mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 16:29:59 +00:00
nf pull request 2023-10-12
-----BEGIN PGP SIGNATURE----- iQJBBAABCAArFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmUnsR0NHGZ3QHN0cmxl bi5kZQAKCRBwkajZrV/2AJaDD/9WqsWX8KK+QaXMNdhuY2TYicRUrzAObeCOkPzU 8M0S0pZiSsfZO4Tzlo30krSoLERnBYsedngEIzLHHlQ/V+65H8h9jY1p1oGZFKIg 5ui9ZQbcvWLqKWTOaCneZuEjsGxodWvVokVubSAWw9XExuYqbfo8WOOKBZzAX4mt J7KznGlShGHithvssWrk8n2FQr8+ZqzRrJjpoNfQcKU1a+GEIiQvIIfm4f3P6baj yiuP2dXWsUXuDK63JmMUK2k3w1e/XwjPpCZ+uyoNxPCggu0X0u//MpM71CNpGAZ4 g9V5dn+p6WsLh1gQ4QvWGgJqXPm8xU1mRux5WLnp5dHVwm+8bgGGy0O8QC+s9H63 15pZmeaGcTd6zp3FxbnCWcWFbcW1jsYoscLrMyqjtgDmGIOBxQfia2oCyaN3Z37M vjRYtNFQbU6TbKZc0tKlh79geUykZL+ibtVuBiHkniZkAMOQXqUBkh3K1yfJ1j76 w/GjIm+wFKn0KKij27mzebwTJNLbXdXWem5bzUg6lhC0X57Mcf3+L8VbNWPv220x drsI9uzw+YPE7neVbmXQ8hHyJKelG5cF0xgfykLT+6DnadiCpdrlrxwiMCP/POQ5 XIPkjgyi1T3k/5Sv4kab7cZxbq1A14URJHASidT/JN2NCYlMV1A1CaeE1vhrZ5Z4 BHgDRw== =mZQY -----END PGP SIGNATURE----- Merge tag 'nf-23-10-12' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter updates for net Patch 1, from Pablo Neira Ayuso, fixes a performance regression (since 6.4) when a large pending set update has to be canceled towards the end of the transaction. Patch 2 from myself, silences an incorrect compiler warning reported with a few (older) compiler toolchains. Patch 3, from Kees Cook, adds __counted_by annotation to nft_pipapo set backend type. I took this for net instead of -next given infra is already in place and no actual code change is made. Patch 4, from Pablo Neira Ayso, disables timeout resets on stateful element reset. The rest should only affect internal object state, e.g. reset a quota or counter, but not affect a pending timeout. Patches 5 and 6 fix NULL dereferences in 'inner header' match, control plane doesn't test for netlink attribute presence before accessing them. Broken since feature was added in 6.2, fixes from Xingyuan Mo. Last patch, from myself, fixes a bogus rule match when skb has a 0-length mac header, in this case we'd fetch data from network header instead of canceling rule evaluation. This is a day 0 bug, present since nftables was merged in 3.13. * tag 'nf-23-10-12' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_payload: fix wrong mac header matching nf_tables: fix NULL pointer dereference in nft_expr_inner_parse() nf_tables: fix NULL pointer dereference in nft_inner_init() netfilter: nf_tables: do not refresh timeout when resetting element netfilter: nf_tables: Annotate struct nft_pipapo_match with __counted_by netfilter: nfnetlink_log: silence bogus compiler warning netfilter: nf_tables: do not remove elements if set backend implements .abort ==================== Link: https://lore.kernel.org/r/20231012085724.15155-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
commit
f50ee3a003
5 changed files with 14 additions and 18 deletions
|
@ -3166,7 +3166,7 @@ int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla,
|
|||
if (err < 0)
|
||||
return err;
|
||||
|
||||
if (!tb[NFTA_EXPR_DATA])
|
||||
if (!tb[NFTA_EXPR_DATA] || !tb[NFTA_EXPR_NAME])
|
||||
return -EINVAL;
|
||||
|
||||
type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
|
||||
|
@ -5556,7 +5556,6 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
|
|||
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
|
||||
unsigned char *b = skb_tail_pointer(skb);
|
||||
struct nlattr *nest;
|
||||
u64 timeout = 0;
|
||||
|
||||
nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
|
||||
if (nest == NULL)
|
||||
|
@ -5592,15 +5591,11 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
|
|||
htonl(*nft_set_ext_flags(ext))))
|
||||
goto nla_put_failure;
|
||||
|
||||
if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) {
|
||||
timeout = *nft_set_ext_timeout(ext);
|
||||
if (nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
|
||||
nf_jiffies64_to_msecs(timeout),
|
||||
NFTA_SET_ELEM_PAD))
|
||||
goto nla_put_failure;
|
||||
} else if (set->flags & NFT_SET_TIMEOUT) {
|
||||
timeout = READ_ONCE(set->timeout);
|
||||
}
|
||||
if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
|
||||
nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
|
||||
nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
|
||||
NFTA_SET_ELEM_PAD))
|
||||
goto nla_put_failure;
|
||||
|
||||
if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
|
||||
u64 expires, now = get_jiffies_64();
|
||||
|
@ -5615,9 +5610,6 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
|
|||
nf_jiffies64_to_msecs(expires),
|
||||
NFTA_SET_ELEM_PAD))
|
||||
goto nla_put_failure;
|
||||
|
||||
if (reset)
|
||||
*nft_set_ext_expiration(ext) = now + timeout;
|
||||
}
|
||||
|
||||
if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
|
||||
|
@ -10347,7 +10339,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
|
|||
break;
|
||||
}
|
||||
te = (struct nft_trans_elem *)trans->data;
|
||||
nft_setelem_remove(net, te->set, &te->elem);
|
||||
if (!te->set->ops->abort ||
|
||||
nft_setelem_is_catchall(te->set, &te->elem))
|
||||
nft_setelem_remove(net, te->set, &te->elem);
|
||||
|
||||
if (!nft_setelem_is_catchall(te->set, &te->elem))
|
||||
atomic_dec(&te->set->nelems);
|
||||
|
||||
|
|
|
@ -698,8 +698,8 @@ nfulnl_log_packet(struct net *net,
|
|||
unsigned int plen = 0;
|
||||
struct nfnl_log_net *log = nfnl_log_pernet(net);
|
||||
const struct nfnl_ct_hook *nfnl_ct = NULL;
|
||||
enum ip_conntrack_info ctinfo = 0;
|
||||
struct nf_conn *ct = NULL;
|
||||
enum ip_conntrack_info ctinfo;
|
||||
|
||||
if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
|
||||
li = li_user;
|
||||
|
|
|
@ -298,6 +298,7 @@ static int nft_inner_init(const struct nft_ctx *ctx,
|
|||
int err;
|
||||
|
||||
if (!tb[NFTA_INNER_FLAGS] ||
|
||||
!tb[NFTA_INNER_NUM] ||
|
||||
!tb[NFTA_INNER_HDRSIZE] ||
|
||||
!tb[NFTA_INNER_TYPE] ||
|
||||
!tb[NFTA_INNER_EXPR])
|
||||
|
|
|
@ -179,7 +179,7 @@ void nft_payload_eval(const struct nft_expr *expr,
|
|||
|
||||
switch (priv->base) {
|
||||
case NFT_PAYLOAD_LL_HEADER:
|
||||
if (!skb_mac_header_was_set(skb))
|
||||
if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) == 0)
|
||||
goto err;
|
||||
|
||||
if (skb_vlan_tag_present(skb) &&
|
||||
|
|
|
@ -147,7 +147,7 @@ struct nft_pipapo_match {
|
|||
unsigned long * __percpu *scratch;
|
||||
size_t bsize_max;
|
||||
struct rcu_head rcu;
|
||||
struct nft_pipapo_field f[];
|
||||
struct nft_pipapo_field f[] __counted_by(field_count);
|
||||
};
|
||||
|
||||
/**
|
||||
|
|
Loading…
Reference in a new issue