linux-stable.git/net/ipv4/netfilter, branch linux-4.5.y

ipv4: Don't do expensive useless work during inetdev destroy.

2016-04-20T06:45:12+00:00

[ Upstream commit fbd40ea0180a2d328c5adc61414dc8bab9335ce2 ]

When an inetdev is destroyed, every address assigned to the interface
is removed.  And in this scenerio we do two pointless things which can
be very expensive if the number of assigned interfaces is large:

1) Address promotion.  We are deleting all addresses, so there is no
   point in doing this.

2) A full nf conntrack table purge for every address.  We only need to
   do this once, as is already caught by the existing
   masq_dev_notifier so masq_inet_event() can skip this.

Reported-by: Solar Designer 
Signed-off-by: David S. Miller 
Tested-by: Cyrill Gorcunov 
Signed-off-by: Greg Kroah-Hartman

inet: frag: Always orphan skbs inside ip_defrag()

2016-01-29T00:00:46+00:00

Later parts of the stack (including fragmentation) expect that there is
never a socket attached to frag in a frag_list, however this invariant
was not enforced on all defrag paths. This could lead to the
BUG_ON(skb->sk) during ip_do_fragment(), as per the call stack at the
end of this commit message.

While the call could be added to openvswitch to fix this particular
error, the head and tail of the frags list are already orphaned
indirectly inside ip_defrag(), so it seems like the remaining fragments
should all be orphaned in all circumstances.

kernel BUG at net/ipv4/ip_output.c:586!
[...]
Call Trace:
 
 [] ? do_output.isra.29+0x1b0/0x1b0 [openvswitch]
 [] ovs_fragment+0xcc/0x214 [openvswitch]
 [] ? dst_discard_out+0x20/0x20
 [] ? dst_ifdown+0x80/0x80
 [] ? find_bucket.isra.2+0x62/0x70 [openvswitch]
 [] ? mod_timer_pending+0x65/0x210
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? nf_conntrack_in+0x252/0x500 [nf_conntrack]
 [] ? __lock_is_held+0x54/0x70
 [] do_output.isra.29+0xe3/0x1b0 [openvswitch]
 [] do_execute_actions+0xe11/0x11f0 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0x32/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0xb2/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? ovs_ct_get_labels+0x49/0x80 [openvswitch]
 [] ovs_vport_receive+0x5d/0xa0 [openvswitch]
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] internal_dev_xmit+0x6c/0x140 [openvswitch]
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] dev_hard_start_xmit+0x2b9/0x5e0
 [] ? netif_skb_features+0xd1/0x1f0
 [] __dev_queue_xmit+0x800/0x930
 [] ? __dev_queue_xmit+0x50/0x930
 [] ? mark_held_locks+0x71/0x90
 [] ? neigh_resolve_output+0x106/0x220
 [] dev_queue_xmit+0x10/0x20
 [] neigh_resolve_output+0x178/0x220
 [] ? ip_finish_output2+0x1ff/0x590
 [] ip_finish_output2+0x1ff/0x590
 [] ? ip_finish_output2+0x7e/0x590
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] icmp_push_reply+0xea/0x120
 [] icmp_reply.constprop.23+0x1ed/0x230
 [] icmp_echo.part.21+0x4e/0x50
 [] ? __lock_is_held+0x54/0x70
 [] ? rcu_read_lock_held+0x5e/0x70
 [] icmp_echo+0x36/0x70
 [] icmp_rcv+0x271/0x450
 [] ip_local_deliver_finish+0x127/0x3a0
 [] ? ip_local_deliver_finish+0x41/0x3a0
 [] ip_local_deliver+0x60/0xd0
 [] ? ip_rcv_finish+0x560/0x560
 [] ip_rcv_finish+0xdd/0x560
 [] ip_rcv+0x283/0x3e0
 [] ? match_held_lock+0x192/0x200
 [] ? inet_del_offload+0x40/0x40
 [] __netif_receive_skb_core+0x392/0xae0
 [] ? process_backlog+0x8e/0x230
 [] ? mark_held_locks+0x71/0x90
 [] __netif_receive_skb+0x18/0x60
 [] process_backlog+0x78/0x230
 [] ? process_backlog+0xdd/0x230
 [] net_rx_action+0x155/0x400
 [] __do_softirq+0xcc/0x420
 [] ? ip_finish_output2+0x217/0x590
 [] do_softirq_own_stack+0x1c/0x30
 
 [] do_softirq+0x4e/0x60
 [] __local_bh_enable_ip+0xa8/0xb0
 [] ip_finish_output2+0x240/0x590
 [] ? ip_do_fragment+0x831/0x8a0
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] raw_sendmsg+0x7d3/0xc30
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? inet_sendmsg+0xc7/0x1d0
 [] ? __lock_is_held+0x54/0x70
 [] inet_sendmsg+0x10a/0x1d0
 [] ? inet_sendmsg+0x5/0x1d0
 [] sock_sendmsg+0x38/0x50
 [] ___sys_sendmsg+0x25f/0x270
 [] ? handle_mm_fault+0x8dd/0x1320
 [] ? _raw_spin_unlock+0x27/0x40
 [] ? __do_page_fault+0x1e2/0x460
 [] ? __fget_light+0x66/0x90
 [] __sys_sendmsg+0x42/0x80
 [] SyS_sendmsg+0x12/0x20
 [] entry_SYSCALL_64_fastpath+0x12/0x6f
Code: 00 00 44 89 e0 e9 7c fb ff ff 4c 89 ff e8 e7 e7 ff ff 41 8b 9d 80 00 00 00 2b 5d d4 89 d8 c1 f8 03 0f b7 c0 e9 33 ff ff f
 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48
RIP  [] ip_do_fragment+0x892/0x8a0
 RSP 

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Signed-off-by: Joe Stringer 
Signed-off-by: David S. Miller

netfilter: nf_tables: release objects on netns destruction

2015-12-28T17:34:35+00:00

We have to release the existing objects on netns removal otherwise we
leak them. Chains are unregistered in first place to make sure no
packets are walking on our rules and sets anymore.

The object release happens by when we unregister the family via
nft_release_afinfo() which is called from nft_unregister_afinfo() from
the corresponding __net_exit path in every family.

Reported-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2015-12-18T20:37:42+00:00

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains the first batch of Netfilter updates for
the upcoming 4.5 kernel. This batch contains userspace netfilter header
compilation fixes, support for packet mangling in nf_tables, the new
tracing infrastructure for nf_tables and cgroup2 support for iptables.
More specifically, they are:

1) Two patches to include dependencies in our netfilter userspace
   headers to resolve compilation problems, from Mikko Rapeli.

2) Four comestic cleanup patches for the ebtables codebase, from Ian Morris.

3) Remove duplicate include in the netfilter reject infrastructure,
   from Stephen Hemminger.

4) Two patches to simplify the netfilter defragmentation code for IPv6,
   patch from Florian Westphal.

5) Fix root ownership of /proc/net netfilter for unpriviledged net
   namespaces, from Philip Whineray.

6) Get rid of unused fields in struct nft_pktinfo, from Florian Westphal.

7) Add mangling support to our nf_tables payload expression, from
   Patrick McHardy.

8) Introduce a new netlink-based tracing infrastructure for nf_tables,
   from Florian Westphal.

9) Change setter functions in nfnetlink_log to be void, from
    Rami Rosen.

10) Add netns support to the cttimeout infrastructure.

11) Add cgroup2 support to iptables, from Tejun Heo.

12) Introduce nfnl_dereference_protected() in nfnetlink, from Florian.

13) Add support for mangling pkttype in the nf_tables meta expression,
    also from Florian.

BTW, I need that you pull net into net-next, I have another batch that
requires changes that I don't yet see in net.
====================

Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-12-18T03:08:28+00:00

Conflicts:
	drivers/net/geneve.c

Here we had an overlapping change, where in 'net' the extraneous stats
bump was being removed whilst in 'net-next' the final argument to
udp_tunnel6_xmit_skb() was being changed.

Signed-off-by: David S. Miller

net: Eliminate NETIF_F_GEN_CSUM and NETIF_F_V[46]_CSUM

2015-12-15T21:50:20+00:00

These netif flags are unnecessary convolutions. It is more
straightforward to just use NETIF_F_HW_CSUM, NETIF_F_IP_CSUM,
and NETIF_F_IPV6_CSUM directly.

This patch also:
    - Cleans up can_checksum_protocol
    - Simplifies netdev_intersect_features

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

netfilter: nf_dup: add missing dependencies with NF_CONNTRACK

2015-12-10T17:17:06+00:00

CONFIG_NF_CONNTRACK=m
CONFIG_NF_DUP_IPV4=y

results in:

   net/built-in.o: In function `nf_dup_ipv4':
>> (.text+0xd434f): undefined reference to `nf_conntrack_untracked'

Reported-by: kbuild test robot 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove duplicate include

2015-11-23T16:54:43+00:00

Signed-off-by: Stephen Hemminger 
Signed-off-by: Pablo Neira Ayuso

net ipv4: use preferred log methods

2015-11-18T18:37:20+00:00

Replace printk calls with preferred unconditional log method calls to keep
kernel messages clean.

Added newline to "too small MTU" message.

Signed-off-by: Bastian Stender 
Signed-off-by: David S. Miller

netfilter: Fix removal of GRE expectation entries created by PPTP

2015-11-09T12:32:14+00:00

The uninitialized tuple structure caused incorrect hash calculation
and the lookup failed.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=106441
Signed-off-by: Anthony Lineham 
Signed-off-by: Pablo Neira Ayuso