Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30322309 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: guarantee 8 byte minalign for template addresses 



The next change will merge skb->nfct pointer and skb->nfctinfo
status bits into single skb->_nfct (unsigned long) area.

For this to work nf_conn addresses must always be aligned at least on
an 8 byte boundary since we will need the lower 3bits to store nfctinfo.

Conntrack templates are allocated via kmalloc.
kbuild test robot reported
BUILD_BUG_ON failed: NFCT_INFOMASK >= ARCH_KMALLOC_MINALIGN
on v1 of this patchset, so not all platforms meet this requirement.

Do manual alignment if needed,  the alignment offset is stored in the
nf_conn entry protocol area. This works because templates are not
handed off to L4 protocol trackers.

Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c74454fa

include/net/netfilter/nf_conntrack.h

+2 −0
Original line number Diff line number Diff line
@@ -163,6 +163,8 @@ void nf_conntrack_alter_reply(struct nf_conn *ct, 
int nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,

			     const struct nf_conn *ignored_conntrack);



#define NFCT_INFOMASK	7UL



/* Return conntrack_info and tuple hash for given skb. */

static inline struct nf_conn *

nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)

net/netfilter/nf_conntrack_core.c

+24 −5
Original line number Diff line number Diff line
@@ -350,16 +350,31 @@ static void nf_ct_del_from_dying_or_unconfirmed_list(struct nf_conn *ct) 
	spin_unlock(&pcpu->lock);

}



#define NFCT_ALIGN(len)	(((len) + NFCT_INFOMASK) & ~NFCT_INFOMASK)



/* Released via destroy_conntrack() */

struct nf_conn *nf_ct_tmpl_alloc(struct net *net,

				 const struct nf_conntrack_zone *zone,

				 gfp_t flags)

{

	struct nf_conn *tmpl;

	struct nf_conn *tmpl, *p;



	if (ARCH_KMALLOC_MINALIGN <= NFCT_INFOMASK) {

		tmpl = kzalloc(sizeof(*tmpl) + NFCT_INFOMASK, flags);

		if (!tmpl)

			return NULL;



		p = tmpl;

		tmpl = (struct nf_conn *)NFCT_ALIGN((unsigned long)p);

		if (tmpl != p) {

			tmpl = (struct nf_conn *)NFCT_ALIGN((unsigned long)p);

			tmpl->proto.tmpl_padto = (char *)tmpl - (char *)p;

		}

	} else {

		tmpl = kzalloc(sizeof(*tmpl), flags);

	if (tmpl == NULL)

		if (!tmpl)

			return NULL;

	}



	tmpl->status = IPS_TEMPLATE;

	write_pnet(&tmpl->ct_net, net);
@@ -374,6 +389,10 @@ void nf_ct_tmpl_free(struct nf_conn *tmpl) 
{

	nf_ct_ext_destroy(tmpl);

	nf_ct_ext_free(tmpl);



	if (ARCH_KMALLOC_MINALIGN <= NFCT_INFOMASK)

		kfree((char *)tmpl - tmpl->proto.tmpl_padto);

	else

		kfree(tmpl);

}

EXPORT_SYMBOL_GPL(nf_ct_tmpl_free);