bles_addchain():
ops->hook = hook.type->hooks[ops->hooknum];
Fixes: fe19c04ca137 ("netfilter: nf_tables: remove nhooks field from struct
nft_af_info")
Signed-off-by: Dan Carpenter
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tab
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
include/net/netfilter/nf_conntrack.h | 2 ++
net/netfilter/nf_conntrack_core.c| 35
net/netfilter/nf_conntrack_netlink.c | 34 +++
3 files changed, 66 insertions(+), 5 deleti
found.
Fixes: 6044eeffafbe ("ipvs: attempt to schedule icmp packets")
Signed-off-by: Julian Anastasov
Signed-off-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
di
isting 'id 0' icmp conntrack and gets
dropped.
Fixes: 203f2e78200c27e ("netfilter: nat: remove l4proto->unique_tuple")
Reported-by: Sven Auhagen
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_nat_core.c
Eric Dumazet
Reported-by: Michal Soltys
Signed-off-by: Florian Westphal
Acked-by: Eric Dumazet
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conntrack_core.c | 7 ++-
net/netfilter/nfnetlink_log.c | 2 +-
net/netfilter/nfnetlink_queue.c
lorian Westphal
Fixes: c4f3db1595827 ("netfilter: conntrack: add and use
nf_l4proto_log_invalid")
Signed-off-by: Andrei Vagin
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conntrack_proto.c | 2 +-
1 file changed, 1 insertio
lorian Westphal
Fixes: c4f3db1595827 ("netfilter: conntrack: add and use
nf_l4proto_log_invalid")
Signed-off-by: Andrei Vagin
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conntrack_proto.c | 2 +-
1 file changed, 1 insertio
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
include/net/netfilter/nf_conntrack.h | 2 ++
net/netfilter/nf_conntrack_core.c| 35
net/netfilter/nf_conntrack_netlink.c | 34 +++
3 files changed, 66 insertions(+), 5 deleti
bles_addchain():
ops->hook = hook.type->hooks[ops->hooknum];
Fixes: fe19c04ca137 ("netfilter: nf_tables: remove nhooks field from struct
nft_af_info")
Signed-off-by: Dan Carpenter
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tab
found.
Fixes: 6044eeffafbe ("ipvs: attempt to schedule icmp packets")
Signed-off-by: Julian Anastasov
Signed-off-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
di
module_put(expr->ops->type->owner);
^
2168 }
Smatch says there are three functions which free expr->ops.
Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list
of extension")
Reported-by: Dan Carpenter
Signed-off
<-- it should be 0
Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list
of extension")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 5 -
1 file changed, 4 insertions(+),
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
include/net/netfilter/nf_conntrack.h | 2 ++
net/netfilter/nf_conntrack_core.c| 35
net/netfilter/nf_conntrack_netlink.c | 34 +++
3 files changed, 66 insertions(+), 5 deleti
found.
Fixes: 6044eeffafbe ("ipvs: attempt to schedule icmp packets")
Signed-off-by: Julian Anastasov
Signed-off-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
di
igned-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 19 +++
1 file changed, 19 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c445d57e3a5b..b149a7219084 1006
found.
Fixes: 6044eeffafbe ("ipvs: attempt to schedule icmp packets")
Signed-off-by: Julian Anastasov
Signed-off-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
di
found.
Fixes: 6044eeffafbe ("ipvs: attempt to schedule icmp packets")
Signed-off-by: Julian Anastasov
Signed-off-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
di
On Fri, Apr 26, 2019 at 08:32:19PM +0200, Pablo Neira Ayuso wrote:
Hi Sasha,
Via Laura Garcia.
Could you cherry-pick the following netfilter fixes for 4.19 -stable?
https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=12c44aba6618b7f6c437076e5722237
ablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/netfilter/nft_set_rbtree.c | 7 +++
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index fa61208371f8..321a0036fdf5 100644
--- a/net/netfilter/nft_se
lo Neira Ayuso
Signed-off-by: Xin Long
Acked-by: Neil Horman
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/bridge/br_netfilter_hooks.c | 1 +
net/bridge/br_netfilter_ipv6.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/net
IPv6 segment routing header 'srh' match")
Signed-off-by: Kangjie Lu
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/ipv6/netfilter/ip6t_srh.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/net/ipv6/netfilter/ip6t_srh.c b/net/ipv6/netfil
r: Kconfig: Change select IPv6 dependencies")
Cc: Máté Eckl
Cc: Taehee Yoo
Link: https://patchwork.ozlabs.org/patch/999498/
Link: https://lore.kernel.org/patchwork/patch/960062/
Reported-by: Randy Dunlap
Reported-by: Stephen Rothwell
Signed-off-by: Arnd Bergmann
Signed-off-by: Pablo Nei
stroy phase")
Reported-by: Laura Garcia
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/netfilter/nft_objref.c | 19 ---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index ae
ablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/netfilter/nft_set_rbtree.c | 7 +++
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 0e5ec126f6ad..b3e75f9cb686 100644
--- a/net/netfilter/nft_se
lo Neira Ayuso
Signed-off-by: Xin Long
Acked-by: Neil Horman
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/bridge/br_netfilter_hooks.c | 1 +
net/bridge/br_netfilter_ipv6.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/net
r: Kconfig: Change select IPv6 dependencies")
Cc: Máté Eckl
Cc: Taehee Yoo
Link: https://patchwork.ozlabs.org/patch/999498/
Link: https://lore.kernel.org/patchwork/patch/960062/
Reported-by: Randy Dunlap
Reported-by: Stephen Rothwell
Signed-off-by: Arnd Bergmann
Signed-off-by: Pablo Nei
IPv6 segment routing header 'srh' match")
Signed-off-by: Kangjie Lu
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/ipv6/netfilter/ip6t_srh.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/net/ipv6/netfilter/ip6t_srh.c b/net/ipv6/netfil
lo Neira Ayuso
Signed-off-by: Xin Long
Acked-by: Neil Horman
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/bridge/br_netfilter_hooks.c | 1 +
net/bridge/br_netfilter_ipv6.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/net
ablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/netfilter/nft_set_rbtree.c | 7 +++
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index d83a4ec5900d..6f3205de887f 100644
--- a/net/netfilter/nft_se
lo Neira Ayuso
Signed-off-by: Xin Long
Acked-by: Neil Horman
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/bridge/br_netfilter_hooks.c | 1 +
net/bridge/br_netfilter_ipv6.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/net
ablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/netfilter/nft_set_rbtree.c | 7 +++
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 93820e0d8814..4ee8acded0a4 100644
--- a/net/netfilter/nft_se
lo Neira Ayuso
Signed-off-by: Xin Long
Acked-by: Neil Horman
Acked-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin (Microsoft)
---
net/bridge/br_netfilter_hooks.c | 1 +
net/bridge/br_netfilter_ipv6.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/net
On Wed, Mar 27, 2019 at 12:06:53AM +0100, Pablo Neira Ayuso wrote:
Hi Greg,
I'm receiving several emails for a bit of time now to request to
cherry-pick this patch:
40ba1d9b4d19 netfilter: nf_tables: fix set double-free in abort path
to kernel 5.0 stable queue. I'd appreciate if you can
On Mon, Mar 11, 2019 at 01:31:45PM +0100, Pablo Neira Ayuso wrote:
Hi Greg,
Cc'ing sta...@vger.kernel.org.
Subash (he's on Cc) needs these two fixes for 4.19:
f24d2d4f9586985509320f90308723d3d0c4e47f
netfilter: xt_TEE: fix wrong interface selection
18c0ab87364ac5128a152055fdcb1d27e01caf01
net
f the IP_CT_DIR_ORIGINAL tuples are equal.
[ Florian: simplify patch to not use .allow_clash setting
and always ignore identical flows ]
Signed-off-by: Martynas Pumputis
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netf
f the IP_CT_DIR_ORIGINAL tuples are equal.
[ Florian: simplify patch to not use .allow_clash setting
and always ignore identical flows ]
Signed-off-by: Martynas Pumputis
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netf
f the IP_CT_DIR_ORIGINAL tuples are equal.
[ Florian: simplify patch to not use .allow_clash setting
and always ignore identical flows ]
Signed-off-by: Martynas Pumputis
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netf
f the IP_CT_DIR_ORIGINAL tuples are equal.
[ Florian: simplify patch to not use .allow_clash setting
and always ignore identical flows ]
Signed-off-by: Martynas Pumputis
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netf
: Taehee Yoo
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_compat.c | 48 +-
1 file changed, 47 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compa
s: use dedicated mutex to guard
transactions")
Fixes: 0935d5588400 ("netfilter: nf_tables: asynchronous release")
Reported-by: Taehee Yoo
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_compat.c | 16 ++
ter: nf_tables: use dedicated mutex to guard
transactions")
Reported-by: Taehee Yoo
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_compat.c | 129 +
1 file changed, 89 insertion
;setsockopt return %d\n", ret);
return ret;
}
Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
Signed-off-by: ZhangXiaoxu
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs
11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Fernando Fernandez Mancera
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nfnetlink_osf.c | 4
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nfnetlink_osf.c b/
estphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/bridge/netfilter/ebtables.c | 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5e55cef0cec39..6693e209efe80 100644
--
s: use dedicated mutex to guard
transactions")
Fixes: 0935d5588400 ("netfilter: nf_tables: asynchronous release")
Reported-by: Taehee Yoo
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_compat.c | 16 ++
;setsockopt return %d\n", ret);
return ret;
}
Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
Signed-off-by: ZhangXiaoxu
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs
estphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/bridge/netfilter/ebtables.c | 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5e55cef0cec39..6693e209efe80 100644
--
11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Fernando Fernandez Mancera
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nfnetlink_osf.c | 4
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nfnetlink_osf.c b/
;setsockopt return %d\n", ret);
return ret;
}
Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
Signed-off-by: ZhangXiaoxu
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs
estphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/bridge/netfilter/ebtables.c | 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 22e4c15a1fc30..53392ac58b38f 100644
--
;setsockopt return %d\n", ret);
return ret;
}
Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
Signed-off-by: ZhangXiaoxu
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs
;setsockopt return %d\n", ret);
return ret;
}
Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
Signed-off-by: ZhangXiaoxu
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs
;setsockopt return %d\n", ret);
return ret;
}
Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
Signed-off-by: ZhangXiaoxu
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs
ter: nf_tables: use dedicated mutex to guard
transactions")
Reported-by: Taehee Yoo
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_compat.c | 129 +
1 file changed, 89 insertion
ses:
daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
which is 2.2.2.7 in the scenario that is described above, while this
should be:
daddr = ct->tuplehash[dir].tuple.src.u3.ip;
that is 10.0.0.7.
Signed-off-by: wenxu
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
etfilter: nf_tables: add stateful object reference to
set elements")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/n
col udp flow offload @fb1
Signed-off-by: wenxu
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
include/net/netfilter/nf_flow_table.h | 1 -
net/netfilter/nf_flow_table_core.c| 5 +++--
net/netfilter/nft_flow_offload.c | 4 ++--
3 files changed, 5 insertions(+), 5 deleti
nry Yen
Reviewed-by: Ryder Lee
Tested-by: John Crispin
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_flow_offload.c | 5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.
ses:
daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
which is 2.2.2.7 in the scenario that is described above, while this
should be:
daddr = ct->tuplehash[dir].tuple.src.u3.ip;
that is 10.0.0.7.
Signed-off-by: wenxu
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
etfilter: nf_tables: add stateful object reference to
set elements")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/n
col udp flow offload @fb1
Signed-off-by: wenxu
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
include/net/netfilter/nf_flow_table.h | 1 -
net/netfilter/nf_flow_table_core.c| 5 +++--
net/netfilter/nft_flow_offload.c | 4 ++--
3 files changed, 5 insertions(+), 5 deleti
nry Yen
Reviewed-by: Ryder Lee
Tested-by: John Crispin
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nft_flow_offload.c | 5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.
etfilter: nf_tables: add stateful object reference to
set elements")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/n
o Brivio
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Sasha Levin
---
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 10 +-
net/netfilter/ipset/ip_set_hash_ipmac.c | 16 ++--
net/netfilter/ipset/ip_set_hash_mac.c | 10 +-
3 files changed, 20 insertions(+), 16 deletions(
341.227509] cleanup_net+0x45b/0x900
[ ... ]
Fixes: 613d0776d3fe ("netfilter: exit_net cleanup check added")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 1 -
1 file changed, 1 deletion(-)
diff --git
lter_net_exit+0x43/0x80 [iptable_filter]
[ 342.123094] ops_exit_list.isra.10+0x94/0x140
[ 342.123094] cleanup_net+0x45b/0x900
[ ... ]
Fixes: 202f59afd441 ("netfilter: ipt_CLUSTERIP: do not hold dev")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sas
o Brivio
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Sasha Levin
---
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 10 +-
net/netfilter/ipset/ip_set_hash_ipmac.c | 16 ++--
net/netfilter/ipset/ip_set_hash_mac.c | 10 +-
3 files changed, 20 insertions(+), 16 deletions(
lter_net_exit+0x43/0x80 [iptable_filter]
[ 342.123094] ops_exit_list.isra.10+0x94/0x140
[ 342.123094] cleanup_net+0x45b/0x900
[ ... ]
Fixes: 202f59afd441 ("netfilter: ipt_CLUSTERIP: do not hold dev")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sas
--hashmode sourceip \
--clustermac 01:00:5e:00:00:21 --total-nodes 2 --local-node 1
After this patch, above commands are disallowed.
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 3 ++-
1 file changed, 2
341.227509] cleanup_net+0x45b/0x900
[ ... ]
Fixes: 613d0776d3fe ("netfilter: exit_net cleanup check added")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 1 -
1 file changed, 1 deletion(-)
diff --git
--hashmode sourceip \
--clustermac 01:00:5e:00:00:21 --total-nodes 2 --local-node 1
After this patch, above commands are disallowed.
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 3 ++-
1 file changed, 2
--hashmode sourceip \
--clustermac 01:00:5e:00:00:21 --total-nodes 2 --local-node 1
After this patch, above commands are disallowed.
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 3 ++-
1 file changed, 2
[89279.430135] nf_tables_commit+0x2555/0x39c0 [nf_tables]
Fixes: f102d66b335a4 ("netfilter: nf_tables: use dedicated mutex to guard
transactions")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
include/linux/netfilter/nfnetlink.h | 12
, so we must
reaload it to avoid memory corruption.
This bug pre-dates git history.
Reported-by: Neel Mehta
Reported-by: Shane Huntley
Reported-by: Heather Adkins
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conntrack_seqadj.c
, so we must
reaload it to avoid memory corruption.
This bug pre-dates git history.
Reported-by: Neel Mehta
Reported-by: Shane Huntley
Reported-by: Heather Adkins
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conntrack_seqadj.c
on the branch that nla_nest_cancel is not called.
Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump
set in parallel")
Signed-off-by: Pan Bian
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfi
on the branch that nla_nest_cancel is not called.
Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump
set in parallel")
Signed-off-by: Pan Bian
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfi
f7891 ("net: remove DST_NOCACHE flag")
Reported-by: Martin Zaharinov
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_nat_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_nat_c
ilter: nf_conncount: Split insert and traversal")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conncount.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncou
, so we must
reaload it to avoid memory corruption.
This bug pre-dates git history.
Reported-by: Neel Mehta
Reported-by: Shane Huntley
Reported-by: Heather Adkins
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conntrack_seqadj.c
f7891 ("net: remove DST_NOCACHE flag")
Reported-by: Martin Zaharinov
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_nat_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_nat_c
on the branch that nla_nest_cancel is not called.
Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump
set in parallel")
Signed-off-by: Pan Bian
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfi
quot;netfilter: nf_conncount: Switch to plain list")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conncount.c | 18 +++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_conncoun
[nf_tables_set]
[ ... ]
Fixes: 5c789e131cbb ("netfilter: nf_conncount: Add list lock and gc worker, and
RCU for init tree search")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_conncount.c | 7 +--
1 file changed, 5 in
99] lock(&(&list->list_lock)->rlock);
[ 461.998999]
[ 461.998999] *** DEADLOCK ***
[ 461.998999]
[ ... ]
Fixes: 5c789e131cbb ("netfilter: nf_conncount: Add list lock and gc worker, and
RCU for init tree search")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neir
ateest hash table per net")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/xt_RATEEST.c | 10 --
1 file changed, 10 deletions(-)
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index dec843cadf46..9e05c86ba
blo Neira Ayuso
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 5 +++--
net/netfilter/nft_compat.c| 3 ++-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/ne
ned-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/xt_hashlimit.c | 9 +++--
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 3e7d259e5d8d..1ad4017f9b73 100644
stasov
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_ctl.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 62eefea48973..518364f4abcc 100644
--- a/net/n
that sets outgoing
interface through IPV6_PKTINFO ipi6_ifindex
Link-local and multicast packets must keep their original oif after
ip6_route_me_harder is called.
Signed-off-by: Alin Nastac
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv6/netfilter.c | 3 ++-
1 file
counter and sets on the dead flag. Therefore, this if statement
in tree_nodes_free() is unnecessary and wrong.
Fixes: 31568ec09ea0 ("netfilter: nf_conncount: fix list_del corruption in
conn_free")
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
From: Taehee Yoo
[ Upstream commit 584eab291c67894cb17cc87544b9d086228ea70f ]
register_{netdevice/inetaddr/inet6addr}_notifier may return an error
value, this patch adds the code to handle these error paths.
Signed-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha
27073] nf_tables_module_init+0x37/0x92 [nf_tables]
[ ... ]
Fixes: 8dd33cc93ec9 ("netfilter: nf_nat: generalize IPv4 masquerading support
for nf_tables")
Fixes: be6b635cd674 ("netfilter: nf_nat: generalize IPv6 masquerading support
for nf_tables")
Signed-off-by: Taehee Yoo
S
ra Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 15 ---
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 06ed55cef962..fe0558b15fd3 100644
--- a/net/netfilter/nf_tables_api.c
+++
ned-off-by: Taehee Yoo
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/xt_hashlimit.c | 9 +++--
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 0c034597b9b8..fe8e8a1622b5 100644
blo Neira Ayuso
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 5 +++--
net/netfilter/nft_compat.c| 3 ++-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/ne
stasov
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_ctl.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 327ebe786eeb..2f45c3ce77ef 100644
--- a/net/n
that sets outgoing
interface through IPV6_PKTINFO ipi6_ifindex
Link-local and multicast packets must keep their original oif after
ip6_route_me_harder is called.
Signed-off-by: Alin Nastac
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/ipv6/netfilter.c | 3 ++-
1 file
ra Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/nf_tables_api.c | 15 ---
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ea1e57daf50e..623ec29ade26 100644
--- a/net/netfilter/nf_tables_api.c
+++
stasov
Acked-by: Simon Horman
Signed-off-by: Pablo Neira Ayuso
Signed-off-by: Sasha Levin
---
net/netfilter/ipvs/ip_vs_ctl.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 079b3c426720..8382b7880b24 100644
--- a/net/n
1 - 100 of 121 matches
Mail list logo
