Commit 48516438 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains ten Netfilter/IPVS fixes, they are:

1) Address refcount leak when creating an expectation from the ctnetlink
   interface.

2) Fix bug splat in the IDLETIMER target related to sysfs, from Dmitry
   Torokhov.

3) Resolve panic for unreachable route in IPVS with locally generated
   traffic in the output path, from Alex Gartrell.

4) Fix wrong source address in rare cases for tunneled traffic in IPVS,
   from Julian Anastasov.

5) Fix crash if scheduler is changed via ipvsadm -E, again from Julian.

6) Make sure skb->sk is unset for forwarded traffic through IPVS, again from
   Alex Gartrell.

7) Fix crash with IPVS sync protocol v0 and FTP, from Julian.

8) Reset sender cpu for forwarded traffic in IPVS, also from Julian.

9) Allocate template conntracks through kmalloc() to resolve netns dependency
   problems with the conntrack kmem_cache.

10) Fix zones with expectations that clash using the same tuple, from Joe
    Stringer.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents cc9f4daa 4b31814d

include/net/netfilter/nf_conntrack.h

+1 −1
Original line number Diff line number Diff line
@@ -291,7 +291,7 @@ extern unsigned int nf_conntrack_max; 
extern unsigned int nf_conntrack_hash_rnd;

void init_nf_conntrack_hash_rnd(void);



void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl);

struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags);



#define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)

#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)

include/net/netns/conntrack.h

+0 −1
Original line number Diff line number Diff line
@@ -68,7 +68,6 @@ struct ct_pcpu { 
	spinlock_t		lock;

	struct hlist_nulls_head unconfirmed;

	struct hlist_nulls_head dying;

	struct hlist_nulls_head tmpl;

};



struct netns_ct {

net/netfilter/ipvs/ip_vs_core.c

+14 −2
Original line number Diff line number Diff line
@@ -319,7 +319,13 @@ ip_vs_sched_persist(struct ip_vs_service *svc, 
		 * return *ignored=0 i.e. ICMP and NF_DROP

		 */

		sched = rcu_dereference(svc->scheduler);

		if (sched) {

			/* read svc->sched_data after svc->scheduler */

			smp_rmb();

			dest = sched->schedule(svc, skb, iph);

		} else {

			dest = NULL;

		}

		if (!dest) {

			IP_VS_DBG(1, "p-schedule: no dest found.\n");

			kfree(param.pe_data);
@@ -467,7 +473,13 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
	}



	sched = rcu_dereference(svc->scheduler);

	if (sched) {

		/* read svc->sched_data after svc->scheduler */

		smp_rmb();

		dest = sched->schedule(svc, skb, iph);

	} else {

		dest = NULL;

	}

	if (dest == NULL) {

		IP_VS_DBG(1, "Schedule: no dest found.\n");

		return NULL;

net/netfilter/ipvs/ip_vs_ctl.c

+49 −29
Original line number Diff line number Diff line
@@ -842,15 +842,16 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, 
	__ip_vs_dst_cache_reset(dest);

	spin_unlock_bh(&dest->dst_lock);



	sched = rcu_dereference_protected(svc->scheduler, 1);

	if (add) {

		ip_vs_start_estimator(svc->net, &dest->stats);

		list_add_rcu(&dest->n_list, &svc->destinations);

		svc->num_dests++;

		if (sched->add_dest)

		sched = rcu_dereference_protected(svc->scheduler, 1);

		if (sched && sched->add_dest)

			sched->add_dest(svc, dest);

	} else {

		if (sched->upd_dest)

		sched = rcu_dereference_protected(svc->scheduler, 1);

		if (sched && sched->upd_dest)

			sched->upd_dest(svc, dest);

	}

}
@@ -1084,7 +1085,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc, 
		struct ip_vs_scheduler *sched;



		sched = rcu_dereference_protected(svc->scheduler, 1);

		if (sched->del_dest)

		if (sched && sched->del_dest)

			sched->del_dest(svc, dest);

	}

}
@@ -1175,12 +1176,15 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u, 
	ip_vs_use_count_inc();



	/* Lookup the scheduler by 'u->sched_name' */

	if (strcmp(u->sched_name, "none")) {

		sched = ip_vs_scheduler_get(u->sched_name);

	if (sched == NULL) {

		pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);

		if (!sched) {

			pr_info("Scheduler module ip_vs_%s not found\n",

				u->sched_name);

			ret = -ENOENT;

			goto out_err;

		}

	}



	if (u->pe_name && *u->pe_name) {

		pe = ip_vs_pe_getbyname(u->pe_name);
@@ -1240,10 +1244,12 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u, 
	spin_lock_init(&svc->stats.lock);



	/* Bind the scheduler */

	if (sched) {

		ret = ip_vs_bind_scheduler(svc, sched);

		if (ret)

			goto out_err;

		sched = NULL;

	}



	/* Bind the ct retriever */

	RCU_INIT_POINTER(svc->pe, pe);
@@ -1291,18 +1297,21 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u, 
static int

ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)

{

	struct ip_vs_scheduler *sched, *old_sched;

	struct ip_vs_scheduler *sched = NULL, *old_sched;

	struct ip_vs_pe *pe = NULL, *old_pe = NULL;

	int ret = 0;



	/*

	 * Lookup the scheduler, by 'u->sched_name'

	 */

	if (strcmp(u->sched_name, "none")) {

		sched = ip_vs_scheduler_get(u->sched_name);

	if (sched == NULL) {

		pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);

		if (!sched) {

			pr_info("Scheduler module ip_vs_%s not found\n",

				u->sched_name);

			return -ENOENT;

		}

	}

	old_sched = sched;



	if (u->pe_name && *u->pe_name) {
@@ -1329,14 +1338,20 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u) 


	old_sched = rcu_dereference_protected(svc->scheduler, 1);

	if (sched != old_sched) {

		if (old_sched) {

			ip_vs_unbind_scheduler(svc, old_sched);

			RCU_INIT_POINTER(svc->scheduler, NULL);

			/* Wait all svc->sched_data users */

			synchronize_rcu();

		}

		/* Bind the new scheduler */

		if (sched) {

			ret = ip_vs_bind_scheduler(svc, sched);

			if (ret) {

			old_sched = sched;

				ip_vs_scheduler_put(sched);

				goto out;

			}

		/* Unbind the old scheduler on success */

		ip_vs_unbind_scheduler(svc, old_sched);

		}

	}



	/*
@@ -1982,6 +1997,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) 
		const struct ip_vs_iter *iter = seq->private;

		const struct ip_vs_dest *dest;

		struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);

		char *sched_name = sched ? sched->name : "none";



		if (iter->table == ip_vs_svc_table) {

#ifdef CONFIG_IP_VS_IPV6
@@ -1990,18 +2006,18 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) 
					   ip_vs_proto_name(svc->protocol),

					   &svc->addr.in6,

					   ntohs(svc->port),

					   sched->name);

					   sched_name);

			else

#endif

				seq_printf(seq, "%s  %08X:%04X %s %s ",

					   ip_vs_proto_name(svc->protocol),

					   ntohl(svc->addr.ip),

					   ntohs(svc->port),

					   sched->name,

					   sched_name,

					   (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");

		} else {

			seq_printf(seq, "FWM  %08X %s %s",

				   svc->fwmark, sched->name,

				   svc->fwmark, sched_name,

				   (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");

		}
@@ -2427,13 +2443,15 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src) 
{

	struct ip_vs_scheduler *sched;

	struct ip_vs_kstats kstats;

	char *sched_name;



	sched = rcu_dereference_protected(src->scheduler, 1);

	sched_name = sched ? sched->name : "none";

	dst->protocol = src->protocol;

	dst->addr = src->addr.ip;

	dst->port = src->port;

	dst->fwmark = src->fwmark;

	strlcpy(dst->sched_name, sched->name, sizeof(dst->sched_name));

	strlcpy(dst->sched_name, sched_name, sizeof(dst->sched_name));

	dst->flags = src->flags;

	dst->timeout = src->timeout / HZ;

	dst->netmask = src->netmask;
@@ -2892,6 +2910,7 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb, 
	struct ip_vs_flags flags = { .flags = svc->flags,

				     .mask = ~0 };

	struct ip_vs_kstats kstats;

	char *sched_name;



	nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);

	if (!nl_service)
@@ -2910,8 +2929,9 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb, 
	}



	sched = rcu_dereference_protected(svc->scheduler, 1);

	sched_name = sched ? sched->name : "none";

	pe = rcu_dereference_protected(svc->pe, 1);

	if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched->name) ||

	if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||

	    (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||

	    nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||

	    nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||

net/netfilter/ipvs/ip_vs_sched.c

+6 −6
Original line number Diff line number Diff line
@@ -74,7 +74,7 @@ void ip_vs_unbind_scheduler(struct ip_vs_service *svc, 


	if (sched->done_service)

		sched->done_service(svc);

	/* svc->scheduler can not be set to NULL */

	/* svc->scheduler can be set to NULL only by caller */

}
@@ -147,21 +147,21 @@ void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler) 


void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg)

{

	struct ip_vs_scheduler *sched;

	struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);

	char *sched_name = sched ? sched->name : "none";



	sched = rcu_dereference(svc->scheduler);

	if (svc->fwmark) {

		IP_VS_ERR_RL("%s: FWM %u 0x%08X - %s\n",

			     sched->name, svc->fwmark, svc->fwmark, msg);

			     sched_name, svc->fwmark, svc->fwmark, msg);

#ifdef CONFIG_IP_VS_IPV6

	} else if (svc->af == AF_INET6) {

		IP_VS_ERR_RL("%s: %s [%pI6c]:%d - %s\n",

			     sched->name, ip_vs_proto_name(svc->protocol),

			     sched_name, ip_vs_proto_name(svc->protocol),

			     &svc->addr.in6, ntohs(svc->port), msg);

#endif

	} else {

		IP_VS_ERR_RL("%s: %s %pI4:%d - %s\n",

			     sched->name, ip_vs_proto_name(svc->protocol),

			     sched_name, ip_vs_proto_name(svc->protocol),

			     &svc->addr.ip, ntohs(svc->port), msg);

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE