[PATCH 0/3] netfilter fixes for net

[PATCH 0/3] netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three netfilter fixes for your net
tree, they are:

* A couple of fixes to resolve info leak to userspace due to uninitialized
  memory area in ulogd, from Mathias Krause.

* Fix instruction ordering issues that may lead to the access of
  uninitialized data in x_tables. The problem involves the table update
 (producer) and the main packet matching (consumer) routines. Detected in
  SMP ARMv7, from Will Deacon.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

----------------------------------------------------------------

The following changes since commit c31eeaced22ce8bd61268a3c595d542bb38c0a4f:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-10-01 12:58:48 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to b416c144f46af1a30ddfa4e4319a8f077381ad63:

  netfilter: x_tables: fix ordering of jumpstack allocation and table update (2013-10-22 10:11:29 +0200)

----------------------------------------------------------------
Mathias Krause (2):
      netfilter: ebt_ulog: fix info leaks
      netfilter: ipt_ULOG: fix info leaks

Will Deacon (1):
      netfilter: x_tables: fix ordering of jumpstack allocation and table update

 net/bridge/netfilter/ebt_ulog.c |    9 +++------
 net/ipv4/netfilter/arp_tables.c |    5 +++++
 net/ipv4/netfilter/ip_tables.c  |    5 +++++
 net/ipv4/netfilter/ipt_ULOG.c   |    7 +------
 net/ipv6/netfilter/ip6_tables.c |    5 +++++
 net/netfilter/x_tables.c        |    7 ++++++-
 6 files changed, 25 insertions(+), 13 deletions(-)

[PATCH 1/3] netfilter: ebt_ulog: fix info leaks

[Pablo Neira Ayuso]

From: Mathias Krause <minipli@googlemail.com>

The ulog messages leak heap bytes by the means of padding bytes and
incompletely filled string arrays. Fix those by memset(0)'ing the
whole struct before filling it.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/bridge/netfilter/ebt_ulog.c |    9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 5180938..7c470c3 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -181,6 +181,7 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
 	ub->qlen++;
 
 	pm = nlmsg_data(nlh);
+	memset(pm, 0, sizeof(*pm));
 
 	/* Fill in the ulog data */
 	pm->version = EBT_ULOG_VERSION;
@@ -193,8 +194,6 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
 	pm->hook = hooknr;
 	if (uloginfo->prefix != NULL)
 		strcpy(pm->prefix, uloginfo->prefix);
-	else
-		*(pm->prefix) = '\0';
 
 	if (in) {
 		strcpy(pm->physindev, in->name);
@@ -204,16 +203,14 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
 			strcpy(pm->indev, br_port_get_rcu(in)->br->dev->name);
 		else
 			strcpy(pm->indev, in->name);
-	} else
-		pm->indev[0] = pm->physindev[0] = '\0';
+	}
 
 	if (out) {
 		/* If out exists, then out is a bridge port */
 		strcpy(pm->physoutdev, out->name);
 		/* rcu_read_lock()ed by nf_hook_slow */
 		strcpy(pm->outdev, br_port_get_rcu(out)->br->dev->name);
-	} else
-		pm->outdev[0] = pm->physoutdev[0] = '\0';
+	}
 
 	if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
 		BUG();
-- 
1.7.10.4

[PATCH 2/3] netfilter: ipt_ULOG: fix info leaks

[Pablo Neira Ayuso]

From: Mathias Krause <minipli@googlemail.com>

The ulog messages leak heap bytes by the means of padding bytes and
incompletely filled string arrays. Fix those by memset(0)'ing the
whole struct before filling it.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv4/netfilter/ipt_ULOG.c |    7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index cbc2215..9cb993c 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net,
 	ub->qlen++;
 
 	pm = nlmsg_data(nlh);
+	memset(pm, 0, sizeof(*pm));
 
 	/* We might not have a timestamp, get one */
 	if (skb->tstamp.tv64 == 0)
@@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net,
 	}
 	else if (loginfo->prefix[0] != '\0')
 		strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
-	else
-		*(pm->prefix) = '\0';
 
 	if (in && in->hard_header_len > 0 &&
 	    skb->mac_header != skb->network_header &&
@@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net,
 
 	if (in)
 		strncpy(pm->indev_name, in->name, sizeof(pm->indev_name));
-	else
-		pm->indev_name[0] = '\0';
 
 	if (out)
 		strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
-	else
-		pm->outdev_name[0] = '\0';
 
 	/* copy_len <= skb->len, so can't fail. */
 	if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
-- 
1.7.10.4

[PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update

[Pablo Neira Ayuso]

From: Will Deacon <will.deacon@arm.com>

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv4/netfilter/arp_tables.c |    5 +++++
 net/ipv4/netfilter/ip_tables.c  |    5 +++++
 net/ipv6/netfilter/ip6_tables.c |    5 +++++
 net/netfilter/x_tables.c        |    7 ++++++-
 4 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 85a4f21..59da7cd 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -271,6 +271,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
 	private = table->private;
+	/*
+	 * Ensure we load private-> members after we've fetched the base
+	 * pointer.
+	 */
+	smp_read_barrier_depends();
 	table_base = private->entries[smp_processor_id()];
 
 	e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d23118d..718dfbd 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -327,6 +327,11 @@ ipt_do_table(struct sk_buff *skb,
 	addend = xt_write_recseq_begin();
 	private = table->private;
 	cpu        = smp_processor_id();
+	/*
+	 * Ensure we load private-> members after we've fetched the base
+	 * pointer.
+	 */
+	smp_read_barrier_depends();
 	table_base = private->entries[cpu];
 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
 	stackptr   = per_cpu_ptr(private->stackptr, cpu);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 44400c2..710238f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -349,6 +349,11 @@ ip6t_do_table(struct sk_buff *skb,
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
 	private = table->private;
+	/*
+	 * Ensure we load private-> members after we've fetched the base
+	 * pointer.
+	 */
+	smp_read_barrier_depends();
 	cpu        = smp_processor_id();
 	table_base = private->entries[cpu];
 	jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8b03028..227aa11 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -845,8 +845,13 @@ xt_replace_table(struct xt_table *table,
 		return NULL;
 	}
 
-	table->private = newinfo;
 	newinfo->initial_entries = private->initial_entries;
+	/*
+	 * Ensure contents of newinfo are visible before assigning to
+	 * private.
+	 */
+	smp_wmb();
+	table->private = newinfo;
 
 	/*
 	 * Even though table entries have now been swapped, other CPU's
-- 
1.7.10.4

RE: [PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update

[David Laight]

> Subject: [PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update
...
> Meanwhile, CPU0 is handling the network receive path and ends up in
> ipt_do_table, resulting in:
> 
> 	private = table->private;
> 
> 	[...]
> 
> 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
> 
> On weakly ordered memory architectures, the writes to table->private
> and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
> Furthermore, on architectures which don't respect ordering of address
> dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

Which reads might be out of order?
AFAICT they are strongly sequenced because they second depends on the
value read by the first.
So I don't see why the read barrier is needed.

I presume the above code is tied to a single cpu.

...
> 
> -	table->private = newinfo;
>  	newinfo->initial_entries = private->initial_entries;
> +	/*
> +	 * Ensure contents of newinfo are visible before assigning to
> +	 * private.
> +	 */
> +	smp_wmb();
> +	table->private = newinfo;

Those writes were in the wrong order on all systems.
Also gcc needs to be told not to reorder the writes even on non-smp
systems (if the code might be pre-empted).
So an asm volatile (:::"memory") is needed there even if no specific
synchronisation instruction is needed.

	David

RE: [PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update

[Eric Dumazet]

On Wed, 2013-10-23 at 10:45 +0100, David Laight wrote:

> Those writes were in the wrong order on all systems.
> Also gcc needs to be told not to reorder the writes even on non-smp
> systems (if the code might be pre-empted).
> So an asm volatile (:::"memory") is needed there even if no specific
> synchronisation instruction is needed.

smp_wmb() contains this compiler barrier already.

Re: [PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update

[Will Deacon]

Hi David,

On Wed, Oct 23, 2013 at 10:45:04AM +0100, David Laight wrote:
> > Subject: [PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update
> ...
> > Meanwhile, CPU0 is handling the network receive path and ends up in
> > ipt_do_table, resulting in:
> > 
> > 	private = table->private;
> > 
> > 	[...]
> > 
> > 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
> > 
> > On weakly ordered memory architectures, the writes to table->private
> > and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
> > Furthermore, on architectures which don't respect ordering of address
> > dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.
> 
> Which reads might be out of order?
> AFAICT they are strongly sequenced because they second depends on the
> value read by the first.
> So I don't see why the read barrier is needed.

That is why this is a dependent read barrier. Some architectures (e.g.
Alpha) *do* allow dependent reads to be observed out of order, so you can
effectively load the data pointed to by a pointer before you load the
pointer itself!

Take a look at Paul's paper about memory ordering if you're curious:

  http://www.rdrop.com/users/paulmck/scalability/paper/whymb.2009.04.05a.pdf

> > -	table->private = newinfo;
> >  	newinfo->initial_entries = private->initial_entries;
> > +	/*
> > +	 * Ensure contents of newinfo are visible before assigning to
> > +	 * private.
> > +	 */
> > +	smp_wmb();
> > +	table->private = newinfo;
> 
> Those writes were in the wrong order on all systems.
> Also gcc needs to be told not to reorder the writes even on non-smp
> systems (if the code might be pre-empted).
> So an asm volatile (:::"memory") is needed there even if no specific
> synchronisation instruction is needed.

The smp_* barriers expand to barrier() when !CONFIG_SMP, which gives you the
memory clobber you want.

What I'm *not* 100% sure about is the table freeing path. There is a mutex
there for removing the table from a list, but I'm not sure how we ensure
that there are no parallel readers at that point.

Will

Re: [PATCH 3/3] netfilter: x_tables: fix ordering of jumpstack allocation and table update

[Eric Dumazet]

On Wed, 2013-10-23 at 17:37 +0100, Will Deacon wrote:

> What I'm *not* 100% sure about is the table freeing path. There is a mutex
> there for removing the table from a list, but I'm not sure how we ensure
> that there are no parallel readers at that point.

Sequence is :

xt_replace_table();
get_counters();
xt_free_table_info();

get_counters() is the way we ensure no cpu is using old copy of the
table before freeing.

Re: [PATCH 0/3] netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 23 Oct 2013 11:15:21 +0200

> The following patchset contains three netfilter fixes for your net
> tree, they are:
> 
> * A couple of fixes to resolve info leak to userspace due to uninitialized
>   memory area in ulogd, from Mathias Krause.
> 
> * Fix instruction ordering issues that may lead to the access of
>   uninitialized data in x_tables. The problem involves the table update
>  (producer) and the main packet matching (consumer) routines. Detected in
>   SMP ARMv7, from Will Deacon.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi,

The following patchset contains Netfilter fixes for net:

1) Uninitialized when used in __nf_conntrack_update(), from
   Nathan Chancellor.

2) Comparison of unsigned expression in nf_confirm_cthelper().

3) Remove 'const' type qualifier with no effect.

This batch is addressing fallout from the previous pull request.

Please, pull this updates from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you.

----------------------------------------------------------------

The following changes since commit a4976a3ef844c510ae9120290b23e9f3f47d6bce:

  crypto: chelsio/chtls: properly set tp->lsndtime (2020-05-26 23:24:00 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 4946ea5c1237036155c3b3a24f049fd5f849f8f6:

  netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build (2020-05-27 13:39:08 +0200)

----------------------------------------------------------------
Nathan Chancellor (1):
      netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update

Pablo Neira Ayuso (2):
      netfilter: conntrack: comparison of unsigned in cthelper confirmation
      netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build

 include/linux/netfilter/nf_conntrack_pptp.h | 2 +-
 net/netfilter/nf_conntrack_core.c           | 8 ++++----
 net/netfilter/nf_conntrack_pptp.c           | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 28 May 2020 00:40:15 +0200

> The following patchset contains Netfilter fixes for net:
> 
> 1) Uninitialized when used in __nf_conntrack_update(), from
>    Nathan Chancellor.
> 
> 2) Comparison of unsigned expression in nf_confirm_cthelper().
> 
> 3) Remove 'const' type qualifier with no effect.
> 
> This batch is addressing fallout from the previous pull request.
> 
> Please, pull this updates from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

1) Module autoload for masquerade and redirection does not work.

2) Leak in unqueued packets in nf_ct_frag6_queue(). Ignore duplicated
   fragments, pretend they are placed into the queue. Patches from
   Guillaume Nault.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 100f6d8e09905c59be45b6316f8f369c0be1b2d8:

  net: correct zerocopy refcnt with udp MSG_MORE (2019-05-30 15:54:04 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 8a3dca632538c550930ce8bafa8c906b130d35cf:

  netfilter: ipv6: nf_defrag: accept duplicate fragments again (2019-06-07 14:49:01 +0200)

----------------------------------------------------------------
Guillaume Nault (2):
      netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
      netfilter: ipv6: nf_defrag: accept duplicate fragments again

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix module autoload with inet family

 net/ipv6/netfilter/nf_conntrack_reasm.c | 22 ++++++++++++----------
 net/netfilter/nft_masq.c                |  3 +--
 net/netfilter/nft_redir.c               |  3 +--
 3 files changed, 14 insertions(+), 14 deletions(-)

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Fix chain filtering when dumping rules via nf_tables_dump_rules().

2) Fix accidental change in NF_CT_STATE_UNTRACKED_BIT through uapi,
   introduced when removing the untracked conntrack object, from
   Florian Westphal.

3) Fix potential nul-dereference when releasing dump filter in
   nf_tables_dump_obj_done(), patch from Hangbin Liu.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit b4681c2829e24943aadd1a7bb3a30d41d0a20050:

  ipv4: Fix use-after-free when flushing FIB tables (2017-12-20 15:12:39 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 8bea728dce8972e534e6b99fd550f7b5cc3864e8:

  netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done() (2017-12-26 17:16:47 +0100)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: uapi: correct UNTRACKED conntrack state bit number

Hangbin Liu (1):
      netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()

 include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
 net/netfilter/nf_tables_api.c                      | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri,  5 Jan 2018 16:08:22 +0100

> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Fix chain filtering when dumping rules via nf_tables_dump_rules().
> 
> 2) Fix accidental change in NF_CT_STATE_UNTRACKED_BIT through uapi,
>    introduced when removing the untracked conntrack object, from
>    Florian Westphal.
> 
> 3) Fix potential nul-dereference when releasing dump filter in
>    nf_tables_dump_obj_done(), patch from Hangbin Liu.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contain Netfilter simple fixes for your net tree,
two one-liner and one two-liner:

1) Oneliner to fix missing spinlock definition that triggers
   'BUG: spinlock bad magic on CPU#' when spinlock debugging is enabled,
   from Florian Westphal.

2) Fix missing workqueue cancelation on IDLETIMER removal,
   from Liping Zhang.

3) Fix insufficient validation of netlink of NFACCT_QUOTA in
   nfnetlink_acct, from Phil Turnbull.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit f28f20da704d399fb1e4d8838ffd697a357d9cc8:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2016-04-26 16:25:51 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to eda3fc50daa93b08774a18d51883c5a5d8d85e15:

  netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter (2016-05-05 16:47:08 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: conntrack: init all_locks to avoid debug warning

Liping Zhang (1):
      netfilter: IDLETIMER: fix race condition when destroy the target

Phil Turnbull (1):
      netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter

 net/netfilter/nf_conntrack_core.c | 2 +-
 net/netfilter/nfnetlink_acct.c    | 2 ++
 net/netfilter/xt_IDLETIMER.c      | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon,  9 May 2016 21:52:00 +0200

> The following patchset contain Netfilter simple fixes for your net tree,
> two one-liner and one two-liner:
> 
> 1) Oneliner to fix missing spinlock definition that triggers
>    'BUG: spinlock bad magic on CPU#' when spinlock debugging is enabled,
>    from Florian Westphal.
> 
> 2) Fix missing workqueue cancelation on IDLETIMER removal,
>    from Liping Zhang.
> 
> 3) Fix insufficient validation of netlink of NFACCT_QUOTA in
>    nfnetlink_acct, from Phil Turnbull.

Pulled, thanks.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes for your net tree. More
specifically, they are:

1) Fix missing filter table per-netns registration in arptables, from
   Florian Westphal.

2) Resolve out of bound access when parsing TCP options in
   nf_conntrack_tcp, patch from Jozsef Kadlecsik.

3) Prefer NFPROTO_BRIDGE extensions over NFPROTO_UNSPEC in ebtables,
   this resolves conflict between xt_limit and ebt_limit, from Phil Sutter.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 0a1a37b6d62e6864a77a82e925217c720f91f963:

  net: add the AF_KCM entries to family name tables (2016-04-06 16:59:01 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to bcf4934288402be3464110109a4dae3bd6fb3e93:

  netfilter: ebtables: Fix extension lookup with identical name (2016-04-13 01:16:57 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: arp_tables: register table in initns

Jozsef Kadlecsik (1):
      netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options

Phil Sutter (1):
      netfilter: ebtables: Fix extension lookup with identical name

 net/bridge/netfilter/ebtables.c        | 6 +++++-
 net/ipv4/netfilter/arptable_filter.c   | 6 ++++++
 net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++
 3 files changed, 15 insertions(+), 1 deletion(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 14 Apr 2016 00:54:51 +0200

> The following patchset contains Netfilter fixes for your net tree. More
> specifically, they are:
> 
> 1) Fix missing filter table per-netns registration in arptables, from
>    Florian Westphal.
> 
> 2) Resolve out of bound access when parsing TCP options in
>    nf_conntrack_tcp, patch from Jozsef Kadlecsik.
> 
> 3) Prefer NFPROTO_BRIDGE extensions over NFPROTO_UNSPEC in ebtables,
>    this resolves conflict between xt_limit and ebt_limit, from Phil Sutter.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Fix crash when TEE target is used with no --oif, from Eric Dumazet.

2) Oneliner to fix a crash on the redirect traffic to localhost
   infrastructure when interface has not yet an address, from
   Munehisa Kamata.

3) Oneliner not to request module all the time from nfnetlink due to
   wrong type value, from Florian Westphal.

I'll make sure these patches 1 and 2 hit -stable.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 104eb270e665f4fcd8cb8c8ab4c4d4538c604e92:

  net: sun4i-emac: Properly free resources on probe failure and remove (2015-10-21 19:47:45 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to dbc3617f4c1f9fcbe63612048cb9583fea1e11ab:

  netfilter: nfnetlink: don't probe module if it exists (2015-10-28 03:40:50 +0100)

----------------------------------------------------------------
Eric Dumazet (1):
      netfilter: xt_TEE: fix NULL dereference

Florian Westphal (1):
      netfilter: nfnetlink: don't probe module if it exists

Munehisa Kamata (1):
      netfilter: nf_nat_redirect: add missing NULL pointer check

 net/netfilter/nf_nat_redirect.c | 2 +-
 net/netfilter/nfnetlink.c       | 2 +-
 net/netfilter/xt_TEE.c          | 6 ++++--
 3 files changed, 6 insertions(+), 4 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed,  4 Nov 2015 15:00:35 +0100

> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Fix crash when TEE target is used with no --oif, from Eric Dumazet.
> 
> 2) Oneliner to fix a crash on the redirect traffic to localhost
>    infrastructure when interface has not yet an address, from
>    Munehisa Kamata.
> 
> 3) Oneliner not to request module all the time from nfnetlink due to
>    wrong type value, from Florian Westphal.
> 
> I'll make sure these patches 1 and 2 hit -stable.

Pulled.

Since net-next got merged, and I fast-forwarded net to Linus's
tree, there were some minor conflicts.

Please double check my work.

Thanks.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contain Netfilter fixes for your net tree, they are:

1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash.
   This problem is due to wrong order in the per-net registration and netlink
   socket events. Patch from Francesco Ruggeri.

2) Make sure that counters that userspace pass us are higher than 0 in all the
   x_tables frontends. Discovered via Trinity, patch from Dave Jones.

3) Revert a patch for br_netfilter to rely on the conntrack status bits. This
   breaks stateless IPv6 NAT transformations. Patch from Florian Westphal.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 13c3ed6a92724d8c8cb148a14b0ae190ddfe7413:

  vxlan: correct typo in call to unregister_netdevice_queue (2015-05-18 16:57:09 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to faecbb45ebefb20260ad4a631e011e93c896cb73:

  Revert "netfilter: bridge: query conntrack about skb dnat" (2015-05-20 13:51:25 +0200)

----------------------------------------------------------------
Dave Jones (1):
      netfilter: ensure number of counters is >0 in do_replace()

Florian Westphal (1):
      Revert "netfilter: bridge: query conntrack about skb dnat"

Francesco Ruggeri (1):
      netfilter: nfnetlink_{log,queue}: Register pernet in first place

 include/linux/skbuff.h               |    1 +
 net/bridge/br_netfilter.c            |   27 +++++++++------------------
 net/bridge/netfilter/ebtables.c      |    4 ++++
 net/ipv4/netfilter/arp_tables.c      |    6 ++++++
 net/ipv4/netfilter/ip_tables.c       |    6 ++++++
 net/ipv6/netfilter/ip6_tables.c      |    6 ++++++
 net/netfilter/nfnetlink_log.c        |   19 ++++++++++---------
 net/netfilter/nfnetlink_queue_core.c |   18 +++++++++---------
 8 files changed, 51 insertions(+), 36 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 22 May 2015 12:34:03 +0200

> The following patchset contain Netfilter fixes for your net tree, they are:
> 
> 1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash.
>    This problem is due to wrong order in the per-net registration and netlink
>    socket events. Patch from Francesco Ruggeri.
> 
> 2) Make sure that counters that userspace pass us are higher than 0 in all the
>    x_tables frontends. Discovered via Trinity, patch from Dave Jones.
> 
> 3) Revert a patch for br_netfilter to rely on the conntrack status bits. This
>    breaks stateless IPv6 NAT transformations. Patch from Florian Westphal.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three Netfilter fixes for your net tree,
they are:

* Fix missing generation sequence initialization which results in a splat
  if lockdep is enabled, it was introduced in the recent works to improve
  nf_conntrack scalability, from Andrey Vagin.

* Don't flush the GRE keymap list in nf_conntrack when the pptp helper is
  disabled otherwise this crashes due to a double release, from Andrey
  Vagin.

* Fix nf_tables cmp fast in big endian, from Patrick McHardy.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 6859e7df6d9045a461412777e63bd8cef12f9705:

  netdev: remove potentially harmful checks (2014-04-07 15:52:07 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to b855d416dc17061ebb271ea7ef1201d100531770:

  netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4 (2014-04-14 10:38:02 +0200)

----------------------------------------------------------------
Andrey Vagin (2):
      netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper
      netfilter: nf_conntrack: initialize net.ct.generation

Patrick McHardy (1):
      netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4

 include/linux/netfilter/nf_conntrack_proto_gre.h |    1 -
 include/net/netfilter/nf_tables_core.h           |   10 ++++++++++
 net/netfilter/nf_conntrack_core.c                |    1 +
 net/netfilter/nf_conntrack_pptp.c                |   20 +-------------------
 net/netfilter/nf_conntrack_proto_gre.c           |    3 +--
 net/netfilter/nf_tables_core.c                   |    3 +--
 net/netfilter/nft_cmp.c                          |    2 +-
 7 files changed, 15 insertions(+), 25 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 15 Apr 2014 00:43:32 +0200

> The following patchset contains three Netfilter fixes for your net tree,
> they are:
> 
> * Fix missing generation sequence initialization which results in a splat
>   if lockdep is enabled, it was introduced in the recent works to improve
>   nf_conntrack scalability, from Andrey Vagin.
> 
> * Don't flush the GRE keymap list in nf_conntrack when the pptp helper is
>   disabled otherwise this crashes due to a double release, from Andrey
>   Vagin.
> 
> * Fix nf_tables cmp fast in big endian, from Patrick McHardy.

Pulled, thanks a lot Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three Netfilter fixes for your net tree,
they are:

* fix incorrect comparison in the new netnet hash ipset type, from
  Dave Jones.

* fix splat in hashlimit due to missing removal of the content of its
  proc entry in netnamespaces, from Sergey Popovich.

* fix missing rule flushing operation by table in nf_tables. Table
  flushing was already discussed back in October but this got lost and
  no patch has hit the tree to address this issue so far, from me.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

----------------------------------------------------------------

The following changes since commit 2c7a9dc1641664173211c4ebc5db510a08684c46:

  be2net: Avoid programming permenant MAC by BE3-R VFs (2013-11-23 15:11:07 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to cf9dc09d0949f0b5953fb08caa10bba0dc7ee71f:

  netfilter: nf_tables: fix missing rules flushing per table (2013-12-07 22:55:48 +0100)

----------------------------------------------------------------
Dave Jones (1):
      netfilter: ipset: fix incorret comparison in hash_netnet4_data_equal()

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix missing rules flushing per table

Sergey Popovich (1):
      netfilter: xt_hashlimit: fix proc entry leak in netns destroy path

 net/netfilter/ipset/ip_set_hash_netnet.c |    2 +-
 net/netfilter/nf_tables_api.c            |   46 +++++++++++++++++++++---------
 net/netfilter/xt_hashlimit.c             |   25 +++++++---------
 3 files changed, 45 insertions(+), 28 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun,  8 Dec 2013 00:13:27 +0100

> The following patchset contains three Netfilter fixes for your net tree,
> they are:
> 
> * fix incorrect comparison in the new netnet hash ipset type, from
>   Dave Jones.
> 
> * fix splat in hashlimit due to missing removal of the content of its
>   proc entry in netnamespaces, from Sergey Popovich.
> 
> * fix missing rule flushing operation by table in nf_tables. Table
>   flushing was already discussed back in October but this got lost and
>   no patch has hit the tree to address this issue so far, from me.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Pulled, thanks Pablo.

[PATCH 0/3] netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes. They are targeted to the
TCP option targets, that have receive some scrinity in the last week. The
changes are:

* Fix TCPOPTSTRIP, it stopped working in the forward chain as tcp_hdr
  uses skb->transport_header, and we cannot use that in the forwarding
  case, from myself.

* Fix default IPv6 MSS in TCPMSS in case of absence of TCP MSS options,
  from Phil Oester.

* Fix missing fragmentation handling again in TCPMSS, from Phil Oester.

You can pull these changes from:

git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

----------------------------------------------------------------
The following changes since commit a8241c63517ec0b900695daa9003cddc41c536a1:

  ipvs: info leak in __ip_vs_get_dest_entries() (2013-06-10 14:53:00 +0200)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to b396966c4688522863572927cb30aa874b3ec504:

  netfilter: xt_TCPMSS: Fix missing fragmentation handling (2013-06-12 11:06:19 +0200)

----------------------------------------------------------------
Pablo Neira Ayuso (1):
      netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()

Phil Oester (2):
      netfilter: xt_TCPMSS: Fix IPv6 default MSS too
      netfilter: xt_TCPMSS: Fix missing fragmentation handling

 net/netfilter/xt_TCPMSS.c      |   25 ++++++++++++++++++-------
 net/netfilter/xt_TCPOPTSTRIP.c |    6 ++++--
 2 files changed, 22 insertions(+), 9 deletions(-)

Re: [PATCH 0/3] netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 17 Jun 2013 21:34:36 +0200

> The following patchset contains Netfilter fixes. They are targeted to the
> TCP option targets, that have receive some scrinity in the last week. The
> changes are:
> 
> * Fix TCPOPTSTRIP, it stopped working in the forward chain as tcp_hdr
>   uses skb->transport_header, and we cannot use that in the forwarding
>   case, from myself.
> 
> * Fix default IPv6 MSS in TCPMSS in case of absence of TCP MSS options,
>   from Phil Oester.
> 
> * Fix missing fragmentation handling again in TCPMSS, from Phil Oester.
> 
> You can pull these changes from:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Pulled, thanks Pablo.