Commit 84f4aced authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

1) Several patches to testore use of memory barriers instead of RCU to
   ensure consistent access to ruleset, from Mark Tomlinson.

2) Fix dump of expectation via ctnetlink, from Florian Westphal.

3) GRE helper works for IPv6, from Ludovic Senecaux.

4) Set error on unsupported flowtable flags.

5) Use delayed instead of deferrable workqueue in the flowtable,
   from Yinjun Zhang.

6) Fix spurious EEXIST in case of add-after-delete flowtable in
   the same batch.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 6c015a22 86fe2c19

include/linux/netfilter/x_tables.h

+2 −5
Original line number Diff line number Diff line
@@ -227,7 +227,7 @@ struct xt_table { 
	unsigned int valid_hooks;



	/* Man behind the curtain... */

	struct xt_table_info __rcu *private;

	struct xt_table_info *private;



	/* Set this to THIS_MODULE if you are a module, otherwise NULL */

	struct module *me;
@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void) 
	 * since addend is most likely 1

	 */

	__this_cpu_add(xt_recseq.sequence, addend);

	smp_wmb();

	smp_mb();



	return addend;

}
@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) 


struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);



struct xt_table_info

*xt_table_get_private_protected(const struct xt_table *table);



#ifdef CONFIG_COMPAT

#include <net/compat.h>

include/net/netfilter/nf_tables.h

+3 −0
Original line number Diff line number Diff line
@@ -1536,6 +1536,7 @@ struct nft_trans_flowtable { 
	struct nft_flowtable		*flowtable;

	bool				update;

	struct list_head		hook_list;

	u32				flags;

};



#define nft_trans_flowtable(trans)	\
@@ -1544,6 +1545,8 @@ struct nft_trans_flowtable { 
	(((struct nft_trans_flowtable *)trans->data)->update)

#define nft_trans_flowtable_hooks(trans)	\

	(((struct nft_trans_flowtable *)trans->data)->hook_list)

#define nft_trans_flowtable_flags(trans)	\

	(((struct nft_trans_flowtable *)trans->data)->flags)



int __init nft_chain_filter_init(void);

void nft_chain_filter_fini(void);

net/ipv4/netfilter/arp_tables.c

+8 −8
Original line number Diff line number Diff line
@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, 


	local_bh_disable();

	addend = xt_write_recseq_begin();

	private = rcu_access_pointer(table->private);

	private = READ_ONCE(table->private); /* Address dependency. */

	cpu     = smp_processor_id();

	table_base = private->entries;

	jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) 
{

	unsigned int countersize;

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;



	/* We need atomic snapshot of counters: rest doesn't change

	 * (other than comefrom, which userspace doesn't care
@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size, 
	unsigned int off, num;

	const struct arpt_entry *e;

	struct xt_counters *counters;

	struct xt_table_info *private = xt_table_get_private_protected(table);

	struct xt_table_info *private = table->private;

	int ret = 0;

	void *loc_cpu_entry;
@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len) 
	t = xt_request_find_table_lock(net, NFPROTO_ARP, name);

	if (!IS_ERR(t)) {

		struct arpt_getinfo info;

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

#ifdef CONFIG_COMPAT

		struct xt_table_info tmp;
@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, 


	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);

	if (!IS_ERR(t)) {

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;



		if (get.size == private->size)

			ret = copy_entries_to_user(private->size,
@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len) 
	}



	local_bh_disable();

	private = xt_table_get_private_protected(t);

	private = t->private;

	if (private->number != tmp.num_counters) {

		ret = -EINVAL;

		goto unlock_up_free;
@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, 
				       void __user *userptr)

{

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;

	void __user *pos;

	unsigned int size;

	int ret = 0;
@@ -1379,7 +1379,7 @@ static int compat_get_entries(struct net *net, 
	xt_compat_lock(NFPROTO_ARP);

	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);

	if (!IS_ERR(t)) {

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

		struct xt_table_info info;



		ret = compat_table_info(private, &info);

net/ipv4/netfilter/ip_tables.c

+8 −8
Original line number Diff line number Diff line
@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb, 
	WARN_ON(!(table->valid_hooks & (1 << hook)));

	local_bh_disable();

	addend = xt_write_recseq_begin();

	private = rcu_access_pointer(table->private);

	private = READ_ONCE(table->private); /* Address dependency. */

	cpu        = smp_processor_id();

	table_base = private->entries;

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) 
{

	unsigned int countersize;

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;



	/* We need atomic snapshot of counters: rest doesn't change

	   (other than comefrom, which userspace doesn't care
@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size, 
	unsigned int off, num;

	const struct ipt_entry *e;

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;

	int ret = 0;

	const void *loc_cpu_entry;
@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len) 
	t = xt_request_find_table_lock(net, AF_INET, name);

	if (!IS_ERR(t)) {

		struct ipt_getinfo info;

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

#ifdef CONFIG_COMPAT

		struct xt_table_info tmp;
@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, 


	t = xt_find_table_lock(net, AF_INET, get.name);

	if (!IS_ERR(t)) {

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

		if (get.size == private->size)

			ret = copy_entries_to_user(private->size,

						   t, uptr->entrytable);
@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) 
	}



	local_bh_disable();

	private = xt_table_get_private_protected(t);

	private = t->private;

	if (private->number != tmp.num_counters) {

		ret = -EINVAL;

		goto unlock_up_free;
@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, 
			    void __user *userptr)

{

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;

	void __user *pos;

	unsigned int size;

	int ret = 0;
@@ -1589,7 +1589,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, 
	xt_compat_lock(AF_INET);

	t = xt_find_table_lock(net, AF_INET, get.name);

	if (!IS_ERR(t)) {

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

		struct xt_table_info info;

		ret = compat_table_info(private, &info);

		if (!ret && get.size == info.size)

net/ipv6/netfilter/ip6_tables.c

+8 −8
Original line number Diff line number Diff line
@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb, 


	local_bh_disable();

	addend = xt_write_recseq_begin();

	private = rcu_access_pointer(table->private);

	private = READ_ONCE(table->private); /* Address dependency. */

	cpu        = smp_processor_id();

	table_base = private->entries;

	jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) 
{

	unsigned int countersize;

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;



	/* We need atomic snapshot of counters: rest doesn't change

	   (other than comefrom, which userspace doesn't care
@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size, 
	unsigned int off, num;

	const struct ip6t_entry *e;

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;

	int ret = 0;

	const void *loc_cpu_entry;
@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len) 
	t = xt_request_find_table_lock(net, AF_INET6, name);

	if (!IS_ERR(t)) {

		struct ip6t_getinfo info;

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

#ifdef CONFIG_COMPAT

		struct xt_table_info tmp;
@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, 


	t = xt_find_table_lock(net, AF_INET6, get.name);

	if (!IS_ERR(t)) {

		struct xt_table_info *private = xt_table_get_private_protected(t);

		struct xt_table_info *private = t->private;

		if (get.size == private->size)

			ret = copy_entries_to_user(private->size,

						   t, uptr->entrytable);
@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len) 
	}



	local_bh_disable();

	private = xt_table_get_private_protected(t);

	private = t->private;

	if (private->number != tmp.num_counters) {

		ret = -EINVAL;

		goto unlock_up_free;
@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, 
			    void __user *userptr)

{

	struct xt_counters *counters;

	const struct xt_table_info *private = xt_table_get_private_protected(table);

	const struct xt_table_info *private = table->private;

	void __user *pos;

	unsigned int size;

	int ret = 0;
@@ -1598,7 +1598,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, 
	xt_compat_lock(AF_INET6);

	t = xt_find_table_lock(net, AF_INET6, get.name);

	if (!IS_ERR(t)) {

		const struct xt_table_info *private = xt_table_get_private_protected(t);

		const struct xt_table_info *private = t->private;

		struct xt_table_info info;

		ret = compat_table_info(private, &info);

		if (!ret && get.size == info.size)