uninitialized data
In reply to Pablo Neira AyusoFrom: Stephen Hemminger <[email protected]>
The destination mac (destmac) is only valid if EBT_DESTMAC flag is set. Fix by changing the order of the comparison to look for the flag first.
--- net/bridge/netfilter/ebt_stp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/bridge/netfilter/ebt_stp.c +2 -2
@@ -161,8 +161,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par)/* Make sure the match only receives stp frames */ if (!par->nft_compat && (!ether_addr_equal (e->destmac, eth_stp_addr) || - !is_broadcast_ether_addr (e->destmsk) || - !(e->bitmask &EBT_DESTMAC ))) + !(e->bitmask &EBT_DESTMAC ) || + !is_broadcast_ether_addr (e->destmsk)))return -EINVAL ;return 0 ;
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 5/15 netfilter: nf_tables: nft_compat: fix refcount leak on xt module
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
Taehee Yoo reported following bug:
iptables-compat -I OUTPUT -m cpu --cpu 0
iptables-compat -F
lsmod |grep xt_cpu
xt_cpu 16384 1
Quote:
"When above command is given, a netlink message has two expressions that are the cpu compat and the nft_counter.
The nft_expr_type_get() in the nf_tables_expr_parse() successes first expression then, calls select_ops callback.
(allocates memory and holds module)
But, second nft_expr_type_get() in the nf_tables_expr_parse() returns -EAGAIN because of request_module().
In that point, by the 'goto err1',
the 'module_put(info[i].ops->type->owner)' is called.
There is no release routine."
The core problem is that unlike all other expression, nft_compat select_ops has side effects.
1. it allocates dynamic memory which holds an nft ops struct. In all other expressions, ops has static storage duration.
2. It grabs references to the xt module that it is supposed to invoke.
Depending on where things go wrong, error unwinding doesn't always do the right thing.
In the above scenario, a new nft_compat_expr is created and xt_cpu module gets loaded with a refcount of 1.
Due to to -EAGAIN, the netlink messages get re-parsed. When that happens, nft_compat finds that xt_cpu is already present and increments module refcount again.
This fixes the problem by making select_ops to have no visible side effects and removes all extra module_get/put.
When select_ops creates a new nft_compat expression, the new expression has a refcount of 0, and the xt module gets its refcount incremented.
When error happens, the next call finds existing entry, but will no longer increase the reference count -- the presence of existing nft_xt means we already hold a module reference.
Because nft_xt_put is only called from nft_compat destroy hook, it will never see the initial zero reference count. ->destroy can only be called after ->init(), and that will increase the refcount.
Lastly, we now free nft_xt struct with kfree_rcu. Else, we get use-after free in nf_tables_rule_destroy:
while (expr != nft_expr_last(rule) && expr->ops) {
nf_tables_expr_destroy(ctx, expr);
expr = nft_expr_next(expr); // herenft_expr_next() dereferences expr->ops. This is safe for all users, as ops have static storage duration. In nft_compat case however, its ->destroy callback can free the memory that hold the ops structure.
--- net/netfilter/nft_compat.c | 92 +++++++++++++++++++++++++++++----------------- 1 file changed, 58 insertions(+), 34 deletions(-)
net/netfilter/nft_compat.c +58 -34
@@ -27,14 +27,24 @@ struct nft_xt {struct list_head head;struct nft_expr_ops ops;unsigned int refcnt; + +/* Unlike other expressions, ops doesn't have static storage duration. +* nft core assumes they do. We use kfree_rcu so that nft core can +* can check expr->ops->size even after nft_compat->destroy() frees +* the nft_xt struct that holds the ops structure. +*/ +struct rcu_head rcu_head; }; -static void nft_xt_put (struct nft_xt *xt) +static bool nft_xt_put (struct nft_xt *xt) {if (--xt->refcnt ==0 ) {list_del (&xt->head); -kfree (xt); +kfree_rcu (xt, rcu_head); +return true; } + +return false; } static int nft_compat_chain_validate_dependency(const char *tablename,
@@ -226,6 +236,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,struct xt_target *target = expr->ops->data;struct xt_tgchk_param par;size_t size =XT_ALIGN (nla_len (tb[NFTA_TARGET_INFO ])); +struct nft_xt *nft_xt;u16 proto =0 ;bool inv = false;union nft_entry e = {};
@@ -236,25 +247,22 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,if (ctx->nla[NFTA_RULE_COMPAT ]) { ret =nft_parse_compat (ctx->nla[NFTA_RULE_COMPAT ], &proto, &inv);if (ret <0 ) - goto err; +return ret; }nft_target_set_tgchk_param (&par, ctx, target, info, &e, proto, inv); ret =xt_check_target (&par, size, proto, inv);if (ret <0 ) - goto err; +return ret;/* The standard target cannot be used */ -if (target->target ==NULL ) { - ret = -EINVAL ; - goto err; - } +if (!target->target) +return -EINVAL ; + nft_xt = container_of(expr->ops, struct nft_xt, ops); + nft_xt->refcnt++;return 0 ; -err: -module_put (target->me); -return ret; } static void
@@ -271,8 +279,8 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)if (par.target->destroy !=NULL ) par.target->destroy (&par); - nft_xt_put(container_of(expr->ops, struct nft_xt, ops)); -module_put (target->me); + if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) +module_put (target->me); }static int nft_target_dump (struct sk_buff *skb,const struct nft_expr *expr)
@@ -411,6 +419,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,struct xt_match *match = expr->ops->data;struct xt_mtchk_param par;size_t size =XT_ALIGN (nla_len (tb[NFTA_MATCH_INFO ])); +struct nft_xt *nft_xt;u16 proto =0 ;bool inv = false;union nft_entry e = {};
@@ -421,19 +430,18 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,if (ctx->nla[NFTA_RULE_COMPAT ]) { ret =nft_parse_compat (ctx->nla[NFTA_RULE_COMPAT ], &proto, &inv);if (ret <0 ) - goto err; +return ret; }nft_match_set_mtchk_param (&par, ctx, match, info, &e, proto, inv); ret =xt_check_match (&par, size, proto, inv);if (ret <0 ) - goto err; +return ret; + nft_xt = container_of(expr->ops, struct nft_xt, ops); + nft_xt->refcnt++;return 0 ; -err: -module_put (match->me); -return ret; } static void
@@ -450,8 +458,8 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)if (par.match->destroy !=NULL ) par.match->destroy (&par); - nft_xt_put(container_of(expr->ops, struct nft_xt, ops)); -module_put (match->me); + if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) +module_put (match->me); }static int nft_match_dump (struct sk_buff *skb,const struct nft_expr *expr)
@@ -654,13 +662,8 @@ nft_match_select_ops(const struct nft_ctx *ctx,list_for_each_entry (nft_match, &nft_match_list, head) {struct xt_match *match = nft_match->ops.data; -if (nft_match_cmp (match, mt_name, rev, family)) { -if (!try_module_get (match->me)) -return ERR_PTR (-ENOENT ); - - nft_match->refcnt++; +if (nft_match_cmp (match, mt_name, rev, family))return &nft_match->ops; - } } match =xt_request_find_match (family, mt_name, rev);
@@ -679,7 +682,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, goto err; } - nft_match->refcnt =1 ; + nft_match->refcnt =0 ; nft_match->ops.type = &nft_match_type; nft_match->ops.size =NFT_EXPR_SIZE (XT_ALIGN (match->matchsize)); nft_match->ops.eval = nft_match_eval;
@@ -739,13 +742,8 @@ nft_target_select_ops(const struct nft_ctx *ctx,list_for_each_entry (nft_target, &nft_target_list, head) {struct xt_target *target = nft_target->ops.data; -if (nft_target_cmp (target, tg_name, rev, family)) { -if (!try_module_get (target->me)) -return ERR_PTR (-ENOENT ); - - nft_target->refcnt++; +if (nft_target_cmp (target, tg_name, rev, family))return &nft_target->ops; - } } target =xt_request_find_target (family, tg_name, rev);
@@ -764,7 +762,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, goto err; } - nft_target->refcnt =1 ; + nft_target->refcnt =0 ; nft_target->ops.type = &nft_target_type; nft_target->ops.size =NFT_EXPR_SIZE (XT_ALIGN (target->targetsize)); nft_target->ops.init = nft_target_init;
@@ -823,6 +821,32 @@ static int __init nft_compat_module_init(void) static void __exit nft_compat_module_exit(void) { +struct nft_xt *xt, *next; + +/* list should be empty here, it can be non-empty only in case there +* was an error that caused nft_xt expr to not be initialized fully +* and noone else requested the same expression later. +* +* In this case, the lists contain 0-refcount entries that still +* hold module reference. +*/ +list_for_each_entry_safe (xt, next, &nft_target_list, head) { +struct xt_target *target = xt->ops.data; + +if (WARN_ON_ONCE (xt->refcnt)) +continue ; +module_put (target->me); +kfree (xt); + } + +list_for_each_entry_safe (xt, next, &nft_match_list, head) { +struct xt_match *match = xt->ops.data; + +if (WARN_ON_ONCE (xt->refcnt)) +continue ; +module_put (match->me); +kfree (xt); + }nfnetlink_subsys_unregister (&nfnl_compat_subsys);nft_unregister_expr (&nft_target_type);nft_unregister_expr (&nft_match_type);
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 6/15 ipvs: fix refcount usage for conns in ops mode
In reply to Pablo Neira AyusoFrom: Julian Anastasov <[email protected]>
Connections in One-packet scheduling mode (-o, --ops) are removed with refcnt=0 because they are not hashed in conn table. To avoid refcount_dec reporting this as error, change them to be removed with refcount_dec_if_one as all other connections.
