[GIT PULL nf] IPVS

[GIT PULL nf] IPVS

[Simon Horman]

Hi Pablo,

please consider pulling
git://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master
to get the following fix from Julian.

The bug in question has been present since 2.6.37 and accordingly I would
like the fix considered for both 3.3 and stable. I have confirmed that it
applies and builds against your net tree, 3.2.2, 3.1.10, 3.0.18 and 2.6.39.4.

Julian Anastasov (1):
      ipvs: fix matching of fwmark templates during scheduling

 net/netfilter/ipvs/ip_vs_core.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

[PATCH] ipvs: fix matching of fwmark templates during scheduling

[Simon Horman]

From: Julian Anastasov <ja@ssi.bg>

	Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
moved the fwmark variable in subcontext that is invalidated before
reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer
in the param structure make sure the fwmark variable is in
same context. As the fwmark templates can not be matched,
more and more template connections are created and the
controlled connections can not go to single real server.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Cc: stable@vger.kernel.org
Signed-off-by: Simon Horman <horms@verge.net.au>
---
 net/netfilter/ipvs/ip_vs_core.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 093cc32..6dc7d7d 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
 	__be16 dport = 0;		/* destination port to forward */
 	unsigned int flags;
 	struct ip_vs_conn_param param;
+	const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
 	union nf_inet_addr snet;	/* source network of the client,
 					   after masking */
 
@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
 	{
 		int protocol = iph.protocol;
 		const union nf_inet_addr *vaddr = &iph.daddr;
-		const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
 		__be16 vport = 0;
 
 		if (dst_port == svc->port) {
-- 
1.7.6.3

Re: [PATCH] ipvs: fix matching of fwmark templates during scheduling

[Pablo Neira Ayuso]

On Fri, Jan 27, 2012 at 10:45:27AM +0900, Simon Horman wrote:
> From: Julian Anastasov <ja@ssi.bg>
> 
> 	Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
> moved the fwmark variable in subcontext that is invalidated before
> reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer
> in the param structure make sure the fwmark variable is in
> same context. As the fwmark templates can not be matched,
> more and more template connections are created and the
> controlled connections can not go to single real server.
> 
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
> Cc: stable@vger.kernel.org
> Signed-off-by: Simon Horman <horms@verge.net.au>

Applied, thanks. I'll pass it to davem.

I'll pass it to stable once this hits Linus tree.

Re: [PATCH] ipvs: fix matching of fwmark templates during scheduling

[Simon Horman]

On Thu, Feb 09, 2012 at 04:15:07PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Jan 27, 2012 at 10:45:27AM +0900, Simon Horman wrote:
> > From: Julian Anastasov <ja@ssi.bg>
> > 
> > 	Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
> > moved the fwmark variable in subcontext that is invalidated before
> > reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer
> > in the param structure make sure the fwmark variable is in
> > same context. As the fwmark templates can not be matched,
> > more and more template connections are created and the
> > controlled connections can not go to single real server.
> > 
> > Signed-off-by: Julian Anastasov <ja@ssi.bg>
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Simon Horman <horms@verge.net.au>
> 
> Applied, thanks. I'll pass it to davem.
> 
> I'll pass it to stable once this hits Linus tree.

Thanks

[GIT PULL nf] IPVS

[Simon Horman]

Hi Pablo,

this pull request consists of three bug fixes for IPVS.
Please consider for inclusion in 3.5 and stable.

The bug fix from Julian, "ipvs: fix oops in ip_vs_dst_event on rmmod"
fixes a regression introduced in 3.4 and thus I believe it is
only relevant to 3.5 and 3.4-stable.

The other two fixes appear to have been present since at least 2.6.37
(there were a lot of changes to IPVS around that time).

----------------------------------------------------------------

The following changes since commit 6bd0405bb4196b44f1acb7a58f11382cdaf6f7f0:

  netfilter: nf_ct_ecache: fix crash with multiple containers, one shutting down (2012-07-09 10:53:19 +0200)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master

for you to fetch changes up to 51878010232aaac12822e219b94e89de54faa1ef:

  ipvs: fix oops in ip_vs_dst_event on rmmod (2012-07-11 09:00:47 +0900)

----------------------------------------------------------------
Julian Anastasov (1):
      ipvs: fix oops in ip_vs_dst_event on rmmod

Lin Ming (1):
      ipvs: fix oops on NAT reply in br_nf context

Xiaotian Feng (1):
      ipvs: add missing lock in ip_vs_ftp_init_conn()

 include/net/ip_vs.h            | 2 +-
 net/netfilter/ipvs/ip_vs_ctl.c | 5 +++--
 net/netfilter/ipvs/ip_vs_ftp.c | 2 ++
 3 files changed, 6 insertions(+), 3 deletions(-)

Re: [GIT PULL nf] IPVS

[Pablo Neira Ayuso]

On Wed, Jul 11, 2012 at 09:19:20AM +0900, Simon Horman wrote:
> 
> Hi Pablo,
> 
> this pull request consists of three bug fixes for IPVS.
> Please consider for inclusion in 3.5 and stable.
> 
> The bug fix from Julian, "ipvs: fix oops in ip_vs_dst_event on rmmod"
> fixes a regression introduced in 3.4 and thus I believe it is
> only relevant to 3.5 and 3.4-stable.
> 
> The other two fixes appear to have been present since at least 2.6.37
> (there were a lot of changes to IPVS around that time).

I have passed the two of these patches to David. The one for the FTP
needs a consistent description.

It's fairly late in the development cycle (-rc7), but these are small.
Let's see if David is still in time to accept them. Otherwise, they go
to net-next and we will ask for -stable submission.

Re: [GIT PULL nf] IPVS

[Simon Horman]

On Tue, Jul 17, 2012 at 12:14:06PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jul 11, 2012 at 09:19:20AM +0900, Simon Horman wrote:
> > 
> > Hi Pablo,
> > 
> > this pull request consists of three bug fixes for IPVS.
> > Please consider for inclusion in 3.5 and stable.
> > 
> > The bug fix from Julian, "ipvs: fix oops in ip_vs_dst_event on rmmod"
> > fixes a regression introduced in 3.4 and thus I believe it is
> > only relevant to 3.5 and 3.4-stable.
> > 
> > The other two fixes appear to have been present since at least 2.6.37
> > (there were a lot of changes to IPVS around that time).
> 
> I have passed the two of these patches to David. The one for the FTP
> needs a consistent description.
> 
> It's fairly late in the development cycle (-rc7), but these are small.
> Let's see if David is still in time to accept them. Otherwise, they go
> to net-next and we will ask for -stable submission.

Thanks, it seems that David was in an accepting mood.

[GIT PULL nf] IPVS

[Simon Horman]

Hi Pablo,

please consider the following fix for IPVS patch for 3.8.

I believe that the problem was introduced in 3.4 and thus
this fix is appropriate for 3.4, 3.5, 3.6 and 3.7 -stable.

----------------------------------------------------------------
The following changes since commit 5b76c4948fe6977bead2359c2054f3e6a2dcf3d0:

  netfilter: x_tables: print correct hook names for ARP (2013-01-13 12:54:12 +0100)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master

for you to fetch changes up to b425df4cdd953a400d814b4474c9d3ec04481858:

  ipvs: freeing uninitialized pointer on error (2013-01-28 10:14:37 +0900)

----------------------------------------------------------------
Dan Carpenter (1):
      ipvs: freeing uninitialized pointer on error

 net/netfilter/ipvs/ip_vs_sync.c |    2 ++
 1 file changed, 2 insertions(+)

Re: [GIT PULL nf] IPVS

[Pablo Neira Ayuso]

On Mon, Jan 28, 2013 at 10:18:33AM +0900, Simon Horman wrote:
> Hi Pablo,
> 
> please consider the following fix for IPVS patch for 3.8.

Pulled, thanks Simon.

> I believe that the problem was introduced in 3.4 and thus
> this fix is appropriate for 3.4, 3.5, 3.6 and 3.7 -stable.

Will pass this to -stable for 3.4 and 3.7.