linux.git/net/ipv4, branch v3.13-rc7

ipv4: consistent reporting of pmtu data in case of corking

2013-12-22T23:52:09+00:00

We report different pmtu values back on the first write and on further
writes on an corked socket.

Also don't include the dst.header_len (respectively exthdrlen) as this
should already be dealt with by the interface mtu of the outgoing
(virtual) interface and policy of that interface should dictate if
fragmentation should happen.

Instead reduce the pmtu data by IP options as we do for IPv6. Make the
same changes for ip_append_data, where we did not care about options or
dst.header_len at all.

Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

net: inet_diag: zero out uninitialized idiag_{src,dst} fields

2013-12-19T19:55:52+00:00

Jakub reported while working with nlmon netlink sniffer that parts of
the inet_diag_sockid are not initialized when r->idiag_family != AF_INET6.
That is, fields of r->id.idiag_src[1 ... 3], r->id.idiag_dst[1 ... 3].

In fact, it seems that we can leak 6 * sizeof(u32) byte of kernel [slab]
memory through this. At least, in udp_dump_one(), we allocate a skb in ...

  rep = nlmsg_new(sizeof(struct inet_diag_msg) + ..., GFP_KERNEL);

... and then pass that to inet_sk_diag_fill() that puts the whole struct
inet_diag_msg into the skb, where we only fill out r->id.idiag_src[0],
r->id.idiag_dst[0] and leave the rest untouched:

  r->id.idiag_src[0] = inet->inet_rcv_saddr;
  r->id.idiag_dst[0] = inet->inet_daddr;

struct inet_diag_msg embeds struct inet_diag_sockid that is correctly /
fully filled out in IPv6 case, but for IPv4 not.

So just zero them out by using plain memset (for this little amount of
bytes it's probably not worth the extra check for idiag_family == AF_INET).

Similarly, fix also other places where we fill that out.

Reported-by: Jakub Zawadzki 
Signed-off-by: Daniel Borkmann 
Signed-off-by: David S. Miller

ip_gre: fix msg_name parsing for recvfrom/recvmsg

2013-12-18T22:44:33+00:00

ipgre_header_parse() needs to parse the tunnel's ip header and it
uses mac_header to locate the iphdr. This got broken when gre tunneling
was refactored as mac_header is no longer updated to point to iphdr.
Introduce skb_pop_mac_header() helper to do the mac_header assignment
and use it in ipgre_rcv() to fix msg_name parsing.

Bug introduced in commit c54419321455 (GRE: Refactor GRE tunneling code.)

Cc: Pravin B Shelar 
Signed-off-by: Timo Teräs 
Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

2013-12-17T20:06:20+00:00

Pablo Neira Ayuso says:

====================
The following patchset contains two Netfilter fixes for your net
tree, they are:

* Fix endianness in nft_reject, the NFTA_REJECT_TYPE netlink attributes
  was not converted to network byte order as needed by all nfnetlink
  subsystems, from Eric Leblond.

* Restrict SYNPROXY target to INPUT and FORWARD chains, this avoid a
  possible crash due to misconfigurations, from Patrick McHardy.
====================

Signed-off-by: David S. Miller

udp: ipv4: do not use sk_dst_lock from softirq context

2013-12-17T19:50:58+00:00

Using sk_dst_lock from softirq context is not supported right now.

Instead of adding BH protection everywhere,
udp_sk_rx_dst_set() can instead use xchg(), as suggested
by David.

Reported-by: Fengguang Wu 
Fixes: 975022310233 ("udp: ipv4: must add synchronization in udp_sk_rx_dst_set()")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

netfilter: nft_reject: fix endianness in dump function

2013-12-12T08:37:39+00:00

The dump function in nft_reject_ipv4 was not converting a u32
field to network order before sending it to userspace, this
needs to happen for consistency with other nf_tables and
nfnetlink subsystems.

Signed-off-by: Eric Leblond 
Signed-off-by: Pablo Neira Ayuso

udp: ipv4: must add synchronization in udp_sk_rx_dst_set()

2013-12-12T01:21:10+00:00

Unlike TCP, UDP input path does not hold the socket lock.

Before messing with sk->sk_rx_dst, we must use a spinlock, otherwise
multiple cpus could leak a refcount.

This patch also takes care of renewing a stale dst entry.
(When the sk->sk_rx_dst would not be used by IP early demux)

Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux")
Signed-off-by: Eric Dumazet 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller

udp: ipv4: fix potential use after free in udp_v4_early_demux()

2013-12-11T21:10:14+00:00

pskb_may_pull() can reallocate skb->head, we need to move the
initialization of iph and uh pointers after its call.

Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux")
Signed-off-by: Eric Dumazet 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller

netfilter: SYNPROXY target: restrict to INPUT/FORWARD

2013-12-11T10:30:25+00:00

Fix a crash in synproxy_send_tcp() when using the SYNPROXY target in the
PREROUTING chain caused by missing routing information.

Reported-by: Nicki P. 
Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

udp: ipv4: fix an use after free in __udp4_lib_rcv()

2013-12-11T03:58:40+00:00

Dave Jones reported a use after free in UDP stack :

[ 5059.434216] =========================
[ 5059.434314] [ BUG: held lock freed! ]
[ 5059.434420] 3.13.0-rc3+ #9 Not tainted
[ 5059.434520] -------------------------
[ 5059.434620] named/863 is freeing memory ffff88005e960000-ffff88005e96061f, with a lock still held there!
[ 5059.434815]  (slock-AF_INET){+.-...}, at: [] udp_queue_rcv_skb+0xd1/0x4b0
[ 5059.435012] 3 locks held by named/863:
[ 5059.435086]  #0:  (rcu_read_lock){.+.+..}, at: [] __netif_receive_skb_core+0x11d/0x940
[ 5059.435295]  #1:  (rcu_read_lock){.+.+..}, at: [] ip_local_deliver_finish+0x3e/0x410
[ 5059.435500]  #2:  (slock-AF_INET){+.-...}, at: [] udp_queue_rcv_skb+0xd1/0x4b0
[ 5059.435734]
stack backtrace:
[ 5059.435858] CPU: 0 PID: 863 Comm: named Not tainted 3.13.0-rc3+ #9 [loadavg: 0.21 0.06 0.06 1/115 1365]
[ 5059.436052] Hardware name:                  /D510MO, BIOS MOPNV10J.86A.0175.2010.0308.0620 03/08/2010
[ 5059.436223]  0000000000000002 ffff88007e203ad8 ffffffff8153a372 ffff8800677130e0
[ 5059.436390]  ffff88007e203b10 ffffffff8108cafa ffff88005e960000 ffff88007b00cfc0
[ 5059.436554]  ffffea00017a5800 ffffffff8141c490 0000000000000246 ffff88007e203b48
[ 5059.436718] Call Trace:
[ 5059.436769]    [] dump_stack+0x4d/0x66
[ 5059.436904]  [] debug_check_no_locks_freed+0x15a/0x160
[ 5059.437037]  [] ? __sk_free+0x110/0x230
[ 5059.437147]  [] kmem_cache_free+0x6a/0x150
[ 5059.437260]  [] __sk_free+0x110/0x230
[ 5059.437364]  [] sk_free+0x19/0x20
[ 5059.437463]  [] sock_edemux+0x25/0x40
[ 5059.437567]  [] sock_queue_rcv_skb+0x81/0x280
[ 5059.437685]  [] ? udp_queue_rcv_skb+0xd1/0x4b0
[ 5059.437805]  [] __udp_queue_rcv_skb+0x42/0x240
[ 5059.437925]  [] ? _raw_spin_lock+0x65/0x70
[ 5059.438038]  [] udp_queue_rcv_skb+0x26b/0x4b0
[ 5059.438155]  [] __udp4_lib_rcv+0x152/0xb00
[ 5059.438269]  [] udp_rcv+0x15/0x20
[ 5059.438367]  [] ip_local_deliver_finish+0x10f/0x410
[ 5059.438492]  [] ? ip_local_deliver_finish+0x3e/0x410
[ 5059.438621]  [] ip_local_deliver+0x43/0x80
[ 5059.438733]  [] ip_rcv_finish+0x140/0x5a0
[ 5059.438843]  [] ip_rcv+0x296/0x3f0
[ 5059.438945]  [] __netif_receive_skb_core+0x742/0x940
[ 5059.439074]  [] ? __netif_receive_skb_core+0x11d/0x940
[ 5059.442231]  [] ? trace_hardirqs_on+0xd/0x10
[ 5059.442231]  [] __netif_receive_skb+0x13/0x60
[ 5059.442231]  [] netif_receive_skb+0x1e/0x1f0
[ 5059.442231]  [] napi_gro_receive+0x70/0xa0
[ 5059.442231]  [] rtl8169_poll+0x166/0x700 [r8169]
[ 5059.442231]  [] net_rx_action+0x129/0x1e0
[ 5059.442231]  [] __do_softirq+0xed/0x240
[ 5059.442231]  [] irq_exit+0x125/0x140
[ 5059.442231]  [] do_IRQ+0x51/0xc0
[ 5059.442231]  [] common_interrupt+0x6f/0x6f

We need to keep a reference on the socket, by using skb_steal_sock()
at the right place.

Note that another patch is needed to fix a race in
udp_sk_rx_dst_set(), as we hold no lock protecting the dst.

Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux")
Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller