Commit 468b0df6 authored by David S. Miller's avatar David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
   skbuff, patch from Davide Caratti.

2) nf_tables rb-tree set backend does not handle element re-addition
   after deletion in the same transaction, leading to infinite loop.

3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
   from Liping Zhang.

4) Conntrack hashtable resizing while ctnetlink dump is progress leads
   to a dead reference to released objects in the lists, also from
   Liping.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents c21fbe29 fefa9267
...@@ -890,8 +890,13 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) ...@@ -890,8 +890,13 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
} }
out: out:
local_bh_enable(); local_bh_enable();
if (last) if (last) {
/* nf ct hash resize happened, now clear the leftover. */
if ((struct nf_conn *)cb->args[1] == last)
cb->args[1] = 0;
nf_ct_put(last); nf_ct_put(last);
}
while (i) { while (i) {
i--; i--;
......
...@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb, ...@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
u8 pf, unsigned int hooknum) u8 pf, unsigned int hooknum)
{ {
const struct sctphdr *sh; const struct sctphdr *sh;
struct sctphdr _sctph;
const char *logmsg; const char *logmsg;
sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph); if (skb->len < dataoff + sizeof(struct sctphdr)) {
if (!sh) {
logmsg = "nf_ct_sctp: short packet "; logmsg = "nf_ct_sctp: short packet ";
goto out_invalid; goto out_invalid;
} }
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
skb->ip_summed == CHECKSUM_NONE) { skb->ip_summed == CHECKSUM_NONE) {
if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
logmsg = "nf_ct_sctp: failed to read header ";
goto out_invalid;
}
sh = (const struct sctphdr *)(skb->data + dataoff);
if (sh->checksum != sctp_compute_cksum(skb, dataoff)) { if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
logmsg = "nf_ct_sctp: bad CRC "; logmsg = "nf_ct_sctp: bad CRC ";
goto out_invalid; goto out_invalid;
......
...@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data) ...@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
* Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack() * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
* will delete entry from already-freed table. * will delete entry from already-freed table.
*/ */
ct->status &= ~IPS_NAT_DONE_MASK; clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource, rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
nf_nat_bysource_params); nf_nat_bysource_params);
......
...@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, ...@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
else if (d > 0) else if (d > 0)
p = &parent->rb_right; p = &parent->rb_right;
else { else {
if (nft_set_elem_active(&rbe->ext, genmask)) {
if (nft_rbtree_interval_end(rbe) && if (nft_rbtree_interval_end(rbe) &&
!nft_rbtree_interval_end(new)) !nft_rbtree_interval_end(new)) {
p = &parent->rb_left; p = &parent->rb_left;
else if (!nft_rbtree_interval_end(rbe) && } else if (!nft_rbtree_interval_end(rbe) &&
nft_rbtree_interval_end(new)) nft_rbtree_interval_end(new)) {
p = &parent->rb_right; p = &parent->rb_right;
else { } else if (nft_set_elem_active(&rbe->ext, genmask)) {
*ext = &rbe->ext; *ext = &rbe->ext;
return -EEXIST; return -EEXIST;
} } else {
p = &parent->rb_left;
} }
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment