Skip to content

Commit 2aa2f88

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Incorrect output device in nf_egress hook, from Phill Sutter. 2) Preserve liberal flag in TCP conntrack state, reported by Sven Auhagen. 3) Use GFP_KERNEL_ACCOUNT flag for nf_tables objects, from Vasily Averin. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents bcb74e1 + 33758c8 commit 2aa2f88

4 files changed

Lines changed: 37 additions & 28 deletions

File tree

‎include/linux/netfilter_netdev.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc,
9999
return skb;
100100

101101
nf_hook_state_init(&state, NF_NETDEV_EGRESS,
102-
NFPROTO_NETDEV, dev, NULL, NULL,
102+
NFPROTO_NETDEV, NULL, dev, NULL,
103103
dev_net(dev), NULL);
104104

105105
/* nf assumes rcu_read_lock, not just read_lock_bh */

‎net/netfilter/core.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ static struct nf_hook_entries *allocate_hook_entries_size(u16 num)
5858
if (num == 0)
5959
return NULL;
6060

61-
e = kvzalloc(alloc, GFP_KERNEL);
61+
e = kvzalloc(alloc, GFP_KERNEL_ACCOUNT);
6262
if (e)
6363
e->num_hook_entries = num;
6464
return e;

‎net/netfilter/nf_conntrack_proto_tcp.c‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -341,8 +341,8 @@ static void tcp_options(const struct sk_buff *skb,
341341
if (!ptr)
342342
return;
343343

344-
state->td_scale =
345-
state->flags = 0;
344+
state->td_scale = 0;
345+
state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
346346

347347
while (length > 0) {
348348
int opcode=*ptr++;
@@ -862,6 +862,16 @@ static bool tcp_can_early_drop(const struct nf_conn *ct)
862862
return false;
863863
}
864864

865+
static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
866+
{
867+
state->td_end = 0;
868+
state->td_maxend = 0;
869+
state->td_maxwin = 0;
870+
state->td_maxack = 0;
871+
state->td_scale = 0;
872+
state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
873+
}
874+
865875
/* Returns verdict for packet, or -1 for invalid. */
866876
int nf_conntrack_tcp_packet(struct nf_conn *ct,
867877
struct sk_buff *skb,
@@ -968,8 +978,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
968978
ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
969979
ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
970980
ct->proto.tcp.last_flags;
971-
memset(&ct->proto.tcp.seen[dir], 0,
972-
sizeof(struct ip_ct_tcp_state));
981+
nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
973982
break;
974983
}
975984
ct->proto.tcp.last_index = index;

‎net/netfilter/nf_tables_api.c‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1192,16 +1192,16 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
11921192
}
11931193

11941194
err = -ENOMEM;
1195-
table = kzalloc(sizeof(*table), GFP_KERNEL);
1195+
table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT);
11961196
if (table == NULL)
11971197
goto err_kzalloc;
11981198

1199-
table->name = nla_strdup(attr, GFP_KERNEL);
1199+
table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT);
12001200
if (table->name == NULL)
12011201
goto err_strdup;
12021202

12031203
if (nla[NFTA_TABLE_USERDATA]) {
1204-
table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);
1204+
table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT);
12051205
if (table->udata == NULL)
12061206
goto err_table_udata;
12071207

@@ -1882,7 +1882,7 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
18821882
struct nft_hook *hook;
18831883
int err;
18841884

1885-
hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1885+
hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT);
18861886
if (!hook) {
18871887
err = -ENOMEM;
18881888
goto err_hook_alloc;
@@ -2105,7 +2105,7 @@ static struct nft_rule_blob *nf_tables_chain_alloc_rules(unsigned int size)
21052105
if (size > INT_MAX)
21062106
return NULL;
21072107

2108-
blob = kvmalloc(size, GFP_KERNEL);
2108+
blob = kvmalloc(size, GFP_KERNEL_ACCOUNT);
21092109
if (!blob)
21102110
return NULL;
21112111

@@ -2205,7 +2205,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
22052205
if (err < 0)
22062206
return err;
22072207

2208-
basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
2208+
basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT);
22092209
if (basechain == NULL) {
22102210
nft_chain_release_hook(&hook);
22112211
return -ENOMEM;
@@ -2235,7 +2235,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
22352235
if (flags & NFT_CHAIN_HW_OFFLOAD)
22362236
return -EOPNOTSUPP;
22372237

2238-
chain = kzalloc(sizeof(*chain), GFP_KERNEL);
2238+
chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT);
22392239
if (chain == NULL)
22402240
return -ENOMEM;
22412241

@@ -2248,15 +2248,15 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
22482248
chain->table = table;
22492249

22502250
if (nla[NFTA_CHAIN_NAME]) {
2251-
chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2251+
chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT);
22522252
} else {
22532253
if (!(flags & NFT_CHAIN_BINDING)) {
22542254
err = -EINVAL;
22552255
goto err_destroy_chain;
22562256
}
22572257

22582258
snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
2259-
chain->name = kstrdup(name, GFP_KERNEL);
2259+
chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT);
22602260
}
22612261

22622262
if (!chain->name) {
@@ -2265,7 +2265,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
22652265
}
22662266

22672267
if (nla[NFTA_CHAIN_USERDATA]) {
2268-
chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
2268+
chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT);
22692269
if (chain->udata == NULL) {
22702270
err = -ENOMEM;
22712271
goto err_destroy_chain;
@@ -2428,7 +2428,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
24282428
char *name;
24292429

24302430
err = -ENOMEM;
2431-
name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2431+
name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT);
24322432
if (!name)
24332433
goto err;
24342434

@@ -2876,7 +2876,7 @@ static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
28762876
goto err1;
28772877

28782878
err = -ENOMEM;
2879-
expr = kzalloc(expr_info.ops->size, GFP_KERNEL);
2879+
expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT);
28802880
if (expr == NULL)
28812881
goto err2;
28822882

@@ -3484,7 +3484,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
34843484
}
34853485

34863486
err = -ENOMEM;
3487-
rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
3487+
rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT);
34883488
if (rule == NULL)
34893489
goto err_release_expr;
34903490

@@ -3897,7 +3897,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
38973897
free_page((unsigned long)inuse);
38983898
}
38993899

3900-
set->name = kasprintf(GFP_KERNEL, name, min + n);
3900+
set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n);
39013901
if (!set->name)
39023902
return -ENOMEM;
39033903

@@ -4461,11 +4461,11 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
44614461
alloc_size = sizeof(*set) + size + udlen;
44624462
if (alloc_size < size || alloc_size > INT_MAX)
44634463
return -ENOMEM;
4464-
set = kvzalloc(alloc_size, GFP_KERNEL);
4464+
set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT);
44654465
if (!set)
44664466
return -ENOMEM;
44674467

4468-
name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4468+
name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT);
44694469
if (!name) {
44704470
err = -ENOMEM;
44714471
goto err_set_name;
@@ -6000,7 +6000,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
60006000
err = -ENOMEM;
60016001
elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
60026002
elem.key_end.val.data, elem.data.val.data,
6003-
timeout, expiration, GFP_KERNEL);
6003+
timeout, expiration, GFP_KERNEL_ACCOUNT);
60046004
if (elem.priv == NULL)
60056005
goto err_parse_data;
60066006

@@ -6244,7 +6244,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
62446244
err = -ENOMEM;
62456245
elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
62466246
elem.key_end.val.data, NULL, 0, 0,
6247-
GFP_KERNEL);
6247+
GFP_KERNEL_ACCOUNT);
62486248
if (elem.priv == NULL)
62496249
goto fail_elem;
62506250

@@ -6556,7 +6556,7 @@ static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
65566556
}
65576557

65586558
err = -ENOMEM;
6559-
obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
6559+
obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT);
65606560
if (!obj)
65616561
goto err2;
65626562

@@ -6722,7 +6722,7 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
67226722
obj->key.table = table;
67236723
obj->handle = nf_tables_alloc_handle(table);
67246724

6725-
obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
6725+
obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT);
67266726
if (!obj->key.name) {
67276727
err = -ENOMEM;
67286728
goto err_strdup;
@@ -7483,15 +7483,15 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
74837483

74847484
nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
74857485

7486-
flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
7486+
flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT);
74877487
if (!flowtable)
74887488
return -ENOMEM;
74897489

74907490
flowtable->table = table;
74917491
flowtable->handle = nf_tables_alloc_handle(table);
74927492
INIT_LIST_HEAD(&flowtable->hook_list);
74937493

7494-
flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
7494+
flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT);
74957495
if (!flowtable->name) {
74967496
err = -ENOMEM;
74977497
goto err1;

0 commit comments

Comments
 (0)