Eric Lee / smarc-fsl-linux-kernel

20 Mar, 2018

4 commits

  • 8039ab43e   netfilter: cttimeout: remove VLA usage ... Browse Code »

    In preparation to enabling -Wvla, remove VLA and replace it
    with dynamic memory allocation.

    >From a security viewpoint, the use of Variable Length Arrays can be
    a vector for stack overflow attacks. Also, in general, as the code
    evolves it is easy to lose track of how big a VLA can get. Thus, we
    can end up having segfaults that are hard to debug.

    Also, fixed as part of the directive to remove all VLAs from
    the kernel: https://lkml.org/lkml/2018/3/7/621

    While at it, remove likely() notation which is not necessary from the
    control plane code.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: Pablo Neira Ayuso

    Gustavo A. R. Silva
     
  • d719e3f21   netfilter: nft_ct: add NFT_CT_{SRC,DST}_{IP,IP6} ... Browse Code »

    All existing keys, except the NFT_CT_SRC and NFT_CT_DST are assumed to
    have strict datatypes. This is causing problems with sets and
    concatenations given the specific length of these keys is not known.

    Signed-off-by: Pablo Neira Ayuso
    Acked-by: Florian Westphal

    Pablo Neira Ayuso
     
  • 35d8deb80   netfilter: conncount: Support count only use case ... Browse Code »

    Currently, nf_conncount_count() counts the number of connections that
    matches key and inserts a conntrack 'tuple' with the same key into the
    accounting data structure. This patch supports another use case that only
    counts the number of connections where 'tuple' is not provided. Therefore,
    proper changes are made on nf_conncount_count() to support the case where
    'tuple' is NULL. This could be useful for querying statistics or
    debugging purpose.

    Signed-off-by: Yi-Hung Wei
    Acked-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Yi-Hung Wei
     
  • 6aec20878   netfilter: Refactor nf_conncount ... Browse Code »

    Remove parameter 'family' in nf_conncount_count() and count_tree().
    It is because the parameter is not useful after commit 625c556118f3
    ("netfilter: connlimit: split xt_connlimit into front and backend").

    Signed-off-by: Yi-Hung Wei
    Acked-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Yi-Hung Wei
     

14 Mar, 2018

2 commits

06 Mar, 2018

28 commits

05 Mar, 2018

6 commits

  • 229952d19   Merge branch 'convert-pernet_operations-part4' ... Browse Code »

    Kirill Tkhai says:

    ====================
    Converting pernet_operations (part #4)

    this series continues to review and to convert pernet_operations
    to make them possible to be executed in parallel for several
    net namespaces in the same time. The patches touch mostly netfilter,
    also there are small number of changes in other places.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • c29babb7f   net: Convert proto_gre_net_ops ... Browse Code »

    These pernet_operations register and unregister sysctl.
    nf_conntrack_l4proto_gre4->init_net is simple memory
    initializer. Also, exit method removes gre keymap_list,
    which is per-net. This looks safe to be executed
    in parallel with other pernet_operations.

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     
  • b04a3d098   net: Convert ctnetlink_net_ops ... Browse Code »

    These pernet_operations register and unregister
    two conntrack notifiers, and they seem to be safe
    to be executed in parallel.

    General/not related to async pernet_operations JFI:
    ctnetlink_net_exit_batch() actions are grouped in batch,
    and this could look like there is synchronize_rcu()
    is forgotten. But there is synchronize_rcu() on module
    exit patch (in ctnetlink_exit()), so this batch may
    be reworked as simple .exit method.

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     
  • 467d14b30   net: Convert nf_conntrack_net_ops ... Browse Code »

    These pernet_operations register and unregister sysctl and /proc
    entries. Exit batch method also waits till all per-net conntracks
    are dead. Thus, they are safe to be marked as async.

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     
  • a5a179b6d   net: Convert ip_set_net_ops ... Browse Code »

    These pernet_operations initialize and destroy
    net_generic(net, ip_set_net_id)-related data.
    Since ip_set is under CONFIG_IP_SET, it's easy
    to watch drivers, which depend on this config.
    All of them are in net/netfilter/ipset directory,
    except of net/netfilter/xt_set.c. There are no
    more drivers, which use ip_set, and all of
    the above don't register another pernet_operations.
    Also, there are is no indirect users, as header
    file include/linux/netfilter/ipset/ip_set.h does
    not define indirect users by something like this:

    #ifdef CONFIG_IP_SET
    extern func(void);
    #else
    static inline func(void);
    #endif

    So, there are no more pernet operations, dereferencing
    net_generic(net, ip_set_net_id).

    ip_set_net_ops are OK to be executed in parallel
    for several net, so we mark them as async.

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai
     
  • 6c6c566e6   net: Convert fou_net_ops ... Browse Code »

    These pernet_operations initialize and destroy
    pernet net_generic(net, fou_net_id) list.
    The rest of net_generic(net, fou_net_id) accesses
    may happen after netlink message, and in-tree
    pernet_operations do not send FOU_GENL_NAME messages.
    So, these pernet_operations are safe to be marked
    as async.

    Signed-off-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    Kirill Tkhai