linux-toradex.git/net/netfilter, branch v3.14.7

netfilter: nfnetlink: Fix use after free when it fails to process batch

2014-06-11T18:54:14+00:00

commit ecd15dd7e45f3683fa8142b9f2c015dfaa0c243d upstream.

This bug manifests when calling the nft command line tool without
nf_tables kernel support.

kernel message:
[   44.071555] Netfilter messages via NETLINK v0.30.
[   44.072253] BUG: unable to handle kernel NULL pointer dereference at 0000000000000119
[   44.072264] IP: [] netlink_getsockbyportid+0xf/0x70
[   44.072272] PGD 7f2b74067 PUD 7f2b73067 PMD 0
[   44.072277] Oops: 0000 [#1] SMP
[...]
[   44.072369] Call Trace:
[   44.072373]  [] netlink_unicast+0x91/0x200
[   44.072377]  [] netlink_ack+0x99/0x110
[   44.072381]  [] nfnetlink_rcv+0x3c1/0x408 [nfnetlink]
[   44.072385]  [] netlink_unicast+0xf3/0x200
[   44.072389]  [] netlink_sendmsg+0x2ff/0x740
[   44.072394]  [] ? __mmdrop+0x62/0x90
[   44.072398]  [] sock_sendmsg+0x8b/0xc0
[   44.072403]  [] ? copy_user_enhanced_fast_string+0x5/0x10
[   44.072406]  [] ? move_addr_to_kernel+0x2c/0x50
[   44.072410]  [] ___sys_sendmsg+0x3c3/0x3d0
[   44.072415]  [] ? handle_mm_fault+0xa9a/0xc60
[   44.072420]  [] ? mmap_region+0x166/0x5a0
[   44.072424]  [] ? __do_page_fault+0x1dc/0x510
[   44.072428]  [] ? apparmor_capable+0x1c/0x60
[   44.072435]  [] ? _raw_spin_unlock_bh+0x1a/0x20
[   44.072439]  [] ? release_sock+0x106/0x150
[   44.072443]  [] __sys_sendmsg+0x42/0x80
[   44.072446]  [] SyS_sendmsg+0x12/0x20
[   44.072450]  [] system_call_fastpath+0x1a/0x1f

Signed-off-by: Denys Fedoryshchenko 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_tables: set names cannot be larger than 15 bytes

2014-05-31T20:20:28+00:00

commit a9bdd8365684810e3de804f8c51e52c26a5eccbb upstream.

Currently, nf_tables trims off the set name if it exceeeds 15
bytes, so explicitly reject set names that are too large.

Reported-by: Giuseppe Longo 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4

2014-05-31T20:20:27+00:00

commit b855d416dc17061ebb271ea7ef1201d100531770 upstream.

nft_cmp_fast is used for equality comparisions of size <= 4. For
comparisions of size < 4 byte a mask is calculated that is applied to
both the data from userspace (during initialization) and the register
value (during runtime). Both values are stored using (in effect) memcpy
to a memory area that is then interpreted as u32 by nft_cmp_fast.

This works fine on little endian since smaller types have the same base
address, however on big endian this is not true and the smaller types
are interpreted as a big number with trailing zero bytes.

The mask therefore must not include the lower bytes, but the higher bytes
on big endian. Add a helper function that does a cpu_to_le32 to switch
the bytes on big endian. Since we're dealing with a mask of just consequitive
bits, this works out fine.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors

2014-03-27T19:29:38+00:00

skb_zerocopy can copy elements of the frags array between skbs, but it doesn't
orphan them. Also, it doesn't handle errors, so this patch takes care of that
as well, and modify the callers accordingly. skb_tx_error() is also added to
the callers so they will signal the failed delivery towards the creator of the
skb.

Signed-off-by: Zoltan Kiss 
Signed-off-by: David S. Miller

netfilter: ctnetlink: force null nat binding on insert

2014-02-17T23:13:51+00:00

Quoting Andrey Vagin:
  When a conntrack is created  by kernel, it is initialized (sets
  IPS_{DST,SRC}_NAT_DONE_BIT bits in nf_nat_setup_info) and only then it
  is added in hashes (__nf_conntrack_hash_insert), so one conntract
  can't be initialized from a few threads concurrently.

  ctnetlink can add an uninitialized conntrack (w/o
  IPS_{DST,SRC}_NAT_DONE_BIT) in hashes, then a few threads can look up
  this conntrack and start initialize it concurrently. It's dangerous,
  because BUG can be triggered from nf_nat_setup_info.

Fix this race by always setting up nat, even if no CTA_NAT_ attribute
was requested before inserting the ct into the hash table. In absence
of CTA_NAT_ attribute, a null binding is created.

This alters current behaviour: Before this patch, the first packet
matching the newly injected conntrack would be run through the nat
table since nf_nat_initialized() returns false.  IOW, this forces
ctnetlink users to specify the desired nat transformation on ct
creation time.

Thanks for Florian Westphal, this patch is based on his original
patch to address this problem, including this patch description.

Reported-By: Andrey Vagin 
Signed-off-by: Pablo Neira Ayuso 
Acked-by: Florian Westphal

netfilter: nf_tables: check if payload length is a power of 2

2014-02-17T10:21:17+00:00

Add a check if payload's length is a power of 2 when selecting ops.
The fast ops were meant for well aligned loads, also this fixes a
small bug when using a length of 3 with some offsets which causes
only 1 byte to be loaded because the fast ops are chosen.

Signed-off-by: Nikolay Aleksandrov 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_meta: fix typo "CONFIG_NET_CLS_ROUTE"

2014-02-14T10:37:34+00:00

There are two checks for CONFIG_NET_CLS_ROUTE, but the corresponding
Kconfig symbol was dropped in v2.6.39. Since the code guards access to
dst_entry.tclassid it seems CONFIG_IP_ROUTE_CLASSID should be used
instead.

Signed-off-by: Paul Bolle 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_reject_inet: fix unintended fall-through in switch-statatement

2014-02-14T10:37:33+00:00

For IPv4 packets, we call both IPv4 and IPv6 reject.

Reported-by: Dave Jones 
Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

net: Include appropriate header file in netfilter/nft_lookup.c

2014-02-10T01:32:50+00:00

Include appropriate header file net/netfilter/nf_tables_core.h in
net/netfilter/nft_lookup.c because it has prototype declaration of
functions defined in net/netfilter/nft_lookup.c.

This eliminates the following warning in net/netfilter/nft_lookup.c:
net/netfilter/nft_lookup.c:133:12: warning: no previous prototype for ‘nft_lookup_module_init’ [-Wmissing-prototypes]
net/netfilter/nft_lookup.c:138:6: warning: no previous prototype for ‘nft_lookup_module_exit’ [-Wmissing-prototypes]

Signed-off-by: Rashika Kheria 
Reviewed-by: Josh Triplett 
Signed-off-by: David S. Miller

netfilter: nf_tables: unininline nft_trace_packet()

2014-02-07T16:50:27+00:00

It makes no sense to inline a rarely used function meant for debugging
only that is called a total of five times in the main evaluation loop.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso