Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 468b0df6 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
   skbuff, patch from Davide Caratti.

2) nf_tables rb-tree set backend does not handle element re-addition
   after deletion in the same transaction, leading to infinite loop.

3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
   from Liping Zhang.

4) Conntrack hashtable resizing while ctnetlink dump is progress leads
   to a dead reference to released objects in the lists, also from
   Liping.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents c21fbe29 fefa9267

net/netfilter/nf_conntrack_netlink.c

+6 −1
Original line number Diff line number Diff line
@@ -890,8 +890,13 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 
	}

out:

	local_bh_enable();

	if (last)

	if (last) {

		/* nf ct hash resize happened, now clear the leftover. */

		if ((struct nf_conn *)cb->args[1] == last)

			cb->args[1] = 0;



		nf_ct_put(last);

	}



	while (i) {

		i--;

net/netfilter/nf_conntrack_proto_sctp.c

+6 −3
Original line number Diff line number Diff line
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb, 
		      u8 pf, unsigned int hooknum)

{

	const struct sctphdr *sh;

	struct sctphdr _sctph;

	const char *logmsg;



	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);

	if (!sh) {

	if (skb->len < dataoff + sizeof(struct sctphdr)) {

		logmsg = "nf_ct_sctp: short packet ";

		goto out_invalid;

	}

	if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&

	    skb->ip_summed == CHECKSUM_NONE) {

		if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {

			logmsg = "nf_ct_sctp: failed to read header ";

			goto out_invalid;

		}

		sh = (const struct sctphdr *)(skb->data + dataoff);

		if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {

			logmsg = "nf_ct_sctp: bad CRC ";

			goto out_invalid;

net/netfilter/nf_nat_core.c

+1 −1
Original line number Diff line number Diff line
@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data) 
	 * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()

	 * will delete entry from already-freed table.

	 */

	ct->status &= ~IPS_NAT_DONE_MASK;

	clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);

	rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,

			nf_nat_bysource_params);

net/netfilter/nft_set_rbtree.c

+11 −11
Original line number Diff line number Diff line
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, 
		else if (d > 0)

			p = &parent->rb_right;

		else {

			if (nft_set_elem_active(&rbe->ext, genmask)) {

			if (nft_rbtree_interval_end(rbe) &&

				    !nft_rbtree_interval_end(new))

			    !nft_rbtree_interval_end(new)) {

				p = &parent->rb_left;

				else if (!nft_rbtree_interval_end(rbe) &&

					 nft_rbtree_interval_end(new))

			} else if (!nft_rbtree_interval_end(rbe) &&

				   nft_rbtree_interval_end(new)) {

				p = &parent->rb_right;

				else {

			} else if (nft_set_elem_active(&rbe->ext, genmask)) {

				*ext = &rbe->ext;

				return -EEXIST;

				}

			} else {

				p = &parent->rb_left;

			}

		}

	}