Ilya Maximets 9593c7cb6c ipv6: tcp: add a missing nf_reset_ct() in 3WHS handling ... Commit b0e214d212 ("netfilter: keep conntrack reference until IPsecv6 policy checks are done") is a direct copy of the old commit b59c270104 ("[NETFILTER]: Keep conntrack reference until IPsec policy checks are done") but for IPv6. However, it also copies a bug that this old commit had. That is: when the third packet of 3WHS connection establishment contains payload, it is added into socket receive queue without the XFRM check and the drop of connection tracking context. That leads to nf_conntrack module being impossible to unload as it waits for all the conntrack references to be dropped while the packet release is deferred in per-cpu cache indefinitely, if not consumed by the application. The issue for IPv4 was fixed in commit 6f0012e351 ("tcp: add a missing nf_reset_ct() in 3WHS handling") by adding a missing XFRM check and correctly dropping the conntrack context. However, the issue was introduced to IPv6 code afterwards. Fixing it the same way for IPv6 now. Fixes: b0e214d212 ("netfilter: keep conntrack reference until IPsecv6 policy checks are done") Link: https://lore.kernel.org/netdev/d589a999-d4dd-2768-b2d5-89dec64a4a42@ovn.org/ Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Acked-by: Florian Westphal <fw@strlen.de> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20230922210530.2045146-1-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2023-10-03 09:49:24 +02:00
..
ila	ila: Remove unnecessary file net/ila.h	2023-08-02 12:28:16 -07:00
netfilter	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
Kconfig	ipv6: fix indentation of a config attribute	2023-08-16 10:03:08 +01:00
Makefile	net: ipv6: use ipv6-y directly instead of ipv6-objs	2021-09-28 13:13:40 +01:00
addrconf.c	Including fixes from netfilter and bpf.	2023-09-07 18:33:07 -07:00
addrconf_core.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
addrlabel.c	ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network	2022-11-07 12:26:15 +00:00
af_inet6.c	inet: move inet->bind_address_no_port to inet->inet_flags	2023-08-16 11:09:17 +01:00
ah6.c	net: ipv6: Remove completion function scaffolding	2023-02-13 18:35:15 +08:00
anycast.c	IPv6: add extack info for IPv6 address add/delete	2023-07-28 11:01:56 +01:00
calipso.c	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-04 15:26:57 -08:00
datagram.c	inet: introduce inet->inet_flags	2023-08-16 11:09:16 +01:00
esp6.c	net: ipv6: Remove completion function scaffolding	2023-02-13 18:35:15 +08:00
esp6_offload.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-22 18:40:38 -07:00
exthdrs.c	ipv6: exthdrs: Replace opencoded swap() implementation	2023-08-08 15:36:47 -07:00
exthdrs_core.c	ipv6: Fix out-of-bounds access in ipv6_find_tlv()	2023-05-24 08:43:39 +01:00
exthdrs_offload.c	…
fib6_notifier.c	…
fib6_rules.c	ipv6: change fib6_rules_net_exit() to batch mode	2022-02-08 20:41:34 -08:00
fou6.c	net: Add MODULE_DESCRIPTION entries to network modules	2020-06-20 21:33:57 -07:00
icmp.c	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
inet6_connection_sock.c	net: annotate lockless accesses to sk->sk_err_soft	2023-03-17 08:25:05 +00:00
inet6_hashtables.c	net: remove duplicate INDIRECT_CALLABLE_DECLARE of udp[6]_ehashfn	2023-07-31 13:53:10 -07:00
ioam6.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
ioam6_iptunnel.c	ipv6: ioam: Insertion frequency in lwtunnel output	2022-02-04 20:24:45 -08:00
ip6_checksum.c	…
ip6_fib.c	net/ipv6: Remove expired routes with a separated list of routes.	2023-08-16 12:26:43 +01:00
ip6_flowlabel.c	ipv6: flowlabel: do not disable BH where not needed	2023-03-21 21:32:18 -07:00
ip6_gre.c	net:ipv6: check return value of pskb_trim()	2023-07-19 12:25:58 +01:00
ip6_icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-02-23 11:29:52 -08:00
