From: Pablo Neira Ayuso <pablo@netfilter.org>
Hi David,
The following patchset contain fixes for your net tree, they are:
* Fix wrong type for NFULA_HWTYPE attribute, this was introduced while
removing the NLA_PUT macro, from Patrick McHardy.
* Three fixes that spot incorrect return values in the initialization
path of several Netfilter modules, from Julia Lawall.
* Fix crash in the SIP helper if we hit EBUSY while adding the RTCP
expectation, from myself.
* Fix racy timer handling in case conntrackd is running in reliable
event mode, also from myself.
You can pull these changes from:
git://1984.lsi.us.es/nf master
BTW, please merge net to net-next after this so I can resolve the
conflict between the SIP helper and NAT IPv6 changes from Patrick,
which is scheduled for net-next.
Thanks!
Julia Lawall (3):
ipvs: fix error return code
netfilter: ctnetlink: fix error return code in init path
netfilter: nfnetlink_log: fix error return code in init path
Pablo Neira Ayuso (2):
netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation
netfilter: nf_conntrack: fix racy timer handling with reliable events
Patrick McHardy (1):
netfilter: nfnetlink_log: fix NLA_PUT macro removal bug
include/net/netfilter/nf_conntrack_ecache.h | 1 +
net/ipv4/netfilter/nf_nat_sip.c | 5 ++++-
net/netfilter/ipvs/ip_vs_ctl.c | 4 +++-
net/netfilter/nf_conntrack_core.c | 16 +++++++++++-----
net/netfilter/nf_conntrack_netlink.c | 3 ++-
net/netfilter/nfnetlink_log.c | 6 ++++--
6 files changed, 25 insertions(+), 10 deletions(-)
--
1.7.10.4
From: Julia Lawall <redacted>
Initialize return variable before exiting on an error path.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_netlink.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
From: Julia Lawall <redacted>
Initialize return variable before exiting on an error path.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink_log.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
From: Julia Lawall <redacted>
Initialize return variable before exiting on an error path.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
{ ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
when != &ret
*if(...)
{
... when != ret = e2
when forall
return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <redacted>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_ctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
@@ -1171,8 +1171,10 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,gotoout_err;}svc->stats.cpustats=alloc_percpu(structip_vs_cpu_stats);-if(!svc->stats.cpustats)+if(!svc->stats.cpustats){+ret=-ENOMEM;gotoout_err;+}/* I'm the first user of the service */atomic_set(&svc->usecnt,0);
From: Pablo Neira Ayuso <pablo@netfilter.org>
Existing code assumes that del_timer returns true for alive conntrack
entries. However, this is not true if reliable events are enabled.
In that case, del_timer may return true for entries that were
just inserted in the dying list. Note that packets / ctnetlink may
hold references to conntrack entries that were just inserted to such
list.
This patch fixes the issue by adding an independent timer for
event delivery. This increases the size of the ecache extension.
Still we can revisit this later and use variable size extensions
to allocate this area on demand.
Tested-by: Oliver Smith <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_ecache.h | 1 +
net/netfilter/nf_conntrack_core.c | 16 +++++++++++-----
2 files changed, 12 insertions(+), 5 deletions(-)
@@ -18,6 +18,7 @@ struct nf_conntrack_ecache {u16ctmask;/* bitmask of ct events to be delivered */u16expmask;/* bitmask of expect events to be delivered */u32pid;/* netlink pid of destroyer */+structtimer_listtimeout;};staticinlinestructnf_conntrack_ecache*
@@ -249,12 +249,15 @@ static void death_by_event(unsigned long ul_conntrack){structnf_conn*ct=(void*)ul_conntrack;structnet*net=nf_ct_net(ct);+structnf_conntrack_ecache*ecache=nf_ct_ecache_find(ct);++BUG_ON(ecache==NULL);if(nf_conntrack_event(IPCT_DESTROY,ct)<0){/* bad luck, let's retry again */-ct->timeout.expires=jiffies++ecache->timeout.expires=jiffies+(random32()%net->ct.sysctl_events_retry_timeout);-add_timer(&ct->timeout);+add_timer(&ecache->timeout);return;}/* we've got the event delivered, now it's dying */
@@ -268,6 +271,9 @@ static void death_by_event(unsigned long ul_conntrack)voidnf_ct_insert_dying_list(structnf_conn*ct){structnet*net=nf_ct_net(ct);+structnf_conntrack_ecache*ecache=nf_ct_ecache_find(ct);++BUG_ON(ecache==NULL);/* add this conntrack to the dying list */spin_lock_bh(&nf_conntrack_lock);
@@ -275,10 +281,10 @@ void nf_ct_insert_dying_list(struct nf_conn *ct)&net->ct.dying);spin_unlock_bh(&nf_conntrack_lock);/* set a new timer to retry event delivery */-setup_timer(&ct->timeout,death_by_event,(unsignedlong)ct);-ct->timeout.expires=jiffies++setup_timer(&ecache->timeout,death_by_event,(unsignedlong)ct);+ecache->timeout.expires=jiffies+(random32()%net->ct.sysctl_events_retry_timeout);-add_timer(&ct->timeout);+add_timer(&ecache->timeout);}EXPORT_SYMBOL_GPL(nf_ct_insert_dying_list);
From: David Miller <davem@davemloft.net> Date: 2012-08-31 19:15:26
From: pablo@netfilter.org
Date: Fri, 31 Aug 2012 16:03:03 +0200
You can pull these changes from:
git://1984.lsi.us.es/nf master
Pulled.
BTW, please merge net to net-next after this so I can resolve the
conflict between the SIP helper and NAT IPv6 changes from Patrick,
which is scheduled for net-next.