linux-stable.git/net/netfilter, branch linux-3.19.y

netfilter: nf_tables: fix addition/deletion of elements from commit/abort

2015-03-26T12:59:49+00:00

commit 02263db00b6cb98701332aa257c07ca549c2324b upstream.

We have several problems in this path:

1) There is a use-after-free when removing individual elements from
   the commit path.

2) We have to uninit() the data part of the element from the abort
   path to avoid a chain refcount leak.

3) We have to check for set->flags to see if there's a mapping, instead
   of the element flags.

4) We have to check for !(flags & NFT_SET_ELEM_INTERVAL_END) to skip
   elements that are part of the interval that have no data part, so
   they don't need to be uninit().

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_tables: fix transaction race condition

2015-03-26T12:59:49+00:00

commit 8670c3a55e91cb27a4b4d4d4c4fa35b0149e1abf upstream.

A race condition exists in the rule transaction code for rules that
get added and removed within the same transaction.

The new rule starts out as inactive in the current and active in the
next generation and is inserted into the ruleset. When it is deleted,
it is additionally set to inactive in the next generation as well.

On commit the next generation is begun, then the actions are finalized.
For the new rule this would mean clearing out the inactive bit for
the previously current, now next generation.

However nft_rule_clear() clears out the bits for *both* generations,
activating the rule in the current generation, where it should be
deactivated due to being deleted. The rule will thus be active until
the deletion is finalized, removing the rule from the ruleset.

Similarly, when aborting a transaction for the same case, the undo
of insertion will remove it from the RCU protected rule list, the
deletion will clear out all bits. However until the next RCU
synchronization after all operations have been undone, the rule is
active on CPUs which can still see the rule on the list.

Generally, there may never be any modifications of the current
generations' inactive bit since this defeats the entire purpose of
atomicity. Change nft_rule_clear() to only touch the next generations
bit to fix this.

Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: xt_socket: fix a stack corruption bug

2015-03-26T12:59:49+00:00

commit 78296c97ca1fd3b104f12e1f1fbc06c46635990b upstream.

As soon as extract_icmp6_fields() returns, its local storage (automatic
variables) is deallocated and can be overwritten.

Lets add an additional parameter to make sure storage is valid long
enough.

While we are at it, adds some const qualifiers.

Signed-off-by: Eric Dumazet 
Fixes: b64c9256a9b76 ("tproxy: added IPv6 support to the socket match")
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: nft_compat: fix module refcount underflow

2015-03-26T12:59:49+00:00

commit 520aa7414bb590f39d0d1591b06018e60cbc7cf4 upstream.

Feb 12 18:20:42 nfdev kernel: ------------[ cut here ]------------
Feb 12 18:20:42 nfdev kernel: WARNING: CPU: 4 PID: 4359 at kernel/module.c:963 module_put+0x9b/0xba()
Feb 12 18:20:42 nfdev kernel: CPU: 4 PID: 4359 Comm: ebtables-compat Tainted: G        W      3.19.0-rc6+ #43
[...]
Feb 12 18:20:42 nfdev kernel: Call Trace:
Feb 12 18:20:42 nfdev kernel: [] dump_stack+0x4c/0x65
Feb 12 18:20:42 nfdev kernel: [] warn_slowpath_common+0x9c/0xb6
Feb 12 18:20:42 nfdev kernel: [] ? module_put+0x9b/0xba
Feb 12 18:20:42 nfdev kernel: [] warn_slowpath_null+0x15/0x17
Feb 12 18:20:42 nfdev kernel: [] module_put+0x9b/0xba
Feb 12 18:20:42 nfdev kernel: [] nft_match_destroy+0x45/0x4c
Feb 12 18:20:42 nfdev kernel: [] nf_tables_rule_destroy+0x28/0x70

Reported-by: Arturo Borrero Gonzalez 
Signed-off-by: Pablo Neira Ayuso 
Tested-by: Arturo Borrero Gonzalez 
Signed-off-by: Greg Kroah-Hartman

ipvs: fix inability to remove a mixed-family RS

2015-03-26T12:59:48+00:00

commit dd3733b3e798daf778a1ec08557f388f00fdc2f6 upstream.

The current code prevents any operation with a mixed-family dest
unless IP_VS_CONN_F_TUNNEL flag is set. The problem is that it's impossible
for the client to follow this rule, because ip_vs_genl_parse_dest does
not even read the destination conn_flags when cmd = IPVS_CMD_DEL_DEST
(need_full_dest = 0).

Also, not every client can pass this flag when removing a dest. ipvsadm,
for example, does not support the "-i" command line option together with
the "-d" option.

This change disables any checks for mixed-family on IPVS_CMD_DEL_DEST command.

Signed-off-by: Alexey Andriyanov 
Fixes: bc18d37f676f ("ipvs: Allow heterogeneous pools now that we support them")
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Greg Kroah-Hartman

ipvs: add missing ip_vs_pe_put in sync code

2015-03-26T12:59:48+00:00

commit 528c943f3bb919aef75ab2fff4f00176f09a4019 upstream.

ip_vs_conn_fill_param_sync() gets in param.pe a module
reference for persistence engine from __ip_vs_pe_getbyname()
but forgets to put it. Problem occurs in backup for
sync protocol v1 (2.6.39).

Also, pe_data usually comes in sync messages for
connection templates and ip_vs_conn_new() copies
the pointer only in this case. Make sure pe_data
is not leaked if it comes unexpectedly for normal
connections. Leak can happen only if bogus messages
are sent to backup server.

Fixes: fe5e7a1efb66 ("IPVS: Backup, Adding Version 1 receive capability")
Signed-off-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Greg Kroah-Hartman

Revert "netfilter: xt_recent: relax ip_pkt_list_tot restrictions"

2015-03-18T13:11:13+00:00

This reverts commit abc86d0f99242b7f142b7cb8f90e30081dd3c256 as it is
broken in 3.19 and is easier to revert here than try to fix it.

Reported-by: Florian Westphal 
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

netfilter: nf_tables: fix leaks in error path of nf_tables_newchain()

2015-01-30T17:42:08+00:00

Release statistics and module refcount on memory allocation problems.

Signed-off-by: Pablo Neira Ayuso

ipvs: rerouting to local clients is not needed anymore

2015-01-30T01:05:55+00:00

commit f5a41847acc5 ("ipvs: move ip_route_me_harder for ICMP")
from 2.6.37 introduced ip_route_me_harder() call for responses to
local clients, so that we can provide valid rt_src after SNAT.
It was used by TCP to provide valid daddr for ip_send_reply().
After commit 0a5ebb8000c5 ("ipv4: Pass explicit daddr arg to
ip_send_reply()." from 3.0 this rerouting is not needed anymore
and should be avoided, especially in LOCAL_IN.

Fixes 3.12.33 crash in xfrm reported by Florian Wiessner:
"3.12.33 - BUG xfrm_selector_match+0x25/0x2f6"

Reported-by: Smart Weblications GmbH - Florian Wiessner 
Tested-by: Smart Weblications GmbH - Florian Wiessner 
Signed-off-by: Julian Anastasov 
Signed-off-by: Simon Horman

netfilter: nf_tables: disable preemption when restoring chain counters

2015-01-26T10:50:02+00:00

With CONFIG_DEBUG_PREEMPT=y

[22144.496057] BUG: using smp_processor_id() in preemptible [00000000] code: iptables-compat/10406
[22144.496061] caller is debug_smp_processor_id+0x17/0x1b
[22144.496065] CPU: 2 PID: 10406 Comm: iptables-compat Not tainted 3.19.0-rc4+ #
[...]
[22144.496092] Call Trace:
[22144.496098]  [] dump_stack+0x4f/0x7b
[22144.496104]  [] check_preemption_disabled+0xd6/0xe8
[22144.496110]  [] debug_smp_processor_id+0x17/0x1b
[22144.496120]  [] nft_stats_alloc+0x94/0xc7 [nf_tables]
[22144.496130]  [] nf_tables_newchain+0x471/0x6d8 [nf_tables]
[22144.496140]  [] ? nft_trans_alloc+0x18/0x34 [nf_tables]
[22144.496154]  [] nfnetlink_rcv_batch+0x2b4/0x457 [nfnetlink]

Reported-by: Andreas Schultz 
Signed-off-by: Pablo Neira Ayuso