Commit 2aa2f88c authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Incorrect output device in nf_egress hook, from Phill Sutter.

2) Preserve liberal flag in TCP conntrack state, reported by Sven Auhagen.

3) Use GFP_KERNEL_ACCOUNT flag for nf_tables objects, from Vasily Averin.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents bcb74e13 33758c89

include/linux/netfilter_netdev.h

+1 −1
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc, 
		return skb;



	nf_hook_state_init(&state, NF_NETDEV_EGRESS,

			   NFPROTO_NETDEV, dev, NULL, NULL,

			   NFPROTO_NETDEV, NULL, dev, NULL,

			   dev_net(dev), NULL);



	/* nf assumes rcu_read_lock, not just read_lock_bh */

net/netfilter/core.c

+1 −1
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ static struct nf_hook_entries *allocate_hook_entries_size(u16 num) 
	if (num == 0)

		return NULL;



	e = kvzalloc(alloc, GFP_KERNEL);

	e = kvzalloc(alloc, GFP_KERNEL_ACCOUNT);

	if (e)

		e->num_hook_entries = num;

	return e;

net/netfilter/nf_conntrack_proto_tcp.c

+13 −4
Original line number Diff line number Diff line
@@ -341,8 +341,8 @@ static void tcp_options(const struct sk_buff *skb, 
	if (!ptr)

		return;



	state->td_scale =

	state->flags = 0;

	state->td_scale = 0;

	state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;



	while (length > 0) {

		int opcode=*ptr++;
@@ -862,6 +862,16 @@ static bool tcp_can_early_drop(const struct nf_conn *ct) 
	return false;

}



static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)

{

	state->td_end		= 0;

	state->td_maxend	= 0;

	state->td_maxwin	= 0;

	state->td_maxack	= 0;

	state->td_scale		= 0;

	state->flags		&= IP_CT_TCP_FLAG_BE_LIBERAL;

}



/* Returns verdict for packet, or -1 for invalid. */

int nf_conntrack_tcp_packet(struct nf_conn *ct,

			    struct sk_buff *skb,
@@ -968,8 +978,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;

			ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =

				ct->proto.tcp.last_flags;

			memset(&ct->proto.tcp.seen[dir], 0,

			       sizeof(struct ip_ct_tcp_state));

			nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);

			break;

		}

		ct->proto.tcp.last_index = index;

net/netfilter/nf_tables_api.c

+22 −22
Original line number Diff line number Diff line
@@ -1192,16 +1192,16 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 
	}



	err = -ENOMEM;

	table = kzalloc(sizeof(*table), GFP_KERNEL);

	table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT);

	if (table == NULL)

		goto err_kzalloc;



	table->name = nla_strdup(attr, GFP_KERNEL);

	table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT);

	if (table->name == NULL)

		goto err_strdup;



	if (nla[NFTA_TABLE_USERDATA]) {

		table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);

		table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT);

		if (table->udata == NULL)

			goto err_table_udata;
@@ -1882,7 +1882,7 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 
	struct nft_hook *hook;

	int err;



	hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);

	hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT);

	if (!hook) {

		err = -ENOMEM;

		goto err_hook_alloc;
@@ -2105,7 +2105,7 @@ static struct nft_rule_blob *nf_tables_chain_alloc_rules(unsigned int size) 
	if (size > INT_MAX)

		return NULL;



	blob = kvmalloc(size, GFP_KERNEL);

	blob = kvmalloc(size, GFP_KERNEL_ACCOUNT);

	if (!blob)

		return NULL;
@@ -2205,7 +2205,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
		if (err < 0)

			return err;



		basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);

		basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT);

		if (basechain == NULL) {

			nft_chain_release_hook(&hook);

			return -ENOMEM;
@@ -2235,7 +2235,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
		if (flags & NFT_CHAIN_HW_OFFLOAD)

			return -EOPNOTSUPP;



		chain = kzalloc(sizeof(*chain), GFP_KERNEL);

		chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT);

		if (chain == NULL)

			return -ENOMEM;
@@ -2248,7 +2248,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
	chain->table = table;



	if (nla[NFTA_CHAIN_NAME]) {

		chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);

		chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT);

	} else {

		if (!(flags & NFT_CHAIN_BINDING)) {

			err = -EINVAL;
@@ -2256,7 +2256,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
		}



		snprintf(name, sizeof(name), "__chain%llu", ++chain_id);

		chain->name = kstrdup(name, GFP_KERNEL);

		chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT);

	}



	if (!chain->name) {
@@ -2265,7 +2265,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
	}



	if (nla[NFTA_CHAIN_USERDATA]) {

		chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);

		chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT);

		if (chain->udata == NULL) {

			err = -ENOMEM;

			goto err_destroy_chain;
@@ -2428,7 +2428,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 
		char *name;



		err = -ENOMEM;

		name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);

		name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT);

		if (!name)

			goto err;
@@ -2876,7 +2876,7 @@ static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 
		goto err1;



	err = -ENOMEM;

	expr = kzalloc(expr_info.ops->size, GFP_KERNEL);

	expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT);

	if (expr == NULL)

		goto err2;
@@ -3484,7 +3484,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 
	}



	err = -ENOMEM;

	rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);

	rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT);

	if (rule == NULL)

		goto err_release_expr;
@@ -3897,7 +3897,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 
		free_page((unsigned long)inuse);

	}



	set->name = kasprintf(GFP_KERNEL, name, min + n);

	set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n);

	if (!set->name)

		return -ENOMEM;
@@ -4461,11 +4461,11 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 
	alloc_size = sizeof(*set) + size + udlen;

	if (alloc_size < size || alloc_size > INT_MAX)

		return -ENOMEM;

	set = kvzalloc(alloc_size, GFP_KERNEL);

	set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT);

	if (!set)

		return -ENOMEM;



	name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);

	name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT);

	if (!name) {

		err = -ENOMEM;

		goto err_set_name;
@@ -6000,7 +6000,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
	err = -ENOMEM;

	elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,

				      elem.key_end.val.data, elem.data.val.data,

				      timeout, expiration, GFP_KERNEL);

				      timeout, expiration, GFP_KERNEL_ACCOUNT);

	if (elem.priv == NULL)

		goto err_parse_data;
@@ -6244,7 +6244,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 
	err = -ENOMEM;

	elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,

				      elem.key_end.val.data, NULL, 0, 0,

				      GFP_KERNEL);

				      GFP_KERNEL_ACCOUNT);

	if (elem.priv == NULL)

		goto fail_elem;
@@ -6556,7 +6556,7 @@ static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 
	}



	err = -ENOMEM;

	obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);

	obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT);

	if (!obj)

		goto err2;
@@ -6722,7 +6722,7 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 
	obj->key.table = table;

	obj->handle = nf_tables_alloc_handle(table);



	obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);

	obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT);

	if (!obj->key.name) {

		err = -ENOMEM;

		goto err_strdup;
@@ -7483,7 +7483,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, 


	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);



	flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);

	flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT);

	if (!flowtable)

		return -ENOMEM;
@@ -7491,7 +7491,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, 
	flowtable->handle = nf_tables_alloc_handle(table);

	INIT_LIST_HEAD(&flowtable->hook_list);



	flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);

	flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT);

	if (!flowtable->name) {

		err = -ENOMEM;

		goto err1;