hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
   skbuff, patch from Davide Caratti.

2) nf_tables rb-tree set backend does not handle element re-addition
   after deletion in the same transaction, leading to infinite loop.

3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
   from Liping Zhang.

4) Conntrack hashtable resizing while ctnetlink dump is progress leads
   to a dead reference to released objects in the lists, also from
   Liping.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2017-05-29 23:16:54 -04:00
parent c21fbe29f8 fefa92679d
commit 468b0df61a
4 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/netfilter/nf_conntrack_netlink.c
View File

@ -890,8 +890,13 @@ restart:
} }
out: out:
local_bh_enable(); local_bh_enable();
if (last) if (last) {
/* nf ct hash resize happened, now clear the leftover. */
if ((struct nf_conn *)cb->args[1] == last)
cb->args[1] = 0;
nf_ct_put(last); nf_ct_put(last);
}
while (i) { while (i) {
i--; i--;

9
net/netfilter/nf_conntrack_proto_sctp.c
View File

@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
u8 pf, unsigned int hooknum) u8 pf, unsigned int hooknum)
{ {
const struct sctphdr *sh; const struct sctphdr *sh;
struct sctphdr _sctph;
const char *logmsg; const char *logmsg;
sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph); if (skb->len < dataoff + sizeof(struct sctphdr)) {
if (!sh) {
logmsg = "nf_ct_sctp: short packet "; logmsg = "nf_ct_sctp: short packet ";
goto out_invalid; goto out_invalid;
} }
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
skb->ip_summed == CHECKSUM_NONE) { skb->ip_summed == CHECKSUM_NONE) {
if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
logmsg = "nf_ct_sctp: failed to read header ";
goto out_invalid;
}
sh = (const struct sctphdr *)(skb->data + dataoff);
if (sh->checksum != sctp_compute_cksum(skb, dataoff)) { if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
logmsg = "nf_ct_sctp: bad CRC "; logmsg = "nf_ct_sctp: bad CRC ";
goto out_invalid; goto out_invalid;

2
net/netfilter/nf_nat_core.c
View File

@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
* Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack() * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
* will delete entry from already-freed table. * will delete entry from already-freed table.
*/ */
ct->status &= ~IPS_NAT_DONE_MASK; clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource, rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
nf_nat_bysource_params); nf_nat_bysource_params);

22
net/netfilter/nft_set_rbtree.c
View File

@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
else if (d > 0) else if (d > 0)
p = &parent->rb_right; p = &parent->rb_right;
else { else {
if (nft_set_elem_active(&rbe->ext, genmask)) { if (nft_rbtree_interval_end(rbe) &&
if (nft_rbtree_interval_end(rbe) && !nft_rbtree_interval_end(new)) {
!nft_rbtree_interval_end(new)) p = &parent->rb_left;
p = &parent->rb_left; } else if (!nft_rbtree_interval_end(rbe) &&
else if (!nft_rbtree_interval_end(rbe) && nft_rbtree_interval_end(new)) {
nft_rbtree_interval_end(new)) p = &parent->rb_right;
p = &parent->rb_right; } else if (nft_set_elem_active(&rbe->ext, genmask)) {
else { *ext = &rbe->ext;
*ext = &rbe->ext; return -EEXIST;
return -EEXIST; } else {
} p = &parent->rb_left;
} }
} }
} }