Florian Westphal
cd4348e0a5
netfilter: nf_tables: prefer nft_chain_validate ...
commit cff3bd012a9512ac5ed858d38e6ed65f6391008c upstream.
nft_chain_validate already performs loop detection because a cycle will
result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE).
It also follows maps via ->validate callback in nft_lookup, so there
appears no reason to iterate the maps again.
nf_tables_check_loops() and all its helper functions can be removed.
This improves ruleset load time significantly, from 23s down to 12s.
This also fixes a crash bug. Old loop detection code can result in
unbounded recursion:
BUG: TASK stack guard page was hit at ....
Oops: stack guard page: 0000 [#1 ] PREEMPT SMP KASAN
CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1
[..]
with a suitable ruleset during validation of register stores.
I can't see any actual reason to attempt to check for this from
nft_validate_register_store(), at this point the transaction is still in
progress, so we don't have a full picture of the rule graph.
For nf-next it might make sense to either remove it or make this depend
on table->validate_state in case we could catch an error earlier
(for improved error reporting to userspace).
Fixes: 20a69341f2
2024-08-19 05:33:54 +02:00
net/9p: fix uninit-value in p9_client_rpc()
2024-06-16 13:28:51 +02:00
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
2024-02-23 08:24:50 +01:00
batman-adv: Don't accept TT entries for out-of-spec VIDs
2024-07-05 09:08:31 +02:00
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
2024-08-19 05:33:46 +02:00
net: bridge: fix corrupted ethernet header on multicast-to-unicast
2024-05-17 11:43:54 +02:00
net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
2024-07-05 09:08:30 +02:00
libceph: fix race between delayed_work() and ceph_monc_stop()
2024-07-18 11:40:55 +02:00
net: linkwatch: use system_unbound_wq
2024-08-19 05:33:46 +02:00
ethernet: Add helper for assigning packet type when dest address does not match device address
2024-05-02 16:18:36 +02:00
hsr: Handle failures in module init
2024-03-26 18:22:25 -04:00
net: nexthop: Initialize all fields in dumped nexthops
2024-08-19 05:33:41 +02:00
ipv6: fix ndisc_is_useropt() handling for PIO
2024-08-19 05:33:45 +02:00
net/iucv: fix use after free in iucv_sock_close()
2024-08-19 05:33:44 +02:00
net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
2024-03-26 18:22:18 -04:00
net l2tp: drop flow hash on forward
2024-05-17 11:43:49 +02:00
llc: call sock_orphan() at release time
2024-02-23 08:25:04 +01:00
wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
2024-07-27 10:38:29 +02:00
net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()
2024-07-27 10:38:31 +02:00
net/ncsi: Fix netlink major/minor version numbers
2024-01-25 14:34:25 -08:00
netfilter: nf_tables: prefer nft_chain_validate
2024-08-19 05:33:54 +02:00
calipso: fix memory leak in netlbl_calipso_add_pass()
2024-01-25 14:34:23 -08:00
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
2024-03-06 14:36:08 +00:00
netrom: Fix a memory leak in nr_heartbeat_expiry()
2024-07-05 09:08:22 +02:00
nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
2024-06-16 13:28:46 +02:00
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
2024-05-17 11:43:49 +02:00
openvswitch: Set the skbuff pkt_type for proper pmtud support.
2024-06-16 13:28:45 +02:00
af_packet: Handle outgoing VLAN packets without hardware offloading
2024-08-19 05:33:35 +02:00
phonet: fix rtm_phonet_notify() skb allocation
2024-05-17 11:43:54 +02:00
net/rds: fix possible cp null dereference
2024-04-13 12:51:33 +02:00
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
2024-02-23 08:25:07 +01:00
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
2024-07-05 09:08:23 +02:00
sctp: Fix null-ptr-deref in reuseport_add_sock().
2024-08-19 05:33:46 +02:00
net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
2024-08-19 05:33:28 +02:00
SUNRPC: Fix a race to wake a sync task
2024-08-19 05:33:48 +02:00
tipc: Return non-zero value from tipc_udp_addr2str() on error
2024-08-19 05:33:41 +02:00
tls: stop recv() if initial process_rx_list gave us non-DATA
2024-03-01 13:13:37 +01:00
af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
2024-07-05 09:08:12 +02:00
virtio/vsock: fix logic which reduces credit update messages
2024-01-25 14:34:25 -08:00
wifi: nl80211: don't give key data to userspace
2024-08-19 05:33:47 +02:00
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
2024-03-26 18:22:18 -04:00
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
2024-06-16 13:28:52 +02:00
net: fix __dst_negative_advice() race
2024-06-16 13:28:52 +02:00
net: Save and restore msg_namelen in sock_sendmsg
2024-01-15 18:25:26 +01:00
cd4348e0a5