[nf-next] netfilter: nf_conntrack: make nf_ct_zone_dflt built-in

Fengguang reported, that some randconfig generated the following linker
issue with nf_ct_zone_dflt object involved:

  [...]
  CC      init/version.o
  LD      init/built-in.o
  net/built-in.o: In function `ipv4_conntrack_defrag':
  nf_defrag_ipv4.c:(.text+0x93e95): undefined reference to `nf_ct_zone_dflt'
  net/built-in.o: In function `ipv6_defrag':
  nf_defrag_ipv6_hooks.c:(.text+0xe3ffe): undefined reference to `nf_ct_zone_dflt'
  make: *** [vmlinux] Error 1

Given that configurations exist where we have a built-in part, which is
accessing nf_ct_zone_dflt such as the two handlers nf_ct_defrag_user()
and nf_ct6_defrag_user(), and a part that configures nf_conntrack as a
module, we must move nf_ct_zone_dflt into a fixed, guaranteed built-in
area when netfilter is configured in general.

Therefore, split the more generic parts into a common header under
include/linux/netfilter/ and move nf_ct_zone_dflt into the built-in
section that already holds parts related to CONFIG_NF_CONNTRACK in the
netfilter core. This fixes the issue on my side.

Fixes: 308ac9143ee2 ("netfilter: nf_conntrack: push zone object into functions")
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 [ Here's the 2nd one for either nf-next or net-next. I've tried various
   Kconfig combinations including the one Fengguang reported, seems to be
   okay from my side. ]

 include/linux/netfilter.h                          |  2 ++
 .../linux/netfilter/nf_conntrack_zones_common.h    | 23 ++++++++++++++++++++++
 include/net/netfilter/nf_conntrack_zones.h         | 19 +-----------------
 net/netfilter/core.c                               |  6 ++++++
 net/netfilter/nf_conntrack_core.c                  |  7 -------
 5 files changed, 32 insertions(+), 25 deletions(-)
 create mode 100644 include/linux/netfilter/nf_conntrack_zones_common.h

From: Daniel Borkmann <daniel@iogearbox.net>
Date: Thu,  3 Sep 2015 01:26:07 +0200

> Fengguang reported, that some randconfig generated the following linker
> issue with nf_ct_zone_dflt object involved:
> 
>   [...]
>   CC      init/version.o
>   LD      init/built-in.o
>   net/built-in.o: In function `ipv4_conntrack_defrag':
>   nf_defrag_ipv4.c:(.text+0x93e95): undefined reference to `nf_ct_zone_dflt'
>   net/built-in.o: In function `ipv6_defrag':
>   nf_defrag_ipv6_hooks.c:(.text+0xe3ffe): undefined reference to `nf_ct_zone_dflt'
>   make: *** [vmlinux] Error 1
> 
> Given that configurations exist where we have a built-in part, which is
> accessing nf_ct_zone_dflt such as the two handlers nf_ct_defrag_user()
> and nf_ct6_defrag_user(), and a part that configures nf_conntrack as a
> module, we must move nf_ct_zone_dflt into a fixed, guaranteed built-in
> area when netfilter is configured in general.
> 
> Therefore, split the more generic parts into a common header under
> include/linux/netfilter/ and move nf_ct_zone_dflt into the built-in
> section that already holds parts related to CONFIG_NF_CONNTRACK in the
> netfilter core. This fixes the issue on my side.
> 
> Fixes: 308ac9143ee2 ("netfilter: nf_conntrack: push zone object into functions")
> Reported-by: Fengguang Wu <fengguang.wu@intel.com>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
>  [ Here's the 2nd one for either nf-next or net-next. I've tried various
>    Kconfig combinations including the one Fengguang reported, seems to be
>    okay from my side. ]

Ok I'll apply this directly too, thanks Daniel.

If Pablo and others want to fix this another way, they can send me
a relative patch.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html