linux-toradex.git/net/netfilter, branch v3.9.6

ipvs: ip_vs_sip_fill_param() BUG: bad check of return value

2013-05-11T14:18:22+00:00

commit f7a1dd6e3ad59f0cfd51da29dfdbfd54122c5916 upstream.

The reason for this patch is crash in kmemdup
caused by returning from get_callid with uniialized
matchoff and matchlen.

Removing Zero check of matchlen since it's done by ct_sip_get_header()

BUG: unable to handle kernel paging request at ffff880457b5763f
IP: [] kmemdup+0x2e/0x35
PGD 27f6067 PUD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: xt_state xt_helper nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle xt_connmark xt_conntrack ip6_tables nf_conntrack_ftp ip_vs_ftp nf_nat xt_tcpudp iptable_mangle xt_mark ip_tables x_tables ip_vs_rr ip_vs_lblcr ip_vs_pe_sip ip_vs nf_conntrack_sip nf_conntrack bonding igb i2c_algo_bit i2c_core
CPU 5
Pid: 0, comm: swapper/5 Not tainted 3.9.0-rc5+ #5                  /S1200KP
RIP: 0010:[]  [] kmemdup+0x2e/0x35
RSP: 0018:ffff8803fea03648  EFLAGS: 00010282
RAX: ffff8803d61063e0 RBX: 0000000000000003 RCX: 0000000000000003
RDX: 0000000000000003 RSI: ffff880457b5763f RDI: ffff8803d61063e0
RBP: ffff8803fea03658 R08: 0000000000000008 R09: 0000000000000011
R10: 0000000000000011 R11: 00ffffffff81a8a3 R12: ffff880457b5763f
R13: ffff8803d67f786a R14: ffff8803fea03730 R15: ffffffffa0098e90
FS:  0000000000000000(0000) GS:ffff8803fea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff880457b5763f CR3: 0000000001a0c000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper/5 (pid: 0, threadinfo ffff8803ee18c000, task ffff8803ee18a480)
Stack:
 ffff8803d822a080 000000000000001c ffff8803fea036c8 ffffffffa000937a
 ffffffff81f0d8a0 000000038135fdd5 ffff880300000014 ffff880300110000
 ffffffff150118ac ffff8803d7e8a000 ffff88031e0118ac 0000000000000000
Call Trace:
 

 [] ip_vs_sip_fill_param+0x13a/0x187 [ip_vs_pe_sip]
 [] ip_vs_sched_persist+0x2c6/0x9c3 [ip_vs]
 [] ? __lock_acquire+0x677/0x1697
 [] ? native_sched_clock+0x3c/0x7d
 [] ? native_sched_clock+0x3c/0x7d
 [] ? sched_clock_cpu+0x43/0xcf
 [] ip_vs_schedule+0x181/0x4ba [ip_vs]
...

Signed-off-by: Hans Schillstrom 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: David S. Miller 
Cc: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: ipset: bitmap:ip,mac: fix listing with timeout

2013-04-18T21:40:41+00:00

The type when timeout support was enabled, could not list all elements,
just the first ones which could fit into one netlink message: it just
did not continue listing after the first message.

Reported-by: Yoann JUET 
Signed-off-by: Jozsef Kadlecsik 
Tested-by: Yoann JUET 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: fix race when unloading protocol modules

2013-04-12T09:46:31+00:00

following oops was reported:
RIP: 0010:[]  [] nf_nat_cleanup_conntrack+0x42/0x70 [nf_nat]
RSP: 0018:ffff880202c63d40  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801ac7bec28 RCX: ffff8801d0eedbe0
RDX: dead000000200200 RSI: 0000000000000011 RDI: ffffffffa03265b8
[..]
Call Trace:
 [..]
 [] destroy_conntrack+0xbd/0x110 [nf_conntrack]

Happens when a conntrack timeout expires right after first part
of the nat cleanup has completed (bysrc hash removal), but before
part 2 has completed (re-initialization of nat area).

[ destroy callback tries to delete bysrc again ]

Patrick suggested to just remove the affected conntracks -- the
connections won't work properly anyway without nat transformation.

So, lets do that.

Reported-by: CAI Qian 
Cc: Patrick McHardy 
Signed-off-by: Florian Westphal 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: hash:net: nomatch flag not excluded on set resize

2013-04-09T19:04:16+00:00

If a resize is triggered the nomatch flag is not excluded at hashing,
which leads to the element missed at lookup in the resized set.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: list:set: fix reference counter update

2013-04-09T19:02:11+00:00

The last element can be replaced or pushed off and in both
cases the reference counter must be updated.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet

2013-04-06T12:03:18+00:00

Some Cisco phones create huge messages that are spread over multiple packets.
After calculating the offset of the SIP body, it is validated to be within
the packet and the packet is dropped otherwise. This breaks operation of
these phones. Since connection tracking is supposed to be passive, just let
those packets pass unmodified and untracked.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack: fix error return code

2013-03-27T17:31:17+00:00

Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in function
nf_conntrack_standalone_init().

Signed-off-by: Wei Yongjun 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_acct: return -EINVAL if object name is empty

2013-03-25T13:21:30+00:00

If user-space tries to create accounting object with an empty
name, then return -EINVAL.

Reported-by: Michael Zintakis 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_queue: fix error return code in nfnetlink_queue_init()

2013-03-25T13:21:27+00:00

Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in this function.

Signed-off-by: Wei Yongjun 
Signed-off-by: Pablo Neira Ayuso

ipvs: remove extra rcu lock

2013-03-19T12:21:52+00:00

In 3.7 we added code that uses ipv4_update_pmtu but after commit
c5ae7d4192 (ipv4: must use rcu protection while calling fib_lookup)
the RCU lock is not needed.

Signed-off-by: Julian Anastasov 
Signed-off-by: Simon Horman