Skip to content

Commit 321e921

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Rename 'searched' column to 'clashres' in conntrack /proc/ stats to amend a recent patch, from Florian Westphal. 2) Remove unused nft_data_debug(), from YueHaibing. 3) Remove unused definitions in IPVS, also from YueHaibing. 4) Fix user data memleak in tables and objects, this is also amending a recent patch, from Jose M. Guisado. 5) Use nla_memdup() to allocate user data in table and objects, also from Jose M. Guisado 6) User data support for chains, from Jose M. Guisado 7) Remove unused definition in nf_tables_offload, from YueHaibing. 8) Use kvzalloc() in ip_set_alloc(), from Vasily Averin. 9) Fix false positive reported by lockdep in nfnetlink mutexes, from Florian Westphal. 10) Extend fast variant of cmp for neq operation, from Phil Sutter. 11) Implement fast bitwise variant, also from Phil Sutter. ==================== Signed-off-by: David S. Miller <[email protected]>
2 parents 456afe0 + 10fdd6d commit 321e921

File tree

12 files changed

+222
-63
lines changed

12 files changed

+222
-63
lines changed

‎include/net/netfilter/nf_tables.h

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -148,13 +148,6 @@ static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
148148
memcpy(dst, src, len);
149149
}
150150

151-
static inline void nft_data_debug(const struct nft_data *data)
152-
{
153-
pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n",
154-
data->data[0], data->data[1],
155-
data->data[2], data->data[3]);
156-
}
157-
158151
/**
159152
* struct nft_ctx - nf_tables rule/set context
160153
*
@@ -952,6 +945,8 @@ struct nft_chain {
952945
bound:1,
953946
genmask:2;
954947
char *name;
948+
u16 udlen;
949+
u8 *udata;
955950

956951
/* Only used during control plane commit phase: */
957952
struct nft_rule **rules_next;

‎include/net/netfilter/nf_tables_core.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,19 @@ extern struct nft_object_type nft_secmark_obj_type;
2323
int nf_tables_core_module_init(void);
2424
void nf_tables_core_module_exit(void);
2525

26+
struct nft_bitwise_fast_expr {
27+
u32 mask;
28+
u32 xor;
29+
enum nft_registers sreg:8;
30+
enum nft_registers dreg:8;
31+
};
32+
2633
struct nft_cmp_fast_expr {
2734
u32 data;
35+
u32 mask;
2836
enum nft_registers sreg:8;
2937
u8 len;
38+
bool inv;
3039
};
3140

3241
struct nft_immediate_expr {
@@ -66,6 +75,8 @@ struct nft_payload_set {
6675

6776
extern const struct nft_expr_ops nft_payload_fast_ops;
6877

78+
extern const struct nft_expr_ops nft_bitwise_fast_ops;
79+
6980
extern struct static_key_false nft_counters_enabled;
7081
extern struct static_key_false nft_trace_enabled;
7182

‎include/uapi/linux/netfilter/nf_tables.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,7 @@ enum nft_chain_flags {
208208
* @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
209209
* @NFTA_CHAIN_FLAGS: chain flags
210210
* @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
211+
* @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
211212
*/
212213
enum nft_chain_attributes {
213214
NFTA_CHAIN_UNSPEC,
@@ -222,6 +223,7 @@ enum nft_chain_attributes {
222223
NFTA_CHAIN_PAD,
223224
NFTA_CHAIN_FLAGS,
224225
NFTA_CHAIN_ID,
226+
NFTA_CHAIN_USERDATA,
225227
__NFTA_CHAIN_MAX
226228
};
227229
#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)

‎net/netfilter/ipset/ip_set_core.c

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -250,22 +250,7 @@ EXPORT_SYMBOL_GPL(ip_set_type_unregister);
250250
void *
251251
ip_set_alloc(size_t size)
252252
{
253-
void *members = NULL;
254-
255-
if (size < KMALLOC_MAX_SIZE)
256-
members = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
257-
258-
if (members) {
259-
pr_debug("%p: allocated with kmalloc\n", members);
260-
return members;
261-
}
262-
263-
members = vzalloc(size);
264-
if (!members)
265-
return NULL;
266-
pr_debug("%p: allocated with vmalloc\n", members);
267-
268-
return members;
253+
return kvzalloc(size, GFP_KERNEL_ACCOUNT);
269254
}
270255
EXPORT_SYMBOL_GPL(ip_set_alloc);
271256

‎net/netfilter/ipvs/ip_vs_sync.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,9 +242,6 @@ struct ip_vs_sync_thread_data {
242242
| IPVS Sync Connection (1) |
243243
*/
244244

245-
#define SYNC_MESG_HEADER_LEN 4
246-
#define MAX_CONNS_PER_SYNCBUFF 255 /* nr_conns in ip_vs_sync_mesg is 8 bit */
247-
248245
/* Version 0 header */
249246
struct ip_vs_sync_mesg_v0 {
250247
__u8 nr_conns;

‎net/netfilter/nf_conntrack_standalone.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -428,14 +428,14 @@ static int ct_cpu_seq_show(struct seq_file *seq, void *v)
428428
const struct ip_conntrack_stat *st = v;
429429

430430
if (v == SEQ_START_TOKEN) {
431-
seq_puts(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete search_restart\n");
431+
seq_puts(seq, "entries clashres found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete search_restart\n");
432432
return 0;
433433
}
434434

435435
seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
436436
"%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
437437
nr_conntracks,
438-
st->clash_resolve, /* was: searched */
438+
st->clash_resolve,
439439
st->found,
440440
0,
441441
st->invalid,

‎net/netfilter/nf_tables_api.c

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -997,7 +997,6 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
997997
struct nft_table *table;
998998
struct nft_ctx ctx;
999999
u32 flags = 0;
1000-
u16 udlen = 0;
10011000
int err;
10021001

10031002
lockdep_assert_held(&net->nft.commit_mutex);
@@ -1034,13 +1033,11 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
10341033
goto err_strdup;
10351034

10361035
if (nla[NFTA_TABLE_USERDATA]) {
1037-
udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
1038-
table->udata = kzalloc(udlen, GFP_KERNEL);
1036+
table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);
10391037
if (table->udata == NULL)
10401038
goto err_table_udata;
10411039

1042-
nla_memcpy(table->udata, nla[NFTA_TABLE_USERDATA], udlen);
1043-
table->udlen = udlen;
1040+
table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
10441041
}
10451042

10461043
err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
@@ -1222,6 +1219,7 @@ static void nf_tables_table_destroy(struct nft_ctx *ctx)
12221219

12231220
rhltable_destroy(&ctx->table->chains_ht);
12241221
kfree(ctx->table->name);
1222+
kfree(ctx->table->udata);
12251223
kfree(ctx->table);
12261224
}
12271225

@@ -1317,6 +1315,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
13171315
[NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
13181316
[NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
13191317
[NFTA_CHAIN_ID] = { .type = NLA_U32 },
1318+
[NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY,
1319+
.len = NFT_USERDATA_MAXLEN },
13201320
};
13211321

13221322
static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
@@ -1458,6 +1458,10 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
14581458
if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
14591459
goto nla_put_failure;
14601460

1461+
if (chain->udata &&
1462+
nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))
1463+
goto nla_put_failure;
1464+
14611465
nlmsg_end(skb, nlh);
14621466
return 0;
14631467

@@ -1694,9 +1698,11 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx)
16941698
free_percpu(rcu_dereference_raw(basechain->stats));
16951699
}
16961700
kfree(chain->name);
1701+
kfree(chain->udata);
16971702
kfree(basechain);
16981703
} else {
16991704
kfree(chain->name);
1705+
kfree(chain->udata);
17001706
kfree(chain);
17011707
}
17021708
}
@@ -2050,7 +2056,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
20502056
} else {
20512057
if (!(flags & NFT_CHAIN_BINDING)) {
20522058
err = -EINVAL;
2053-
goto err1;
2059+
goto err_destroy_chain;
20542060
}
20552061

20562062
snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
@@ -2059,13 +2065,22 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
20592065

20602066
if (!chain->name) {
20612067
err = -ENOMEM;
2062-
goto err1;
2068+
goto err_destroy_chain;
2069+
}
2070+
2071+
if (nla[NFTA_CHAIN_USERDATA]) {
2072+
chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
2073+
if (chain->udata == NULL) {
2074+
err = -ENOMEM;
2075+
goto err_destroy_chain;
2076+
}
2077+
chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);
20632078
}
20642079

20652080
rules = nf_tables_chain_alloc_rules(chain, 0);
20662081
if (!rules) {
20672082
err = -ENOMEM;
2068-
goto err1;
2083+
goto err_destroy_chain;
20692084
}
20702085

20712086
*rules = NULL;
@@ -2074,12 +2089,12 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
20742089

20752090
err = nf_tables_register_hook(net, table, chain);
20762091
if (err < 0)
2077-
goto err1;
2092+
goto err_destroy_chain;
20782093

20792094
trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
20802095
if (IS_ERR(trans)) {
20812096
err = PTR_ERR(trans);
2082-
goto err2;
2097+
goto err_unregister_hook;
20832098
}
20842099

20852100
nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
@@ -2089,15 +2104,15 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
20892104
err = nft_chain_add(table, chain);
20902105
if (err < 0) {
20912106
nft_trans_destroy(trans);
2092-
goto err2;
2107+
goto err_unregister_hook;
20932108
}
20942109

20952110
table->use++;
20962111

20972112
return 0;
2098-
err2:
2113+
err_unregister_hook:
20992114
nf_tables_unregister_hook(net, table, chain);
2100-
err1:
2115+
err_destroy_chain:
21012116
nf_tables_chain_destroy(ctx);
21022117

21032118
return err;
@@ -5906,7 +5921,6 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
59065921
struct nft_object *obj;
59075922
struct nft_ctx ctx;
59085923
u32 objtype;
5909-
u16 udlen;
59105924
int err;
59115925

59125926
if (!nla[NFTA_OBJ_TYPE] ||
@@ -5963,13 +5977,11 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
59635977
}
59645978

59655979
if (nla[NFTA_OBJ_USERDATA]) {
5966-
udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
5967-
obj->udata = kzalloc(udlen, GFP_KERNEL);
5980+
obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL);
59685981
if (obj->udata == NULL)
59695982
goto err_userdata;
59705983

5971-
nla_memcpy(obj->udata, nla[NFTA_OBJ_USERDATA], udlen);
5972-
obj->udlen = udlen;
5984+
obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
59735985
}
59745986

59755987
err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
@@ -6238,6 +6250,7 @@ static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
62386250

62396251
module_put(obj->ops->type->owner);
62406252
kfree(obj->key.name);
6253+
kfree(obj->udata);
62416254
kfree(obj);
62426255
}
62436256

‎net/netfilter/nf_tables_core.c

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,22 @@ static inline void nft_trace_packet(struct nft_traceinfo *info,
4747
}
4848
}
4949

50+
static void nft_bitwise_fast_eval(const struct nft_expr *expr,
51+
struct nft_regs *regs)
52+
{
53+
const struct nft_bitwise_fast_expr *priv = nft_expr_priv(expr);
54+
u32 *src = &regs->data[priv->sreg];
55+
u32 *dst = &regs->data[priv->dreg];
56+
57+
*dst = (*src & priv->mask) ^ priv->xor;
58+
}
59+
5060
static void nft_cmp_fast_eval(const struct nft_expr *expr,
5161
struct nft_regs *regs)
5262
{
5363
const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
54-
u32 mask = nft_cmp_fast_mask(priv->len);
5564

56-
if ((regs->data[priv->sreg] & mask) == priv->data)
65+
if (((regs->data[priv->sreg] & priv->mask) == priv->data) ^ priv->inv)
5766
return;
5867
regs->verdict.code = NFT_BREAK;
5968
}
@@ -176,6 +185,8 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)
176185
nft_rule_for_each_expr(expr, last, rule) {
177186
if (expr->ops == &nft_cmp_fast_ops)
178187
nft_cmp_fast_eval(expr, &regs);
188+
else if (expr->ops == &nft_bitwise_fast_ops)
189+
nft_bitwise_fast_eval(expr, &regs);
179190
else if (expr->ops != &nft_payload_fast_ops ||
180191
!nft_payload_fast_eval(expr, &regs, pkt))
181192
expr_call_ops_eval(expr, &regs, pkt);

‎net/netfilter/nf_tables_offload.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -323,8 +323,6 @@ static int nft_indr_block_offload_cmd(struct nft_base_chain *basechain,
323323
return nft_block_setup(basechain, &bo, cmd);
324324
}
325325

326-
#define FLOW_SETUP_BLOCK TC_SETUP_BLOCK
327-
328326
static int nft_chain_offload_cmd(struct nft_base_chain *basechain,
329327
struct net_device *dev,
330328
enum flow_block_command cmd)

‎net/netfilter/nfnetlink.c

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,23 @@ static struct {
4646
const struct nfnetlink_subsystem __rcu *subsys;
4747
} table[NFNL_SUBSYS_COUNT];
4848

49+
static struct lock_class_key nfnl_lockdep_keys[NFNL_SUBSYS_COUNT];
50+
51+
static const char *const nfnl_lockdep_names[NFNL_SUBSYS_COUNT] = {
52+
[NFNL_SUBSYS_NONE] = "nfnl_subsys_none",
53+
[NFNL_SUBSYS_CTNETLINK] = "nfnl_subsys_ctnetlink",
54+
[NFNL_SUBSYS_CTNETLINK_EXP] = "nfnl_subsys_ctnetlink_exp",
55+
[NFNL_SUBSYS_QUEUE] = "nfnl_subsys_queue",
56+
[NFNL_SUBSYS_ULOG] = "nfnl_subsys_ulog",
57+
[NFNL_SUBSYS_OSF] = "nfnl_subsys_osf",
58+
[NFNL_SUBSYS_IPSET] = "nfnl_subsys_ipset",
59+
[NFNL_SUBSYS_ACCT] = "nfnl_subsys_acct",
60+
[NFNL_SUBSYS_CTNETLINK_TIMEOUT] = "nfnl_subsys_cttimeout",
61+
[NFNL_SUBSYS_CTHELPER] = "nfnl_subsys_cthelper",
62+
[NFNL_SUBSYS_NFTABLES] = "nfnl_subsys_nftables",
63+
[NFNL_SUBSYS_NFT_COMPAT] = "nfnl_subsys_nftcompat",
64+
};
65+
4966
static const int nfnl_group2type[NFNLGRP_MAX+1] = {
5067
[NFNLGRP_CONNTRACK_NEW] = NFNL_SUBSYS_CTNETLINK,
5168
[NFNLGRP_CONNTRACK_UPDATE] = NFNL_SUBSYS_CTNETLINK,
@@ -632,7 +649,7 @@ static int __init nfnetlink_init(void)
632649
BUG_ON(nfnl_group2type[i] == NFNL_SUBSYS_NONE);
633650

634651
for (i=0; i<NFNL_SUBSYS_COUNT; i++)
635-
mutex_init(&table[i].mutex);
652+
__mutex_init(&table[i].mutex, nfnl_lockdep_names[i], &nfnl_lockdep_keys[i]);
636653

637654
return register_pernet_subsys(&nfnetlink_net_ops);
638655
}

0 commit comments

Comments
 (0)