ip6_input.c	ipv6: ignore dst hint for multipath routes	2023-09-01 08:11:51 +01:00
ip6_offload.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
ip6_offload.h	…
ip6_output.c	net: annotate data-races around sk->sk_tsflags	2023-09-01 07:27:33 +01:00
ip6_tunnel.c	net: tunnels: annotate lockless accesses to dev->needed_headroom	2023-03-15 00:04:04 -07:00
ip6_udp_tunnel.c	net: Make locking in sock_bindtoindex optional	2020-06-01 14:57:14 -07:00
ip6_vti.c	ip6_vti: fix slab-use-after-free in decode_session6	2023-07-11 11:06:08 +02:00
ip6mr.c	net: ipv4, ipv6: fix IPSTATS_MIB_OUTOCTETS increment duplicated	2023-08-30 09:44:09 +01:00
ipcomp6.c	xfrm: ipcomp: add extack to ipcomp{4,6}_init_state	2022-09-29 07:18:00 +02:00
ipv6_sockglue.c	net: selectively purge error queue in IP_RECVERR / IPV6_RECVERR	2023-08-20 15:17:47 +01:00
mcast.c	ipv6: Constify the sk parameter of several helper functions.	2023-07-14 08:27:33 +01:00
mcast_snoop.c	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-04-27 14:02:06 -07:00
mip6.c	xfrm: mip6: add extack to mip6_destopt_init_state, mip6_rthdr_init_state	2022-09-29 07:18:01 +02:00
ndisc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-10 14:10:53 -07:00
netfilter.c	netfilter: Use l3mdev flow key when re-routing mangled packets	2022-05-16 13:03:29 +02:00
output_core.c	treewide: use get_random_u32_{above,below}() instead of manual loop	2022-11-18 02:15:22 +01:00
ping.c	net: annotate data-races around sk->sk_tsflags	2023-09-01 07:27:33 +01:00
proc.c	icmp: Add counters for rate limits	2023-01-26 10:52:18 +01:00
protocol.c	…
raw.c	net: annotate data-races around sk->sk_tsflags	2023-09-01 07:27:33 +01:00
reassembly.c	networking: Update to register_net_sysctl_sz	2023-08-15 15:26:18 -07:00
route.c	Including fixes from netfilter and bpf.	2023-09-07 18:33:07 -07:00
rpl.c	ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv().	2023-06-19 11:32:58 -07:00
rpl_iptunnel.c	ipv6: rpl: Remove redundant skb_dst_drop().	2023-07-12 17:12:29 -07:00
seg6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-09-08 18:38:30 +02:00
seg6_hmac.c	net: ipv6: unexport __init-annotated seg6_hmac_net_init()	2022-06-28 21:23:30 -07:00
seg6_iptunnel.c	seg6: Cleanup duplicates of skb_dst_drop calls	2023-05-17 09:05:47 +01:00
seg6_local.c	seg6: add NEXT-C-SID support for SRv6 End.X behavior	2023-08-15 18:51:47 -07:00
sit.c	sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()	2023-04-28 09:48:14 +01:00
syncookies.c	tcp: Fix data-races around sysctl_tcp_syncookies.	2022-07-18 12:21:54 +01:00
sysctl_net_ipv6.c	networking: Update to register_net_sysctl_sz	2023-08-15 15:26:18 -07:00
tcp_ipv6.c	ipv6: tcp: add a missing nf_reset_ct() in 3WHS handling	2023-10-03 09:49:24 +02:00
tcpv6_offload.c	net: Make gro complete function to return void	2023-05-31 09:50:17 +01:00
tunnel6.c	tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels	2020-07-09 12:52:37 +02:00
udp.c	net: annotate data-races around sk->sk_tsflags	2023-09-01 07:27:33 +01:00
udp_impl.h	tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().	2022-10-12 17:50:37 -07:00
udp_offload.c	net: gro: fix misuse of CB in udp socket lookup	2023-07-29 17:10:27 +01:00
udplite.c	ipv6: remove hard coded limitation on ipv6_pinfo	2023-07-24 09:39:31 +01:00
xfrm6_input.c	xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets	2023-06-09 08:16:34 +02:00
xfrm6_output.c	xfrm: fix tunnel model fragmentation behavior	2022-03-01 12:08:40 +01:00
xfrm6_policy.c	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
xfrm6_protocol.c	xfrm: add support for UDPv6 encapsulation of ESP	2020-04-28 11:28:36 +02:00
xfrm6_state.c	xfrm: remove output_finish indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c	xfrm: tunnel: add extack to ipip_init_state, xfrm6_tunnel_init_state	2022-09-29 07:18:00 +02:00