refcount_t hit zero at ip_vs_conn_put+0x31/0x40 [ip_vs] in sh[15519], uid/euid: 497/497
WARNING: CPU: 0 PID: 15519 at ../kernel/panic.c:657 refcount_error_report+0x94/0x9e Modules linked in: ip_vs_rr cirrus ttm sb_edac
edac_core drm_kms_helper crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc mousedev drm aesni_intel aes_x86_64 crypto_simd glue_helper cryptd psmouse evdev input_leds led_class intel_agp fb_sys_fops syscopyarea sysfillrect intel_rapl_perf mac_hid intel_gtt serio_raw sysimgblt agpgart i2c_piix4 i2c_core ata_generic pata_acpi floppy cfg80211 rfkill button loop macvlan ip_vs nf_conntrack libcrc32c crc32c_generic ip_tables x_tables ipv6 crc_ccitt autofs4 ext4 crc16 mbcache jbd2 fscrypto ata_piix libata atkbd libps2 scsi_mod crc32c_intel i8042 rtc_cmos serio af_packet dm_mod dax fuse xen_netfront xen_blkfront
CPU: 0 PID: 15519 Comm: sh Tainted: G W 4.15.17 #1-NixOS Hardware name: Xen HVM domU, BIOS 4.2.amazon 08/24/2006 RIP: 0010:refcount_error_report+0x94/0x9e RSP: 0000:ffffa344dde039c8 EFLAGS: 00010296 RAX: 0000000000000057 RBX: ffffffff92f20e06 RCX: 0000000000000006 RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffffa344dde165c0 RBP: ffffa344dde03b08 R08: 0000000000000218 R09: 0000000000000004 R10: ffffffff93006a80 R11: 0000000000000001 R12: ffffa344d68cd100 R13: 00000000000001f1 R14: ffffffff92f12fb0 R15: 0000000000000004 FS: 00007fc9d2040fc0(0000) GS:ffffa344dde00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000262a000 CR3: 0000000016a0c004 CR4: 00000000001606f0 Call Trace: <IRQ> ex_handler_refcount+0x4e/0x80 fixup_exception+0x33/0x40 do_trap+0x83/0x140 do_error_trap+0x83/0xf0 ? ip_vs_conn_drop_conntrack+0x120/0x1a5 [ip_vs] ? ip_finish_output2+0x29c/0x390 ? ip_finish_output2+0x1a2/0x390 invalid_op+0x1b/0x40 RIP: 0010:ip_vs_conn_put+0x31/0x40 [ip_vs] RSP: 0000:ffffa344dde03bb8 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffffa344df31cf00 RCX: ffffa344d7450198 RDX: 0000000000000003 RSI: 00000000fffffe01 RDI: ffffa344d7450140 RBP: 0000000000000002 R08: 0000000000000476 R09: 0000000000000000 R10: ffffa344dde03b28 R11: ffffa344df200000 R12: ffffa344d7d09000 R13: ffffa344def3a980 R14: ffffffffc04f6e20 R15: 0000000000000008 ip_vs_in.part.29.constprop.36+0x34f/0x640 [ip_vs] ? ip_vs_conn_out_get+0xe0/0xe0 [ip_vs] ip_vs_remote_request4+0x47/0xa0 [ip_vs] ? ip_vs_in.part.29.constprop.36+0x640/0x640 [ip_vs] nf_hook_slow+0x43/0xc0 ip_local_deliver+0xac/0xc0 ? ip_rcv_finish+0x400/0x400 ip_rcv+0x26c/0x380 __netif_receive_skb_core+0x3a0/0xb10 ? inet_gro_receive+0x23c/0x2b0 ? netif_receive_skb_internal+0x24/0xb0 netif_receive_skb_internal+0x24/0xb0 napi_gro_receive+0xb8/0xe0 xennet_poll+0x676/0xb40 [xen_netfront] net_rx_action+0x139/0x3a0 __do_softirq+0xde/0x2b4 irq_exit+0xae/0xb0 xen_evtchn_do_upcall+0x2c/0x40 xen_hvm_callback_vector+0x7d/0x90 </IRQ> RIP: 0033:0x7fc9d11c91f9 RSP: 002b:00007ffebe8a2ea0 EFLAGS: 00000202 ORIG_RAX:
ffffffffffffff0c
RAX: 00000000ffffffff RBX: 0000000002609808 RCX: 0000000000000054
RDX: 0000000000000001 RSI: 0000000002605440 RDI: 00000000025f940e
RBP: 00000000025f940e R08: 000000000260213d R09: 1999999999999999
R10: 000000000262a808 R11: 00000000025f942d R12: 00000000025f940e
R13: 00007fc9d1301e20 R14: 00000000025f9408 R15: 00007fc9d1302720
Code: 48 8b 95 80 00 00 00 41 55 49 8d 8c 24 e0 05 00
00 45 8b 84 24 38 04 00 00 41 89 c1 48 89 de 48 c7 c7 a8 2f f2 92 e8 7c fa ff ff <0f> 0b 58 5b 5d 41 5c 41 5d c3 0f 1f 44 00 00 55 48 89 e5 41 56
--- net/netfilter/ipvs/ip_vs_conn.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
net/netfilter/ipvs/ip_vs_conn.c +6 -11
@@ -232,7 +232,10 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)static inline bool ip_vs_conn_unlink (struct ip_vs_conn *cp) {unsigned int hash; -bool ret; +bool ret = false; + +if (cp->flags &IP_VS_CONN_F_ONE_PACKET ) +return refcount_dec_if_one (&cp->refcnt); hash =ip_vs_conn_hashkey_conn (cp);
@@ -240,15 +243,13 @@ static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp)spin_lock (&cp->lock);if (cp->flags &IP_VS_CONN_F_HASHED ) { - ret = false;/* Decrease refcnt and unlink conn only if we are last user */ if (refcount_dec_if_one (&cp->refcnt)) {hlist_del_rcu (&cp->c_list); cp->flags &= ~IP_VS_CONN_F_HASHED ; ret = true; } - }else - ret =refcount_read (&cp->refcnt) ? false : true; + }spin_unlock (&cp->lock);ct_write_unlock_bh (hash);
@@ -454,12 +455,6 @@ ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af, }EXPORT_SYMBOL_GPL (ip_vs_conn_out_get_proto); -static void __ip_vs_conn_put_notimer (struct ip_vs_conn *cp) -{ -__ip_vs_conn_put (cp); -ip_vs_conn_expire (&cp->timer); -} -/* * Put back the conn and restart its timer with its timeout */
@@ -478,7 +473,7 @@ void ip_vs_conn_put(struct ip_vs_conn *cp) (refcount_read(&cp->refcnt) == 1) && !timer_pending(&cp->timer))/* expire connection immediately */ -__ip_vs_conn_put_notimer (cp); +ip_vs_conn_expire (&cp->timer); else__ip_vs_conn_put_timer (cp ); }
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 7/15 ipvs: fix stats update from local clients
In reply to Pablo Neira AyusoFrom: Julian Anastasov <[email protected]>
Local clients are not properly synchronized on 32-bit CPUs when updating stats (3.10+). Now it is possible estimation_timer (timer), a stats reader, to interrupt the local client in the middle of write_seqcount_{begin,end} sequence leading to loop (DEADLOCK). The same interrupt can happen from received packet (SoftIRQ) which updates the same per-CPU stats.
Fix it by disabling BH while updating stats.
Found with debug:
WARNING: inconsistent lock state 4.17.0-rc2-00105-g35cb6d7-dirty #2 Not tainted
--------------------------------
inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage. ftp/2545 [HC0[0]:SC0[0]:HE1:SE1] takes:
86845479 (&syncp->seq#6){+.+-}, at: ip_vs_schedule+0x1c5/0x59e [ip_vs] {IN-SOFTIRQ-R} state was registered at:
lock_acquire+0x44/0x5b estimation_timer+0x1b3/0x341 [ip_vs] call_timer_fn+0x54/0xcd run_timer_softirq+0x10c/0x12b __do_softirq+0xc1/0x1a9 do_softirq_own_stack+0x1d/0x23 irq_exit+0x4a/0x64 smp_apic_timer_interrupt+0x63/0x71 apic_timer_interrupt+0x3a/0x40 default_idle+0xa/0xc arch_cpu_idle+0x9/0xb default_idle_call+0x21/0x23 do_idle+0xa0/0x167 cpu_startup_entry+0x19/0x1b start_secondary+0x133/0x182 startup_32_smp+0x164/0x168 irq event stamp: 42213
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&syncp->seq#6);
<Interrupt>
lock(&syncp->seq#6);
*** DEADLOCK ***
--- net/netfilter/ipvs/ip_vs_core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/netfilter/ipvs/ip_vs_core.c +12 -0
@@ -119,6 +119,8 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)struct ip_vs_cpu_stats *s;struct ip_vs_service *svc; +local_bh_disable (); + s =this_cpu_ptr (dest->stats.cpustats);u64_stats_update_begin (&s->syncp); s->cnt.inpkts++;
@@ -137,6 +139,8 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb) s->cnt.inpkts++; s->cnt.inbytes += skb->len;u64_stats_update_end (&s->syncp); + +local_bh_enable (); } }
@@ -151,6 +155,8 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)struct ip_vs_cpu_stats *s;struct ip_vs_service *svc; +local_bh_disable (); + s =this_cpu_ptr (dest->stats.cpustats);u64_stats_update_begin (&s->syncp); s->cnt.outpkts++;
@@ -169,6 +175,8 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb) s->cnt.outpkts++; s->cnt.outbytes += skb->len;u64_stats_update_end (&s->syncp); + +local_bh_enable (); } }
@@ -179,6 +187,8 @@ ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)struct netns_ipvs *ipvs = svc->ipvs;struct ip_vs_cpu_stats *s; +local_bh_disable (); + s =this_cpu_ptr (cp->dest->stats.cpustats);u64_stats_update_begin (&s->syncp); s->cnt.conns++;
@@ -193,6 +203,8 @@ ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)u64_stats_update_begin (&s->syncp); s->cnt.conns++;u64_stats_update_end (&s->syncp); + +local_bh_enable (); }
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 8/15 netfilter: core: add missing __rcu annotation
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
removes following sparse error:net/netfilter/core.c:598:30: warning: incorrect type in argument 1 (different address spaces)net/netfilter/core.c:598:30: expected struct nf_hook_entries **enet/netfilter/core.c:598:30: got struct nf_hook_entries [noderef] <asn:4>**<noident>
--- net/netfilter/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/core.c +2 -1
@@ -585,7 +585,8 @@ void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);EXPORT_SYMBOL (nf_nat_decode_session_hook);#endif -static void __net_init __netfilter_net_init (struct nf_hook_entries **e,int max) +static void __net_init +__netfilter_net_init (struct nf_hook_entries __rcu **e,int max) {int h;
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 9/15 netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
fixes these warnings:
'nfnl_cthelper_create' at net/netfilter/nfnetlink_cthelper.c:237:2,
'nfnl_cthelper_new' at net/netfilter/nfnetlink_cthelper.c:450:9:./include/linux/string.h:246:9: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation]
return __builtin_strncpy(p, q, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~Moreover, strncpy assumes null-terminated source buffers, but thats not the case here.
Unlike strlcpy, nla_strlcpy *does* pad the destination buffer while also considering nla attribute size.
--- net/netfilter/nfnetlink_acct.c | 2 +- net/netfilter/nfnetlink_cthelper.c | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-)
net/netfilter/nfnetlink_acct.c +1 -1
@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl, nfacct->flags = flags; } -strncpy (nfacct->name,nla_data (tb[NFACCT_NAME ]),NFACCT_NAME_MAX ); +nla_strlcpy (nfacct->name,nla_data (tb[NFACCT_NAME ]),NFACCT_NAME_MAX );if (tb[NFACCT_BYTES ]) { atomic64_set(&nfacct->bytes,
net/netfilter/nfnetlink_cthelper.c +4 -3
@@ -149,8 +149,8 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, !tb[NFCTH_POLICY_EXPECT_TIMEOUT])return -EINVAL ; -strncpy (expect_policy->name, -nla_data (tb[NFCTH_POLICY_NAME ]),NF_CT_HELPER_NAME_LEN ); +nla_strlcpy (expect_policy->name, +nla_data (tb[NFCTH_POLICY_NAME ]),NF_CT_HELPER_NAME_LEN ); expect_policy->max_expected =ntohl (nla_get_be32 (tb[NFCTH_POLICY_EXPECT_MAX ]));if (expect_policy->max_expected >NF_CT_EXPECT_MAX_CNT )
@@ -234,7 +234,8 @@ nfnl_cthelper_create(const struct nlattr * const tb[],if (ret <0 ) goto err1; -strncpy (helper->name,nla_data (tb[NFCTH_NAME ]),NF_CT_HELPER_NAME_LEN ); +nla_strlcpy (helper->name, +nla_data (tb[NFCTH_NAME ]),NF_CT_HELPER_NAME_LEN ); size =ntohl (nla_get_be32 (tb[NFCTH_PRIV_DATA_LEN ])); if (size > FIELD_SIZEOF(struct nf_conn_help, data)) { ret = -ENOMEM ;
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 10/15 netfilter: x_tables: add module alias for icmp matches
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
The icmp matches are implemented in ip_tables and ip6_tables, respectively, so for normal iptables they are always available:
those modules are loaded once iptables calls getsockopt() to fetch available module revisions.
In iptables-over-nftables case probing occurs via nfnetlink, so these modules might not be loaded. Add aliases so modprobe can load these when icmp/icmp6 is requested.
--- net/ipv4/netfilter/ip_tables.c | 1 + net/ipv6/netfilter/ip6_tables.c | 1 + 2 files changed, 2 insertions(+)
net/ipv4/netfilter/ip_tables.c +1 -0
@@ -34,6 +34,7 @@MODULE_LICENSE ("GPL" );MODULE_AUTHOR ("Netfilter Core Team <[email protected]>" );MODULE_DESCRIPTION ("IPv4 packet filter" ); +MODULE_ALIAS ("ipt_icmp" );void *ipt_alloc_initial_table (const struct xt_table *info) {
net/ipv6/netfilter/ip6_tables.c +1 -0
@@ -38,6 +38,7 @@MODULE_LICENSE ("GPL" );MODULE_AUTHOR ("Netfilter Core Team <[email protected]>" );MODULE_DESCRIPTION ("IPv6 packet filter" ); +MODULE_ALIAS ("ip6t_icmp6" );void *ip6t_alloc_initial_table (const struct xt_table *info) {
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 11/15 netfilter: nf_tables: don't assume chain stats are set when jumplabel is set
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
nft_chain_stats_replace() and all other spots assume ->stats can be NULL, but nft_update_chain_stats does not. It must do this check, just because the jump label is set doesn't mean all basechains have stats assigned.
--- net/netfilter/nf_tables_core.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
net/netfilter/nf_tables_core.c +14 -7
@@ -119,15 +119,22 @@ DEFINE_STATIC_KEY_FALSE(nft_counters_enabled); static noinline void nft_update_chain_stats(const struct nft_chain *chain,const struct nft_pktinfo *pkt) { +struct nft_base_chain *base_chain;struct nft_stats *stats; -local_bh_disable (); - stats =this_cpu_ptr (rcu_dereference (nft_base_chain (chain)->stats)); -u64_stats_update_begin (&stats->syncp); - stats->pkts++; - stats->bytes += pkt->skb->len; -u64_stats_update_end (&stats->syncp); -local_bh_enable (); + base_chain =nft_base_chain (chain); +if (!base_chain->stats) +return ; + + stats =this_cpu_ptr (rcu_dereference (base_chain->stats)); +if (stats) { +local_bh_disable (); +u64_stats_update_begin (&stats->syncp); + stats->pkts++; + stats->bytes += pkt->skb->len; +u64_stats_update_end (&stats->syncp); +local_bh_enable (); + } }struct nft_jumpstack {
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 12/15 netfilter: nft_compat: prepare for indirect info storage
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
Next patch will make it possible for *info to be stored in a separate allocation instead of the expr private area.
This removes the 'expr priv area is info blob' assumption from the match init/destroy/eval functions.
--- net/netfilter/nft_compat.c | 47 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 36 insertions(+), 11 deletions(-)
net/netfilter/nft_compat.c +36 -11
@@ -324,11 +324,11 @@ static int nft_target_validate(const struct nft_ctx *ctx,return 0 ; } -static void nft_match_eval (const struct nft_expr *expr, -struct nft_regs *regs, -const struct nft_pktinfo *pkt) +static void __nft_match_eval (const struct nft_expr *expr, +struct nft_regs *regs, +const struct nft_pktinfo *pkt, +void *info) { -void *info =nft_expr_priv (expr);struct xt_match *match = expr->ops->data;struct sk_buff *skb = pkt->skb;bool ret;
@@ -352,6 +352,13 @@ static void nft_match_eval(const struct nft_expr *expr, } } +static void nft_match_eval (const struct nft_expr *expr, +struct nft_regs *regs, +const struct nft_pktinfo *pkt) +{ +__nft_match_eval (expr, regs, pkt,nft_expr_priv (expr)); +} +static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX +1 ] = { [NFTA_MATCH_NAME ] = { .type =NLA_NUL_STRING }, [NFTA_MATCH_REV ] = { .type =NLA_U32 },
@@ -412,10 +419,10 @@ static void match_compat_from_user(struct xt_match *m, void *in, void *out) }static int -nft_match_init (const struct nft_ctx *ctx,const struct nft_expr *expr, -const struct nlattr *const tb[]) +__nft_match_init (const struct nft_ctx *ctx,const struct nft_expr *expr, +const struct nlattr *const tb[], +void *info) { -void *info =nft_expr_priv (expr);struct xt_match *match = expr->ops->data;struct xt_mtchk_param par;size_t size =XT_ALIGN (nla_len (tb[NFTA_MATCH_INFO ]));
@@ -444,11 +451,18 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,return 0 ; } +static int +nft_match_init (const struct nft_ctx *ctx,const struct nft_expr *expr, +const struct nlattr *const tb[]) +{ +return __nft_match_init (ctx, expr, tb,nft_expr_priv (expr)); +} +static void -nft_match_destroy (const struct nft_ctx *ctx,const struct nft_expr *expr) +__nft_match_destroy (const struct nft_ctx *ctx,const struct nft_expr *expr, +void *info) {struct xt_match *match = expr->ops->data; -void *info =nft_expr_priv (expr);struct xt_mtdtor_param par; par.net = ctx->net;
@@ -462,9 +476,15 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)module_put (match->me); } -static int nft_match_dump (struct sk_buff *skb,const struct nft_expr *expr) +static void +nft_match_destroy (const struct nft_ctx *ctx,const struct nft_expr *expr) +{ +__nft_match_destroy (ctx, expr,nft_expr_priv (expr)); +} + +static int __nft_match_dump (struct sk_buff *skb,const struct nft_expr *expr, +void *info) { -void *info =nft_expr_priv (expr);struct xt_match *match = expr->ops->data; if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||
@@ -478,6 +498,11 @@ static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr)return -1 ; } +static int nft_match_dump (struct sk_buff *skb,const struct nft_expr *expr) +{ +return __nft_match_dump (skb, expr,nft_expr_priv (expr)); +} +static int nft_match_validate (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nft_data **data)
Signature · 1 line
2.11.0
PATCH 13/15 netfilter: nft_compat: fix handling of large matchinfo size
In reply to Pablo Neira AyusoFrom: Florian Westphal <[email protected]>
currently matchinfo gets stored in the expression, but some xt matches are very large.
