| Message ID | 20240523162019.5035-1-pablo@netfilter.org |
|---|---|
| State | Changes Requested |
| Headers | show |
Hi, On Thu, May 23, 2024 at 06:20:13PM +0200, Pablo Neira Ayuso wrote: > v2: fixes sparse warnings due to incorrect endianness in vlan mangling fix > reported by kbuild robot and Paolo Abeni. I realized checkpatch complains on use of spaces instead of indentation in patch 4/6. I can repost the series as v3. Apologies for this comestic issue. Thanks. > -o- > > Hi, > > The following patchset contains Netfilter fixes for net: > > Patch #1 syzbot reports that nf_reinject() could be called without > rcu_read_lock() when flushing pending packets at nfnetlink > queue removal, from Eric Dumazet. > > Patch #2 flushes ipset list:set when canceling garbage collection to > reference to other lists to fix a race, from Jozsef Kadlecsik. > > Patch #3 restores q-in-q matching with nft_payload by reverting > f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support"). > > Patch #4 fixes vlan mangling in skbuff when vlan offload is present > in skbuff, without this patch nft_payload corrupts packets > in this case. > > Patch #5 fixes possible nul-deref in tproxy no IP address is found in > netdevice, reported by syzbot and patch from Florian Westphal. > > Patch #6 removes a superfluous restriction which prevents loose fib > lookups from input and forward hooks, from Eric Garver. > > My assessment is that patches #1, #2 and #5 address possible kernel > crash, anything else in this batch fixes broken features. > > Please, pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-05-23 > > Thanks. > > ---------------------------------------------------------------- > > The following changes since commit 4b377b4868ef17b040065bd468668c707d2477a5: > > kprobe/ftrace: fix build error due to bad function definition (2024-05-17 19:17:55 -0700) > > are available in the Git repository at: > > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-05-23 > > for you to fetch changes up to ece92825a1fa31cf704a5898fd599daab5cb6573: > > netfilter: nft_fib: allow from forward/input without iif selector (2024-05-23 17:56:31 +0200) > > ---------------------------------------------------------------- > netfilter pull request 24-05-23 > > ---------------------------------------------------------------- > Alexander Maltsev (1): > netfilter: ipset: Add list flush to cancel_gc > > Eric Dumazet (1): > netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() > > Eric Garver (1): > netfilter: nft_fib: allow from forward/input without iif selector > > Florian Westphal (1): > netfilter: tproxy: bail out if IP has been disabled on the device > > Pablo Neira Ayuso (2): > netfilter: nft_payload: restore vlan q-in-q match support > netfilter: nft_payload: skbuff vlan metadata mangle support > > net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 + > net/netfilter/ipset/ip_set_list_set.c | 3 ++ > net/netfilter/nfnetlink_queue.c | 2 + > net/netfilter/nft_fib.c | 8 ++- > net/netfilter/nft_payload.c | 95 ++++++++++++++++++++++++++--------- > 5 files changed, 82 insertions(+), 28 deletions(-) >
On Sat, 2024-05-25 at 23:29 +0200, Pablo Neira Ayuso wrote: > Hi, > > On Thu, May 23, 2024 at 06:20:13PM +0200, Pablo Neira Ayuso wrote: > > v2: fixes sparse warnings due to incorrect endianness in vlan mangling fix > > reported by kbuild robot and Paolo Abeni. > > I realized checkpatch complains on use of spaces instead of > indentation in patch 4/6. > > I can repost the series as v3. Apologies for this comestic issue. I think the overhead of a repost would offset the benefit of cleaning- up that minor format issue. You could follow-up on net-next if/as needed. Thanks, Paolo
On Mon, 2024-05-27 at 11:59 +0200, Paolo Abeni wrote: > On Sat, 2024-05-25 at 23:29 +0200, Pablo Neira Ayuso wrote: > > Hi, > > > > On Thu, May 23, 2024 at 06:20:13PM +0200, Pablo Neira Ayuso wrote: > > > v2: fixes sparse warnings due to incorrect endianness in vlan mangling fix > > > reported by kbuild robot and Paolo Abeni. > > > > I realized checkpatch complains on use of spaces instead of > > indentation in patch 4/6. > > > > I can repost the series as v3. Apologies for this comestic issue. > > I think the overhead of a repost would offset the benefit of cleaning- > up that minor format issue. I'm sorry for being so self-contradictory in a very short period of time, but before I misread the report. I think this specific format violation is worth fixing. Could you please send a v3? Thanks! Paolo
On Mon, May 27, 2024 at 12:12:39PM +0200, Paolo Abeni wrote: > On Mon, 2024-05-27 at 11:59 +0200, Paolo Abeni wrote: > > On Sat, 2024-05-25 at 23:29 +0200, Pablo Neira Ayuso wrote: > > > Hi, > > > > > > On Thu, May 23, 2024 at 06:20:13PM +0200, Pablo Neira Ayuso wrote: > > > > v2: fixes sparse warnings due to incorrect endianness in vlan mangling fix > > > > reported by kbuild robot and Paolo Abeni. > > > > > > I realized checkpatch complains on use of spaces instead of > > > indentation in patch 4/6. > > > > > > I can repost the series as v3. Apologies for this comestic issue. > > > > I think the overhead of a repost would offset the benefit of cleaning- > > up that minor format issue. > > I'm sorry for being so self-contradictory in a very short period of > time, but before I misread the report. > > I think this specific format violation is worth fixing. Could you > please send a v3? Sure, preparing a v3. Thanks
v2: fixes sparse warnings due to incorrect endianness in vlan mangling fix reported by kbuild robot and Paolo Abeni. -o- Hi, The following patchset contains Netfilter fixes for net: Patch #1 syzbot reports that nf_reinject() could be called without rcu_read_lock() when flushing pending packets at nfnetlink queue removal, from Eric Dumazet. Patch #2 flushes ipset list:set when canceling garbage collection to reference to other lists to fix a race, from Jozsef Kadlecsik. Patch #3 restores q-in-q matching with nft_payload by reverting f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support"). Patch #4 fixes vlan mangling in skbuff when vlan offload is present in skbuff, without this patch nft_payload corrupts packets in this case. Patch #5 fixes possible nul-deref in tproxy no IP address is found in netdevice, reported by syzbot and patch from Florian Westphal. Patch #6 removes a superfluous restriction which prevents loose fib lookups from input and forward hooks, from Eric Garver. My assessment is that patches #1, #2 and #5 address possible kernel crash, anything else in this batch fixes broken features. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-05-23 Thanks. ---------------------------------------------------------------- The following changes since commit 4b377b4868ef17b040065bd468668c707d2477a5: kprobe/ftrace: fix build error due to bad function definition (2024-05-17 19:17:55 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-05-23 for you to fetch changes up to ece92825a1fa31cf704a5898fd599daab5cb6573: netfilter: nft_fib: allow from forward/input without iif selector (2024-05-23 17:56:31 +0200) ---------------------------------------------------------------- netfilter pull request 24-05-23 ---------------------------------------------------------------- Alexander Maltsev (1): netfilter: ipset: Add list flush to cancel_gc Eric Dumazet (1): netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() Eric Garver (1): netfilter: nft_fib: allow from forward/input without iif selector Florian Westphal (1): netfilter: tproxy: bail out if IP has been disabled on the device Pablo Neira Ayuso (2): netfilter: nft_payload: restore vlan q-in-q match support netfilter: nft_payload: skbuff vlan metadata mangle support net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 + net/netfilter/ipset/ip_set_list_set.c | 3 ++ net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_fib.c | 8 ++- net/netfilter/nft_payload.c | 95 ++++++++++++++++++++++++++--------- 5 files changed, 82 insertions(+), 28 deletions(-)