No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal cd4348e0a5 netfilter: nf_tables: prefer nft_chain_validate
commit cff3bd012a9512ac5ed858d38e6ed65f6391008c upstream.

nft_chain_validate already performs loop detection because a cycle will
result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE).

It also follows maps via ->validate callback in nft_lookup, so there
appears no reason to iterate the maps again.

nf_tables_check_loops() and all its helper functions can be removed.
This improves ruleset load time significantly, from 23s down to 12s.

This also fixes a crash bug. Old loop detection code can result in
unbounded recursion:

BUG: TASK stack guard page was hit at ....
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN
CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1
[..]

with a suitable ruleset during validation of register stores.

I can't see any actual reason to attempt to check for this from
nft_validate_register_store(), at this point the transaction is still in
progress, so we don't have a full picture of the rule graph.

For nf-next it might make sense to either remove it or make this depend
on table->validate_state in case we could catch an error earlier
(for improved error reporting to userspace).

Fixes: 20a69341f2 ("netfilter: nf_tables: add netlink set API")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-08-19 05:33:54 +02:00
arch x86/mtrr: Check if fixed MTRRs exist before saving them 2024-08-19 05:33:53 +02:00
block block: prevent division by zero in blk_rq_stat_sum() 2024-04-13 12:51:38 +02:00
certs
crypto crypto: ecrdsa - Fix module auto-load on add_key 2024-06-16 13:28:51 +02:00
Documentation arm64: errata: Expand speculative SSBS workaround (again) 2024-08-19 05:33:50 +02:00
drivers drm/mgag200: Set DDC timeout in milliseconds 2024-08-19 05:33:53 +02:00
fs ext4: fix wrong unit use in ext4_mb_find_by_goal 2024-08-19 05:33:48 +02:00
include netfilter: nf_tables: use timestamp to check for set element timeout 2024-08-19 05:33:53 +02:00
init init: open /initrd.image with O_LARGEFILE 2024-04-13 12:51:36 +02:00
ipc
kernel tracing: Fix overflow in get_free_elt() 2024-08-19 05:33:53 +02:00
lib kobject_uevent: Fix OOB access within zap_modalias_env() 2024-08-19 05:33:38 +02:00
LICENSES
mm mm: avoid overflows in dirty throttling logic 2024-08-19 05:33:42 +02:00
net netfilter: nf_tables: prefer nft_chain_validate 2024-08-19 05:33:54 +02:00
samples media: rename VFL_TYPE_GRABBER to _VIDEO 2024-03-26 18:22:22 -04:00
scripts kbuild: Fix '-S -c' in x86 stack protector scripts 2024-08-19 05:33:53 +02:00
security apparmor: Fix null pointer deref when receiving skb during sock creation 2024-08-19 05:33:42 +02:00
sound ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 2024-08-19 05:33:51 +02:00
tools selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT 2024-08-19 05:33:47 +02:00
usr
virt KVM: async_pf: Cleanup kvm_setup_async_pf() 2024-05-02 16:18:32 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.281 2024-07-27 10:38:33 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.