linux-stable.git/net/ipv4/netfilter, branch v4.4.4

inet: frag: Always orphan skbs inside ip_defrag()

2016-03-03T23:07:04+00:00

[ Upstream commit 8282f27449bf15548cb82c77b6e04ee0ab827bdc ]

Later parts of the stack (including fragmentation) expect that there is
never a socket attached to frag in a frag_list, however this invariant
was not enforced on all defrag paths. This could lead to the
BUG_ON(skb->sk) during ip_do_fragment(), as per the call stack at the
end of this commit message.

While the call could be added to openvswitch to fix this particular
error, the head and tail of the frags list are already orphaned
indirectly inside ip_defrag(), so it seems like the remaining fragments
should all be orphaned in all circumstances.

kernel BUG at net/ipv4/ip_output.c:586!
[...]
Call Trace:
 
 [] ? do_output.isra.29+0x1b0/0x1b0 [openvswitch]
 [] ovs_fragment+0xcc/0x214 [openvswitch]
 [] ? dst_discard_out+0x20/0x20
 [] ? dst_ifdown+0x80/0x80
 [] ? find_bucket.isra.2+0x62/0x70 [openvswitch]
 [] ? mod_timer_pending+0x65/0x210
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? nf_conntrack_in+0x252/0x500 [nf_conntrack]
 [] ? __lock_is_held+0x54/0x70
 [] do_output.isra.29+0xe3/0x1b0 [openvswitch]
 [] do_execute_actions+0xe11/0x11f0 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0x32/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0xb2/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? ovs_ct_get_labels+0x49/0x80 [openvswitch]
 [] ovs_vport_receive+0x5d/0xa0 [openvswitch]
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] internal_dev_xmit+0x6c/0x140 [openvswitch]
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] dev_hard_start_xmit+0x2b9/0x5e0
 [] ? netif_skb_features+0xd1/0x1f0
 [] __dev_queue_xmit+0x800/0x930
 [] ? __dev_queue_xmit+0x50/0x930
 [] ? mark_held_locks+0x71/0x90
 [] ? neigh_resolve_output+0x106/0x220
 [] dev_queue_xmit+0x10/0x20
 [] neigh_resolve_output+0x178/0x220
 [] ? ip_finish_output2+0x1ff/0x590
 [] ip_finish_output2+0x1ff/0x590
 [] ? ip_finish_output2+0x7e/0x590
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] icmp_push_reply+0xea/0x120
 [] icmp_reply.constprop.23+0x1ed/0x230
 [] icmp_echo.part.21+0x4e/0x50
 [] ? __lock_is_held+0x54/0x70
 [] ? rcu_read_lock_held+0x5e/0x70
 [] icmp_echo+0x36/0x70
 [] icmp_rcv+0x271/0x450
 [] ip_local_deliver_finish+0x127/0x3a0
 [] ? ip_local_deliver_finish+0x41/0x3a0
 [] ip_local_deliver+0x60/0xd0
 [] ? ip_rcv_finish+0x560/0x560
 [] ip_rcv_finish+0xdd/0x560
 [] ip_rcv+0x283/0x3e0
 [] ? match_held_lock+0x192/0x200
 [] ? inet_del_offload+0x40/0x40
 [] __netif_receive_skb_core+0x392/0xae0
 [] ? process_backlog+0x8e/0x230
 [] ? mark_held_locks+0x71/0x90
 [] __netif_receive_skb+0x18/0x60
 [] process_backlog+0x78/0x230
 [] ? process_backlog+0xdd/0x230
 [] net_rx_action+0x155/0x400
 [] __do_softirq+0xcc/0x420
 [] ? ip_finish_output2+0x217/0x590
 [] do_softirq_own_stack+0x1c/0x30
 
 [] do_softirq+0x4e/0x60
 [] __local_bh_enable_ip+0xa8/0xb0
 [] ip_finish_output2+0x240/0x590
 [] ? ip_do_fragment+0x831/0x8a0
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] raw_sendmsg+0x7d3/0xc30
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? inet_sendmsg+0xc7/0x1d0
 [] ? __lock_is_held+0x54/0x70
 [] inet_sendmsg+0x10a/0x1d0
 [] ? inet_sendmsg+0x5/0x1d0
 [] sock_sendmsg+0x38/0x50
 [] ___sys_sendmsg+0x25f/0x270
 [] ? handle_mm_fault+0x8dd/0x1320
 [] ? _raw_spin_unlock+0x27/0x40
 [] ? __do_page_fault+0x1e2/0x460
 [] ? __fget_light+0x66/0x90
 [] __sys_sendmsg+0x42/0x80
 [] SyS_sendmsg+0x12/0x20
 [] entry_SYSCALL_64_fastpath+0x12/0x6f
Code: 00 00 44 89 e0 e9 7c fb ff ff 4c 89 ff e8 e7 e7 ff ff 41 8b 9d 80 00 00 00 2b 5d d4 89 d8 c1 f8 03 0f b7 c0 e9 33 ff ff f
 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48
RIP  [] ip_do_fragment+0x892/0x8a0
 RSP 

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Signed-off-by: Joe Stringer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_dup: add missing dependencies with NF_CONNTRACK

2015-12-10T17:17:06+00:00

CONFIG_NF_CONNTRACK=m
CONFIG_NF_DUP_IPV4=y

results in:

   net/built-in.o: In function `nf_dup_ipv4':
>> (.text+0xd434f): undefined reference to `nf_conntrack_untracked'

Reported-by: kbuild test robot 
Signed-off-by: Pablo Neira Ayuso

netfilter: Fix removal of GRE expectation entries created by PPTP

2015-11-09T12:32:14+00:00

The uninitialized tuple structure caused incorrect hash calculation
and the lookup failed.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=106441
Signed-off-by: Anthony Lineham 
Signed-off-by: Pablo Neira Ayuso

ipv4: use sk_fullsock() in ipv4_conntrack_defrag()

2015-11-05T19:36:09+00:00

Before converting a 'socket pointer' into inet socket,
use sk_fullsock() to detect timewait or request sockets.

Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet 
Reported-by: Dmitry Vyukov 
Tested-by: Dmitry Vyukov 
Cc: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-10-24T13:54:12+00:00

Conflicts:
	net/ipv6/xfrm6_output.c
	net/openvswitch/flow_netlink.c
	net/openvswitch/vport-gre.c
	net/openvswitch/vport-vxlan.c
	net/openvswitch/vport.c
	net/openvswitch/vport.h

The openvswitch conflicts were overlapping changes.  One was
the egress tunnel info fix in 'net' and the other was the
vport ->send() op simplification in 'net-next'.

The xfrm6_output.c conflicts was also a simplification
overlapping a bug fix.

Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2015-10-17T12:28:03+00:00

This merge resolves conflicts with 75aec9df3a78 ("bridge: Remove
br_nf_push_frag_xmit_sk") as part of Eric Biederman's effort to improve
netns support in the network stack that reached upstream via David's
net-next tree.

Signed-off-by: Pablo Neira Ayuso 

Conflicts:
	net/bridge/br_netfilter_hooks.c

netfilter: ipv4: whitespace around operators

2015-10-16T17:19:23+00:00

This patch cleanses whitespace around arithmetical operators.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipv4: code indentation

2015-10-16T17:19:15+00:00

Use tabs instead of spaces to indent code.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipv4: function definition layout

2015-10-16T17:19:10+00:00

Use tabs instead of spaces to indent second line of parameters in
function definitions.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipv4: ternary operator layout

2015-10-16T17:19:04+00:00

Correct whitespace layout of ternary operators in the netfilter-ipv4
code.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: Pablo Neira Ayuso