Commit f4926d51 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net, they are:

1) Unaligned atomic access in ipset, from Russell King.

2) Missing module description, from Rob Gill.

3) Patches to fix a module unload causing NULL pointer dereference in
   xtables, from David Wilder. For the record, I posting here his cover
   letter explaining the problem:

    A crash happened on ppc64le when running ltp network tests triggered by
    "rmmod iptable_mangle".

    See previous discussion in this thread:
    https://lists.openwall.net/netdev/2020/06/03/161

 .

    In the crash I found in iptable_mangle_hook() that
    state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference.
    net->ipv4.iptable_mangle is set to NULL in +iptable_mangle_net_exit() and
    called when ip_mangle modules is unloaded. A rmmod task was found running
    in the crash dump.  A 2nd crash showed the same problem when running
    "rmmod iptable_filter" (net->ipv4.iptable_filter=NULL).

    To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will
    un-register the underlying hook and exit would do the table freeing. The
    netns core does an unconditional +synchronize_rcu after the pre_exit hooks
    insuring no packets are in flight that have picked up the pointer before
    completing the un-register.

    These patches include changes for both iptables and ip6tables.

    We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a
    loop for 72 hours.

4) Add a selftest for conntrack helper assignment, from Florian Westphal.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 206e7323 619ae8e0

include/linux/netfilter_ipv4/ip_tables.h

+6 −0
Original line number Diff line number Diff line
@@ -25,6 +25,12 @@ 
int ipt_register_table(struct net *net, const struct xt_table *table,

		       const struct ipt_replace *repl,

		       const struct nf_hook_ops *ops, struct xt_table **res);



void ipt_unregister_table_pre_exit(struct net *net, struct xt_table *table,

		       const struct nf_hook_ops *ops);



void ipt_unregister_table_exit(struct net *net, struct xt_table *table);



void ipt_unregister_table(struct net *net, struct xt_table *table,

			  const struct nf_hook_ops *ops);

include/linux/netfilter_ipv6/ip6_tables.h

+3 −0
Original line number Diff line number Diff line
@@ -29,6 +29,9 @@ int ip6t_register_table(struct net *net, const struct xt_table *table, 
			const struct nf_hook_ops *ops, struct xt_table **res);

void ip6t_unregister_table(struct net *net, struct xt_table *table,

			   const struct nf_hook_ops *ops);

void ip6t_unregister_table_pre_exit(struct net *net, struct xt_table *table,

				    const struct nf_hook_ops *ops);

void ip6t_unregister_table_exit(struct net *net, struct xt_table *table);

extern unsigned int ip6t_do_table(struct sk_buff *skb,

				  const struct nf_hook_state *state,

				  struct xt_table *table);

net/bridge/netfilter/nft_meta_bridge.c

+1 −0
Original line number Diff line number Diff line
@@ -155,3 +155,4 @@ module_exit(nft_meta_bridge_module_exit); 
MODULE_LICENSE("GPL");

MODULE_AUTHOR("wenxu <wenxu@ucloud.cn>");

MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "meta");

MODULE_DESCRIPTION("Support for bridge dedicated meta key");

net/bridge/netfilter/nft_reject_bridge.c

+1 −0
Original line number Diff line number Diff line
@@ -455,3 +455,4 @@ module_exit(nft_reject_bridge_module_exit); 
MODULE_LICENSE("GPL");

MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");

MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");

MODULE_DESCRIPTION("Reject packets from bridge via nftables");

net/ipv4/netfilter/ip_tables.c

+14 −1
Original line number Diff line number Diff line
@@ -1797,11 +1797,22 @@ out_free: 
	return ret;

}



void ipt_unregister_table_pre_exit(struct net *net, struct xt_table *table,

				   const struct nf_hook_ops *ops)

{

	nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));

}



void ipt_unregister_table_exit(struct net *net, struct xt_table *table)

{

	__ipt_unregister_table(net, table);

}



void ipt_unregister_table(struct net *net, struct xt_table *table,

			  const struct nf_hook_ops *ops)

{

	if (ops)

		nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));

		ipt_unregister_table_pre_exit(net, table, ops);

	__ipt_unregister_table(net, table);

}
@@ -1958,6 +1969,8 @@ static void __exit ip_tables_fini(void) 


EXPORT_SYMBOL(ipt_register_table);

EXPORT_SYMBOL(ipt_unregister_table);

EXPORT_SYMBOL(ipt_unregister_table_pre_exit);

EXPORT_SYMBOL(ipt_unregister_table_exit);

EXPORT_SYMBOL(ipt_do_table);

module_init(ip_tables_init);

module_exit(ip_tables_fini);

CRA Git | Maintained and supported by SUSTech CRA and CCSE