Commit 4a0c7191 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Put back reference on CLUSTERIP configuration structure from the
   error path, patch from Florian Westphal.

2) Put reference on CLUSTERIP configuration instead of freeing it,
   another cpu may still be walking over it, also from Florian.

3) Refetch pointer to IPv6 header from nf_nat_ipv6_manip_pkt() given
   packet manipulation may reallocation the skbuff header, from Florian.

4) Missing match size sanity checks in ebt_among, from Florian.

5) Convert BUG_ON to WARN_ON in ebtables, from Florian.

6) Sanity check userspace offsets from ebtables kernel, from Florian.

7) Missing checksum replace call in flowtable IPv4 DNAT, from Felix
   Fietkau.

8) Bump the right stats on checksum error from bridge netfilter,
   from Taehee Yoo.

9) Unset interface flag in IPv6 fib lookups otherwise we get
   misleading routing lookup results, from Florian.

10) Missing sk_to_full_sk() in ip6_route_me_harder() from Eric Dumazet.

11) Don't allow devices to be part of multiple flowtables at the same
    time, this may break setups.

12) Missing netlink attribute validation in flowtable deletion.

13) Wrong array index in nf_unregister_net_hook() call from error path
    in flowtable addition path.

14) Fix FTP IPVS helper when NAT mangling is in place, patch from
    Julian Anastasov.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents d69242bf 8a949fff

net/bridge/br_netfilter_hooks.c

+3 −1
Original line number Diff line number Diff line
@@ -214,7 +214,7 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb) 


	iph = ip_hdr(skb);

	if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))

		goto inhdr_error;

		goto csum_error;



	len = ntohs(iph->tot_len);

	if (skb->len < len) {
@@ -236,6 +236,8 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb) 
	 */

	return 0;



csum_error:

	__IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);

inhdr_error:

	__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);

drop:

net/bridge/netfilter/ebt_among.c

+19 −2
Original line number Diff line number Diff line
@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par) 
	return true;

}



static bool poolsize_invalid(const struct ebt_mac_wormhash *w)

{

	return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));

}



static int ebt_among_mt_check(const struct xt_mtchk_param *par)

{

	const struct ebt_among_info *info = par->matchinfo;

	const struct ebt_entry_match *em =

		container_of(par->matchinfo, const struct ebt_entry_match, data);

	int expected_length = sizeof(struct ebt_among_info);

	unsigned int expected_length = sizeof(struct ebt_among_info);

	const struct ebt_mac_wormhash *wh_dst, *wh_src;

	int err;



	if (expected_length > em->match_size)

		return -EINVAL;



	wh_dst = ebt_among_wh_dst(info);

	wh_src = ebt_among_wh_src(info);

	if (poolsize_invalid(wh_dst))

		return -EINVAL;



	expected_length += ebt_mac_wormhash_size(wh_dst);

	if (expected_length > em->match_size)

		return -EINVAL;



	wh_src = ebt_among_wh_src(info);

	if (poolsize_invalid(wh_src))

		return -EINVAL;



	expected_length += ebt_mac_wormhash_size(wh_src);



	if (em->match_size != EBT_ALIGN(expected_length)) {

net/bridge/netfilter/ebtables.c

+30 −10
Original line number Diff line number Diff line
@@ -1641,7 +1641,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr, 
	int off = ebt_compat_match_offset(match, m->match_size);

	compat_uint_t msize = m->match_size - off;



	BUG_ON(off >= m->match_size);

	if (WARN_ON(off >= m->match_size))

		return -EINVAL;



	if (copy_to_user(cm->u.name, match->name,

	    strlen(match->name) + 1) || put_user(msize, &cm->match_size))
@@ -1671,7 +1672,8 @@ static int compat_target_to_user(struct ebt_entry_target *t, 
	int off = xt_compat_target_offset(target);

	compat_uint_t tsize = t->target_size - off;



	BUG_ON(off >= t->target_size);

	if (WARN_ON(off >= t->target_size))

		return -EINVAL;



	if (copy_to_user(cm->u.name, target->name,

	    strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
@@ -1902,7 +1904,8 @@ static int ebt_buf_add(struct ebt_entries_buf_state *state, 
	if (state->buf_kern_start == NULL)

		goto count_only;



	BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);

	if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len))

		return -EINVAL;



	memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
@@ -1915,7 +1918,8 @@ static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz) 
{

	char *b = state->buf_kern_start;



	BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);

	if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len))

		return -EINVAL;



	if (b != NULL && sz > 0)

		memset(b + state->buf_kern_offset, 0, sz);
@@ -1992,8 +1996,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, 
	pad = XT_ALIGN(size_kern) - size_kern;



	if (pad > 0 && dst) {

		BUG_ON(state->buf_kern_len <= pad);

		BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);

		if (WARN_ON(state->buf_kern_len <= pad))

			return -EINVAL;

		if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad))

			return -EINVAL;

		memset(dst + size_kern, 0, pad);

	}

	return off + match_size;
@@ -2043,7 +2049,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, 
		if (ret < 0)

			return ret;



		BUG_ON(ret < match32->match_size);

		if (WARN_ON(ret < match32->match_size))

			return -EINVAL;

		growth += ret - match32->match_size;

		growth += ebt_compat_entry_padsize();
@@ -2053,7 +2060,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, 
		if (match_kern)

			match_kern->match_size = ret;



		WARN_ON(type == EBT_COMPAT_TARGET && size_left);

		if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))

			return -EINVAL;



		match32 = (struct compat_ebt_entry_mwt *) buf;

	}
@@ -2109,6 +2118,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, 
	 *

	 * offsets are relative to beginning of struct ebt_entry (i.e., 0).

	 */

	for (i = 0; i < 4 ; ++i) {

		if (offsets[i] >= *total)

			return -EINVAL;

		if (i == 0)

			continue;

		if (offsets[i-1] > offsets[i])

			return -EINVAL;

	}



	for (i = 0, j = 1 ; j < 4 ; j++, i++) {

		struct compat_ebt_entry_mwt *match32;

		unsigned int size;
@@ -2140,7 +2158,8 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, 


	startoff = state->buf_user_offset - startoff;



	BUG_ON(*total < startoff);

	if (WARN_ON(*total < startoff))

		return -EINVAL;

	*total -= startoff;

	return 0;

}
@@ -2267,7 +2286,8 @@ static int compat_do_replace(struct net *net, void __user *user, 
	state.buf_kern_len = size64;



	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);

	BUG_ON(ret < 0);	/* parses same data again */

	if (WARN_ON(ret < 0))

		goto out_unlock;



	vfree(entries_tmp);

	tmp.entries_size = size64;

net/ipv4/netfilter/ipt_CLUSTERIP.c

+10 −5
Original line number Diff line number Diff line
@@ -232,7 +232,6 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i, 
	c->hash_mode = i->hash_mode;

	c->hash_initval = i->hash_initval;

	refcount_set(&c->refcount, 1);

	refcount_set(&c->entries, 1);



	spin_lock_bh(&cn->lock);

	if (__clusterip_config_find(net, ip)) {
@@ -263,8 +262,10 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i, 


	c->notifier.notifier_call = clusterip_netdev_event;

	err = register_netdevice_notifier(&c->notifier);

	if (!err)

	if (!err) {

		refcount_set(&c->entries, 1);

		return c;

	}



#ifdef CONFIG_PROC_FS

	proc_remove(c->pde);
@@ -273,7 +274,7 @@ err: 
	spin_lock_bh(&cn->lock);

	list_del_rcu(&c->list);

	spin_unlock_bh(&cn->lock);

	kfree(c);

	clusterip_config_put(c);



	return ERR_PTR(err);

}
@@ -496,12 +497,15 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) 
				return PTR_ERR(config);

		}

	}

	cipinfo->config = config;



	ret = nf_ct_netns_get(par->net, par->family);

	if (ret < 0)

	if (ret < 0) {

		pr_info("cannot load conntrack support for proto=%u\n",

			par->family);

		clusterip_config_entry_put(par->net, config);

		clusterip_config_put(config);

		return ret;

	}



	if (!par->net->xt.clusterip_deprecated_warning) {

		pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, "
@@ -509,6 +513,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) 
		par->net->xt.clusterip_deprecated_warning = true;

	}



	cipinfo->config = config;

	return ret;

}

net/ipv4/netfilter/nf_flow_table_ipv4.c

+1 −0
Original line number Diff line number Diff line
@@ -111,6 +111,7 @@ static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb, 
	default:

		return -1;

	}

	csum_replace4(&iph->check, addr, new_addr);



	return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE