linux-toradex.git/net/netfilter, branch v3.3.5

netfilter: ctnetlink: fix race between delete and timeout expiration

2012-03-17T08:47:08+00:00

Kerin Millar reported hardlockups while running `conntrackd -c'
in a busy firewall. That system (with several processors) was
acting as backup in a primary-backup setup.

After several tries, I found a race condition between the deletion
operation of ctnetlink and timeout expiration. This patch fixes
this problem.

Tested-by: Kerin Millar 
Reported-by: Kerin Millar 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: nf_conntrack: fix early_drop with reliable event delivery

2012-03-06T19:43:50+00:00

If reliable event delivery is enabled and ctnetlink fails to deliver
the destroy event in early_drop, the conntrack subsystem cannot
drop any the candidate flow that was planned to be evicted.

Reported-by: Kerin Millar 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: ctnetlink: remove incorrect spin_[un]lock_bh on NAT module autoload

2012-03-06T19:43:49+00:00

Since 7d367e0, ctnetlink_new_conntrack is called without holding
the nf_conntrack_lock spinlock. Thus, ctnetlink_parse_nat_setup
does not require to release that spinlock anymore in the NAT module
autoload case.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

netfilter: ctnetlink: fix soft lockup when netlink adds new entries (v2)

2012-02-24T11:24:15+00:00

Marcell Zambo and Janos Farago noticed and reported that when
new conntrack entries are added via netlink and the conntrack table
gets full, soft lockup happens. This is because the nf_conntrack_lock
is held while nf_conntrack_alloc is called, which is in turn wants
to lock nf_conntrack_lock while evicting entries from the full table.

The patch fixes the soft lockup with limiting the holding of the
nf_conntrack_lock to the minimum, where it's absolutely required.
It required to extend (and thus change) nf_conntrack_hash_insert
so that it makes sure conntrack and ctnetlink do not add the same entry
twice to the conntrack table.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

Revert "netfilter: ctnetlink: fix soft lockup when netlink adds new entries"

2012-02-24T11:19:57+00:00

This reverts commit af14cca162ddcdea017b648c21b9b091e4bf1fa4.

This patch contains a race condition between packets and ctnetlink
in the conntrack addition. A new patch to fix this issue follows up.

Signed-off-by: Pablo Neira Ayuso

Merge branch 'nf' of git://1984.lsi.us.es/net

2012-02-23T05:20:14+00:00

netfilter: ip6_route_output() never returns NULL.

2012-02-22T20:30:15+00:00

ip6_route_output() never returns NULL, so it is wrong to
check if the return value is NULL.

Signed-off-by: RongQing.Li 
Signed-off-by: David S. Miller

netfilter: ctnetlink: fix soft lockup when netlink adds new entries

2012-02-21T15:25:31+00:00

Marcell Zambo and Janos Farago noticed and reported that when
new conntrack entries are added via netlink and the conntrack table
gets full, soft lockup happens. This is because the nf_conntrack_lock
is held while nf_conntrack_alloc is called, which is in turn wants
to lock nf_conntrack_lock while evicting entries from the full table.

The patch fixes the soft lockup with limiting the holding of the
nf_conntrack_lock to the minimum, where it's absolutely required.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_queue: fix queueing of bridged gro skbs

2012-02-09T19:47:53+00:00

When trying to nf_queue GRO/GSO skbs, nf_queue uses skb_gso_segment
to split the skb.

However, if nf_queue is called via bridge netfilter, the mac header
won't be preserved -- packets will thus contain a bogus mac header.

Fix this by setting skb->data to the mac header when skb->nf_bridge
is set and restoring skb->data afterwards for all segments.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

ipvs: fix matching of fwmark templates during scheduling

2012-02-04T19:27:58+00:00

	Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
moved the fwmark variable in subcontext that is invalidated before
reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer
in the param structure make sure the fwmark variable is in
same context. As the fwmark templates can not be matched,
more and more template connections are created and the
controlled connections can not go to single real server.

Signed-off-by: Julian Anastasov 
Cc: stable@vger.kernel.org
Signed-off-by: Simon Horman 
Signed-off-by: Pablo Neira Ayuso