Commit f00439e2 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains fixes for your net tree, they are:

1) Unitialize the set element key and data from the commit path,
   otherwise this leaks chain refcount if the transaction is aborted,
   reported by Thomas Graf.

2) Fix crash when updating chains without no counters in nf_tables,
   this slipped through in the new transaction infrastructure, reported
   by Matteo Croce.

3) Replace all mutex_lock_interruptible() by mutex_lock() in the Netfilter
   tree, suggested by Patrick McHardy. This implicitly fixes the problem
   that Eric Dumazet reported in: http://patchwork.ozlabs.org/patch/373076/



4) Fix error return code in nf_tables when deleting set element in
   nf_tables if the transaction cannot be allocated, from Julia Lawall.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4da5e6a0 609ccf08

net/bridge/netfilter/ebtables.c

+2 −8
Original line number Diff line number Diff line
@@ -327,10 +327,7 @@ find_inlist_lock_noload(struct list_head *head, const char *name, int *error, 
		char name[EBT_FUNCTION_MAXNAMELEN];

	} *e;



	*error = mutex_lock_interruptible(mutex);

	if (*error != 0)

		return NULL;



	mutex_lock(mutex);

	list_for_each_entry(e, head, list) {

		if (strcmp(e->name, name) == 0)

			return e;
@@ -1203,10 +1200,7 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table) 


	table->private = newinfo;

	rwlock_init(&table->lock);

	ret = mutex_lock_interruptible(&ebt_mutex);

	if (ret != 0)

		goto free_chainstack;



	mutex_lock(&ebt_mutex);

	list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {

		if (strcmp(t->name, table->name) == 0) {

			ret = -EEXIST;

net/netfilter/core.c

+2 −9
Original line number Diff line number Diff line
@@ -35,11 +35,7 @@ EXPORT_SYMBOL_GPL(nf_ipv6_ops); 


int nf_register_afinfo(const struct nf_afinfo *afinfo)

{

	int err;



	err = mutex_lock_interruptible(&afinfo_mutex);

	if (err < 0)

		return err;

	mutex_lock(&afinfo_mutex);

	RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);

	mutex_unlock(&afinfo_mutex);

	return 0;
@@ -68,11 +64,8 @@ static DEFINE_MUTEX(nf_hook_mutex); 
int nf_register_hook(struct nf_hook_ops *reg)

{

	struct nf_hook_ops *elem;

	int err;



	err = mutex_lock_interruptible(&nf_hook_mutex);

	if (err < 0)

		return err;

	mutex_lock(&nf_hook_mutex);

	list_for_each_entry(elem, &nf_hooks[reg->pf][reg->hooknum], list) {

		if (reg->priority < elem->priority)

			break;

net/netfilter/ipvs/ip_vs_ctl.c

+4 −15
Original line number Diff line number Diff line
@@ -2271,10 +2271,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) 
	    cmd == IP_VS_SO_SET_STOPDAEMON) {

		struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;



		if (mutex_lock_interruptible(&ipvs->sync_mutex)) {

			ret = -ERESTARTSYS;

			goto out_dec;

		}

		mutex_lock(&ipvs->sync_mutex);

		if (cmd == IP_VS_SO_SET_STARTDAEMON)

			ret = start_sync_thread(net, dm->state, dm->mcast_ifn,

						dm->syncid);
@@ -2284,11 +2281,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) 
		goto out_dec;

	}



	if (mutex_lock_interruptible(&__ip_vs_mutex)) {

		ret = -ERESTARTSYS;

		goto out_dec;

	}



	mutex_lock(&__ip_vs_mutex);

	if (cmd == IP_VS_SO_SET_FLUSH) {

		/* Flush the virtual service */

		ret = ip_vs_flush(net, false);
@@ -2573,9 +2566,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
		struct ip_vs_daemon_user d[2];



		memset(&d, 0, sizeof(d));

		if (mutex_lock_interruptible(&ipvs->sync_mutex))

			return -ERESTARTSYS;



		mutex_lock(&ipvs->sync_mutex);

		if (ipvs->sync_state & IP_VS_STATE_MASTER) {

			d[0].state = IP_VS_STATE_MASTER;

			strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
@@ -2594,9 +2585,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
		return ret;

	}



	if (mutex_lock_interruptible(&__ip_vs_mutex))

		return -ERESTARTSYS;



	mutex_lock(&__ip_vs_mutex);

	switch (cmd) {

	case IP_VS_SO_GET_VERSION:

	{

net/netfilter/nf_sockopt.c

+2 −6
Original line number Diff line number Diff line
@@ -26,9 +26,7 @@ int nf_register_sockopt(struct nf_sockopt_ops *reg) 
	struct nf_sockopt_ops *ops;

	int ret = 0;



	if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)

		return -EINTR;



	mutex_lock(&nf_sockopt_mutex);

	list_for_each_entry(ops, &nf_sockopts, list) {

		if (ops->pf == reg->pf

		    && (overlap(ops->set_optmin, ops->set_optmax,
@@ -65,9 +63,7 @@ static struct nf_sockopt_ops *nf_sockopt_find(struct sock *sk, u_int8_t pf, 
{

	struct nf_sockopt_ops *ops;



	if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)

		return ERR_PTR(-EINTR);



	mutex_lock(&nf_sockopt_mutex);

	list_for_each_entry(ops, &nf_sockopts, list) {

		if (ops->pf == pf) {

			if (!try_module_get(ops->owner))

net/netfilter/nf_tables_api.c

+17 −13
Original line number Diff line number Diff line
@@ -899,6 +899,9 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 
static void nft_chain_stats_replace(struct nft_base_chain *chain,

				    struct nft_stats __percpu *newstats)

{

	if (newstats == NULL)

		return;



	if (chain->stats) {

		struct nft_stats __percpu *oldstats =

				nft_dereference(chain->stats);
@@ -3134,16 +3137,13 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 
		goto err2;



	trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);

	if (trans == NULL)

	if (trans == NULL) {

		err = -ENOMEM;

		goto err2;

	}



	nft_trans_elem(trans) = elem;

	list_add_tail(&trans->list, &ctx->net->nft.commit_list);



	nft_data_uninit(&elem.key, NFT_DATA_VALUE);

	if (set->flags & NFT_SET_MAP)

		nft_data_uninit(&elem.data, set->dtype);



	return 0;

err2:

	nft_data_uninit(&elem.key, desc.type);
@@ -3310,7 +3310,7 @@ static int nf_tables_commit(struct sk_buff *skb) 
{

	struct net *net = sock_net(skb->sk);

	struct nft_trans *trans, *next;

	struct nft_set *set;

	struct nft_trans_elem *te;



	/* Bump generation counter, invalidate any dump in progress */

	while (++net->nft.base_seq == 0);
@@ -3396,13 +3396,17 @@ static int nf_tables_commit(struct sk_buff *skb) 
			nft_trans_destroy(trans);

			break;

		case NFT_MSG_DELSETELEM:

			nf_tables_setelem_notify(&trans->ctx,

						 nft_trans_elem_set(trans),

						 &nft_trans_elem(trans),

			te = (struct nft_trans_elem *)trans->data;

			nf_tables_setelem_notify(&trans->ctx, te->set,

						 &te->elem,

						 NFT_MSG_DELSETELEM, 0);

			set = nft_trans_elem_set(trans);

			set->ops->get(set, &nft_trans_elem(trans));

			set->ops->remove(set, &nft_trans_elem(trans));

			te->set->ops->get(te->set, &te->elem);

			te->set->ops->remove(te->set, &te->elem);

			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);

			if (te->elem.flags & NFT_SET_MAP) {

				nft_data_uninit(&te->elem.data,

						te->set->dtype);

			}

			nft_trans_destroy(trans);

			break;

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE