No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal 1da4874d05 netfilter: nf_tables: don't skip expired elements during walk
commit 24138933b97b055d486e8064b4a1721702442a9b upstream.

There is an asymmetry between commit/abort and preparation phase if the
following conditions are met:

1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled

In this case, following sequence is problematic:

1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements
   from preparation phase
4. kernel does another set walk to remove elements from the commit phase
   (or another walk to do a chain->use increment for all elements from
    abort phase)

If E has already expired in 1), it will be ignored during list walk, so its use count
won't have been changed.

Then, when set is culled, ->destroy callback will zap the element via
nf_tables_set_elem_destroy(), but this function is only safe for
elements that have been deactivated earlier from the preparation phase:
lack of earlier deactivate removes the element but leaks the chain use
count, which results in a WARN splat when the chain gets removed later,
plus a leak of the nft_chain structure.

Update pipapo_get() not to skip expired elements, otherwise flush
command reports bogus ENOENT errors.

Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Fixes: 8d8540c4f5 ("netfilter: nft_set_rbtree: add timeout support")
Fixes: 9d0982927e ("netfilter: nft_hash: add support for timeouts")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-28 16:50:22 +00:00
arch parisc/pgtable: Do not drop upper 5 address bits of physical address 2023-11-28 16:50:20 +00:00
block
certs
crypto crypto: pcrypt - Fix hungtask for PADATA_RESET 2023-11-28 16:50:14 +00:00
Documentation firmware: ti_sci: Replace HTTP links with HTTPS ones 2023-11-20 10:30:12 +01:00
drivers drm/amdgpu: fix error handling in amdgpu_bo_list_get() 2023-11-28 16:50:22 +00:00
fs ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks 2023-11-28 16:50:21 +00:00
include netfilter: nf_tables: drop map element references from preparation phase 2023-11-28 16:50:22 +00:00
init
ipc
kernel tracing: Have trace_event_file have ref counters 2023-11-28 16:50:22 +00:00
lib kobject: Fix slab-out-of-bounds in fill_kobj_path() 2023-11-08 11:23:38 +01:00
LICENSES
mm mm/cma: use nth_page() in place of direct struct page manipulation 2023-11-28 16:50:19 +00:00
net netfilter: nf_tables: don't skip expired elements during walk 2023-11-28 16:50:22 +00:00
samples
scripts randstruct: Fix gcc-plugin performance mode to stay in group 2023-11-28 16:50:17 +00:00
security ima: rework CONFIG_IMA dependency block 2023-10-10 21:46:46 +02:00
sound ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC 2023-11-28 16:50:20 +00:00
tools tools/power/turbostat: Fix a knl bug 2023-11-28 16:50:17 +00:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.261 2023-11-20 10:30:17 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.