To handle those we either need to switch nft core to kvmalloc and increase size limit, or allocate the info blob of large matches separately.
This does the latter, this limits the scope of the changes to nft_compat.
I picked a threshold of 192, this allows most matches to work as before and handle only few ones via separate alloation (cgroup, u32, sctp, rt).
--- net/netfilter/nft_compat.c | 64 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 63 insertions(+), 1 deletion(-)
net/netfilter/nft_compat.c +63 -1
@@ -36,6 +36,13 @@ struct nft_xt {struct rcu_head rcu_head; }; +/* Used for matches where *info is larger than X byte */ +#define NFT_MATCH_LARGE_THRESH 192 + +struct nft_xt_match_priv { +void *info; +}; +static bool nft_xt_put (struct nft_xt *xt) {if (--xt->refcnt ==0 ) {
@@ -352,6 +359,15 @@ static void __nft_match_eval(const struct nft_expr *expr, } } +static void nft_match_large_eval (const struct nft_expr *expr, +struct nft_regs *regs, +const struct nft_pktinfo *pkt) +{ +struct nft_xt_match_priv *priv =nft_expr_priv (expr); + +__nft_match_eval (expr, regs, pkt, priv->info); +} +static void nft_match_eval (const struct nft_expr *expr,struct nft_regs *regs,const struct nft_pktinfo *pkt)
@@ -458,6 +474,24 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,return __nft_match_init (ctx, expr, tb,nft_expr_priv (expr)); } +static int +nft_match_large_init (const struct nft_ctx *ctx,const struct nft_expr *expr, +const struct nlattr *const tb[]) +{ +struct nft_xt_match_priv *priv =nft_expr_priv (expr); +struct xt_match *m = expr->ops->data; +int ret; + + priv->info =kmalloc (XT_ALIGN (m->matchsize),GFP_KERNEL ); +if (!priv->info) +return -ENOMEM ; + + ret =__nft_match_init (ctx, expr, tb, priv->info); +if (ret) +kfree (priv->info); +return ret; +} +static void __nft_match_destroy (const struct nft_ctx *ctx,const struct nft_expr *expr,void *info)
@@ -482,6 +516,15 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)__nft_match_destroy (ctx, expr,nft_expr_priv (expr)); } +static void +nft_match_large_destroy (const struct nft_ctx *ctx,const struct nft_expr *expr) +{ +struct nft_xt_match_priv *priv =nft_expr_priv (expr); + +__nft_match_destroy (ctx, expr, priv->info); +kfree (priv->info); +} +static int __nft_match_dump (struct sk_buff *skb,const struct nft_expr *expr,void *info) {
@@ -503,6 +546,13 @@ static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr)return __nft_match_dump (skb, expr,nft_expr_priv (expr)); } +static int nft_match_large_dump (struct sk_buff *skb,const struct nft_expr *e) +{ +struct nft_xt_match_priv *priv =nft_expr_priv (e); + +return __nft_match_dump (skb, e, priv->info); +} +static int nft_match_validate (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nft_data **data)
@@ -670,6 +720,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, {struct nft_xt *nft_match;struct xt_match *match; +unsigned int matchsize;char *mt_name;u32 rev, family;int err;
@@ -709,7 +760,6 @@ nft_match_select_ops(const struct nft_ctx *ctx, nft_match->refcnt =0 ; nft_match->ops.type = &nft_match_type; - nft_match->ops.size =NFT_EXPR_SIZE (XT_ALIGN (match->matchsize)); nft_match->ops.eval = nft_match_eval; nft_match->ops.init = nft_match_init; nft_match->ops.destroy = nft_match_destroy;
@@ -717,6 +767,18 @@ nft_match_select_ops(const struct nft_ctx *ctx, nft_match->ops.validate = nft_match_validate; nft_match->ops.data = match; + matchsize =NFT_EXPR_SIZE (XT_ALIGN (match->matchsize)); +if (matchsize >NFT_MATCH_LARGE_THRESH ) { + matchsize =NFT_EXPR_SIZE (sizeof (struct nft_xt_match_priv )); + + nft_match->ops.eval = nft_match_large_eval; + nft_match->ops.init = nft_match_large_init; + nft_match->ops.destroy = nft_match_large_destroy; + nft_match->ops.dump = nft_match_large_dump; + } + + nft_match->ops.size = matchsize; +list_add (&nft_match->head, &nft_match_list);return &nft_match->ops;
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 14/15 netfilter: nf_tables: bogus EBUSY in chain deletions
In reply to Pablo Neira AyusoWhen removing a rule that jumps to chain and such chain in the same batch, this bogusly hits EBUSY. Add activate and deactivate operations to expression that can be called from the preparation and the commit/abort phases.
--- include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nf_tables_api.c | 46 +++++++++++++++++++++++++++++++++++---- net/netfilter/nft_immediate.c | 15 ++++++++++--- 3 files changed, 59 insertions(+), 7 deletions(-)
include/net/netfilter/nf_tables.h +5 -0
@@ -170,6 +170,7 @@ struct nft_data_desc {int nft_data_init (const struct nft_ctx *ctx,struct nft_data *data,unsigned int size,struct nft_data_desc *desc,const struct nlattr *nla); +void nft_data_hold (const struct nft_data *data,enum nft_data_types type);void nft_data_release (const struct nft_data *data,enum nft_data_types type);int nft_data_dump (struct sk_buff *skb,int attr,const struct nft_data *data,enum nft_data_types type,unsigned int len);
@@ -736,6 +737,10 @@ struct nft_expr_ops {int (*init)(const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nlattr *const tb[]); +void (*activate)(const struct nft_ctx *ctx, +const struct nft_expr *expr); +void (*deactivate)(const struct nft_ctx *ctx, +const struct nft_expr *expr);void (*destroy)(const struct nft_ctx *ctx,const struct nft_expr *expr); int (*dump)(struct sk_buff *skb,
net/netfilter/nf_tables_api.c +42 -4
98 lines not on this page · raw message
net/netfilter/nft_immediate.c +12 -3
@@ -69,8 +69,16 @@ static int nft_immediate_init(const struct nft_ctx *ctx,return err; } -static void nft_immediate_destroy (const struct nft_ctx *ctx, -const struct nft_expr *expr) +static void nft_immediate_activate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +const struct nft_immediate_expr *priv =nft_expr_priv (expr); + +return nft_data_hold (&priv->data,nft_dreg_to_type (priv->dreg)); +} + +static void nft_immediate_deactivate (const struct nft_ctx *ctx, +const struct nft_expr *expr) {const struct nft_immediate_expr *priv =nft_expr_priv (expr);
@@ -108,7 +116,8 @@ static const struct nft_expr_ops nft_imm_ops = { .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), .eval = nft_immediate_eval, .init = nft_immediate_init, - .destroy = nft_immediate_destroy, + .activate = nft_immediate_activate, + .deactivate = nft_immediate_deactivate, .dump = nft_immediate_dump, .validate = nft_immediate_validate, };
Signature · 1 line
2.11.0
Pablo Neira Ayuso
maintainerPATCH 15/15 netfilter: nf_tables: fix memory leak on error exit return
In reply to Pablo Neira AyusoFrom: Colin Ian King <[email protected]>
Currently the -EBUSY error return path is not free'ing resources allocated earlier, leaving a memory leak. Fix this by exiting via the error exit label err5 that performs the necessary resource clean up.
Detected by CoverityScan, CID#1432975 ("Resource leak")
--- net/netfilter/nf_tables_api.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +4 -2
@@ -4080,8 +4080,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (nft_set_ext_exists (ext,NFT_SET_EXT_DATA ) ^nft_set_ext_exists (ext2,NFT_SET_EXT_DATA ) ||nft_set_ext_exists (ext,NFT_SET_EXT_OBJREF ) ^ -nft_set_ext_exists (ext2,NFT_SET_EXT_OBJREF )) -return -EBUSY ; +nft_set_ext_exists (ext2,NFT_SET_EXT_OBJREF )) { + err = -EBUSY ; + goto err5; + } if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && memcmp(nft_set_ext_data(ext),
Signature · 1 line
2.11.0
David Miller
maintainerFrom: Pablo Neira Ayuso <[email protected]>
Date: Mon, 14 May 2018 00:36:41 +0200
Quoted 2 lines
The following patchset contains Netfilter/IPVS fixes for your net tree, they are:
...
Quoted 3 lines
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks.