Re: Android boot failure with 6.12

[Jozsef Kadlecsik <kadlec@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 2541 bytes --]

Hi Pablo,

On Sat, 11 Jan 2025, Pablo Neira Ayuso wrote:

> On Sat, Jan 11, 2025 at 02:31:18PM +0100, Jozsef Kadlecsik wrote:
> > 
> > On Fri, 10 Jan 2025, Maciej Żenczykowski wrote:
> > 
> > > nvm - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/netfilter/xt_mark.c?id=306ed1728e8438caed30332e1ab46b28c25fe3d8
> > 
> > Sorry, but I don't understand the patch at all. With it applied now it'd 
> > be not possible to load in the "MARK" target with IPv4. The code segment 
> > after the patch:
> > 
> > static struct xt_target mark_tg_reg[] __read_mostly = {
> >         {
> >                 .name           = "MARK",
> >                 .revision       = 2,
> >                 .family         = NFPROTO_IPV6,
> >                 .target         = mark_tg,
> >                 .targetsize     = sizeof(struct xt_mark_tginfo2),
> >                 .me             = THIS_MODULE,
> >         },
> > #if IS_ENABLED(CONFIG_IP_NF_ARPTABLES)
> >         {
> >                 .name           = "MARK",
> >                 .revision       = 2,
> >                 .family         = NFPROTO_ARP,
> >                 .target         = mark_tg,
> >                 .targetsize     = sizeof(struct xt_mark_tginfo2),
> >                 .me             = THIS_MODULE,
> >         },
> > #endif
> > #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
> >         {
> >                 .name           = "MARK",
> >                 .revision       = 2,
> >                 .family         = NFPROTO_IPV6,
> >                 .target         = mark_tg,
> >                 .targetsize     = sizeof(struct xt_mark_tginfo2),
> >                 .me             = THIS_MODULE,
> >         },
> > #endif
> > };
> > 
> > How is it supposed to work for IPv4?
> > 
> > Why the "IS_ENABLED(CONFIG_IP6_NF_IPTABLES)" part was not enough for the 
> > IPv6-specific MARK target to be compiled in? Isn't it an issue about 
> > selecting CONFIG_IP6_NF_IPTABLES vs CONFIG_IP6_NF_IPTABLES_LEGACY?
> 
> This was fixed by an incremental patch:
> 
>   306ed1728e84 ("netfilter: xtables: fix typo causing some targets not to load on IPv6")
> 
> so there is no two MARK targets for NFPROTO_IPV6.

No, it was my fault not checking the patch properly. It's completely fine, 
sorry for the noise!

Best regards,
Jozsef
-- 
E-mail : kadlec@netfilter.org, kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
Address: Wigner Research Centre for Physics
         H-1525 Budapest 114, POB. 49, Hungary