Eric Lee / smarc-fsl-linux-kernel

21 May, 2019

1 commit

  • 3a63cbb8d   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 3 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 or
    later as published by the free software foundation

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 9 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Steve Winslow
    Reviewed-by: Jilayne Lovejoy
    Reviewed-by: Allison Randal
    Reviewed-by: Kate Stewart
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190519154040.848507137@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

11 Oct, 2018

2 commits

  • 18c0ab873   netfilter: xt_TEE: add missing code to get interface index in checkentry. ... Browse Code »

    checkentry(tee_tg_check) should initialize priv->oif from dev if possible.
    But only netdevice notifier handler can set that.
    Hence priv->oif is always -1 until notifier handler is called.

    Fixes: 9e2f6c5d78db ("netfilter: Rework xt_TEE netdevice notifier")
    Signed-off-by: Taehee Yoo
    Signed-off-by: Pablo Neira Ayuso

    Taehee Yoo
     
  • f24d2d4f9   netfilter: xt_TEE: fix wrong interface selection ... Browse Code »

    TEE netdevice notifier handler checks only interface name. however
    each netns can have same interface name. hence other netns's interface
    could be selected.

    test commands:
    %ip netns add vm1
    %iptables -I INPUT -p icmp -j TEE --gateway 192.168.1.1 --oif enp2s0
    %ip link set enp2s0 netns vm1

    Above rule is in the root netns. but that rule could get enp2s0
    ifindex of vm1 by notifier handler.

    After this patch, TEE rule is added to the per-netns list.

    Fixes: 9e2f6c5d78db ("netfilter: Rework xt_TEE netdevice notifier")
    Signed-off-by: Taehee Yoo
    Signed-off-by: Pablo Neira Ayuso

    Taehee Yoo
     

17 Jul, 2018

1 commit

  • 5d400a493   netfilter: Kconfig: Change select IPv6 dependencies ... Browse Code »

    ... from IPV6 to NF_TABLES_IPV6 and IP6_NF_IPTABLES.

    In some cases module selects depend on IPV6, but this means that they
    select another module even if eg. NF_TABLES_IPV6 is not set in which
    case the selected module is useless due to the lack of IPv6 nf_tables
    functionality.

    The same applies for IP6_NF_IPTABLES and iptables.

    Joint work with: Arnd Bermann

    Signed-off-by: Máté Eckl
    Signed-off-by: Pablo Neira Ayuso

    Máté Eckl
     

30 Mar, 2018

1 commit

  • 9e2f6c5d7   netfilter: Rework xt_TEE netdevice notifier ... Browse Code »

    Register netdevice notifier for every iptable entry
    is not good, since this breaks modularity, and
    the hidden synchronization is based on rtnl_lock().

    This patch reworks the synchronization via new lock,
    while the rest of logic remains as it was before.
    This is required for the next patch.

    Tested via:

    while :; do
    unshare -n iptables -t mangle -A OUTPUT -j TEE --gateway 1.1.1.2 --oif lo;
    done

    Signed-off-by: Kirill Tkhai
    Acked-by: Pablo Neira Ayuso
    Signed-off-by: David S. Miller

    Kirill Tkhai
     

10 Jan, 2017

1 commit

  • ec2318904   xtables: extend matches and targets with .usersize ... Browse Code »

    In matches and targets that define a kernel-only tail to their
    xt_match and xt_target data structs, add a field .usersize that
    specifies up to where data is to be shared with userspace.

    Performed a search for comment "Used internally by the kernel" to find
    relevant matches and targets. Manually inspected the structs to derive
    a valid offsetof.

    Signed-off-by: Willem de Bruijn
    Signed-off-by: Pablo Neira Ayuso

    Willem de Bruijn
     

03 Nov, 2016

1 commit

13 Sep, 2016

1 commit

08 Feb, 2016

1 commit

  • 08a7f5d3f   netfilter: tee: select NF_DUP_IPV6 unconditionally ... Browse Code »

    The NETFILTER_XT_TARGET_TEE option selects NF_DUP_IPV6 whenever
    IP6_NF_IPTABLES is enabled, and it ensures that it cannot be
    builtin itself if NF_CONNTRACK is a loadable module, as that
    is a dependency for NF_DUP_IPV6.

    However, NF_DUP_IPV6 can be enabled even if IP6_NF_IPTABLES is
    turned off, and it only really depends on IPV6. With the current
    check in tee_tg6, we call nf_dup_ipv6() whenever NF_DUP_IPV6
    is enabled. This can however be a loadable module which is
    unreachable from a built-in xt_TEE:

    net/built-in.o: In function `tee_tg6':
    :(.text+0x67728): undefined reference to `nf_dup_ipv6'

    The bug was originally introduced in the split of the xt_TEE module
    into separate modules for ipv4 and ipv6, and two patches tried
    to fix it unsuccessfully afterwards.

    This is a revert of the the first incorrect attempt to fix it,
    going back to depending on IPV6 as the dependency, and we
    adapt the 'select' condition accordingly.

    Signed-off-by: Arnd Bergmann
    Fixes: bbde9fc1824a ("netfilter: factor out packet duplication for IPv4/IPv6")
    Fixes: 116984a316c3 ("netfilter: xt_TEE: use IS_ENABLED(CONFIG_NF_DUP_IPV6)")
    Fixes: 74ec4d55c4d2 ("netfilter: fix xt_TEE and xt_TPROXY dependencies")
    Signed-off-by: Pablo Neira Ayuso

    Arnd Bergmann
     

05 Nov, 2015

1 commit

  • d9c7dbc11   Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Browse Code »

    Conflicts:
    net/netfilter/xt_TEE.c

    Pablo Neira Ayuso says:

    ====================
    Netfilter fixes for net

    The following patchset contains Netfilter fixes for your net tree,
    they are:

    1) Fix crash when TEE target is used with no --oif, from Eric Dumazet.

    2) Oneliner to fix a crash on the redirect traffic to localhost
    infrastructure when interface has not yet an address, from
    Munehisa Kamata.

    3) Oneliner not to request module all the time from nfnetlink due to
    wrong type value, from Florian Westphal.

    I'll make sure these patches 1 and 2 hit -stable.
    ====================

    The conflict in net/netfilter/xt_TEE.c was minor, a change
    to the 'oif' selection overlapping a function signature
    change for the nf_dup_ipv{4,6}() routines.

    Signed-off-by: David S. Miller

    David S. Miller
     

22 Oct, 2015

1 commit

  • 45efccdbe   netfilter: xt_TEE: fix NULL dereference ... Browse Code »

    iptables -I INPUT ... -j TEE --gateway 10.1.2.3

    because --oif was not specified

    tee_tg_check() sets ->priv pointer to NULL in this case.

    Fixes: bbde9fc1824a ("netfilter: factor out packet duplication for IPv4/IPv6")
    Signed-off-by: Eric Dumazet
    Signed-off-by: Pablo Neira Ayuso

    Eric Dumazet
     

19 Sep, 2015

1 commit

22 Aug, 2015

1 commit

  • 116984a31   netfilter: xt_TEE: use IS_ENABLED(CONFIG_NF_DUP_IPV6) ... Browse Code »

    Instead of IS_ENABLED(CONFIG_IPV6), otherwise we hit:

    et/built-in.o: In function `tee_tg6':
    >> xt_TEE.c:(.text+0x6cd8c): undefined reference to `nf_dup_ipv6'

    when:

    CONFIG_IPV6=y
    CONFIG_NF_DUP_IPV4=y
    # CONFIG_NF_DUP_IPV6 is not set
    CONFIG_NETFILTER_XT_TARGET_TEE=y

    Reported-by: kbuild test robot
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     

07 Aug, 2015

2 commits

16 Jul, 2015

2 commits

  • dcebd3153   netfilter: add and use jump label for xt_tee ... Browse Code »

    Don't bother testing if we need to switch to alternate stack
    unless TEE target is used.

    Suggested-by: Eric Dumazet
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • e7c8899f3   netfilter: move tee_active to core ... Browse Code »

    This prepares for a TEE like expression in nftables.
    We want to ensure only one duplicate is sent, so both will
    use the same percpu variable to detect duplication.

    The other use case is detection of recursive call to xtables, but since
    we don't want dependency from nft to xtables core its put into core.c
    instead of the x_tables core.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

26 May, 2015

1 commit

  • 48e8aa6e3   ipv6: Set FLOWI_FLAG_KNOWN_NH at flowi6_flags ... Browse Code »

    The neighbor look-up used to depend on the rt6i_gateway (if
    there is a gateway) or the rt6i_dst (if it is a RTF_CACHE clone)
    as the nexthop address. Note that rt6i_dst is set to fl6->daddr
    for the RTF_CACHE clone where fl6->daddr is the one used to do
    the route look-up.

    Now, we only create RTF_CACHE clone after encountering exception.
    When doing the neighbor look-up with a route that is neither a gateway
    nor a RTF_CACHE clone, the daddr in skb will be used as the nexthop.

    In some cases, the daddr in skb is not the one used to do
    the route look-up. One example is in ip_vs_dr_xmit_v6() where the
    real nexthop server address is different from the one in the skb.

    This patch is going to follow the IPv4 approach and ask the
    ip6_pol_route() callers to set the FLOWI_FLAG_KNOWN_NH properly.

    In the next patch, ip6_pol_route() will honor the FLOWI_FLAG_KNOWN_NH
    and create a RTF_CACHE clone.

    Signed-off-by: Martin KaFai Lau
    Acked-by: Julian Anastasov
    Tested-by: Julian Anastasov
    Cc: Hannes Frederic Sowa
    Cc: Steffen Klassert
    Signed-off-by: David S. Miller

    Martin KaFai Lau
     

29 May, 2013

1 commit

  • 351638e7d   net: pass info struct via netdevice notifier ... Browse Code »

    So far, only net_device * could be passed along with netdevice notifier
    event. This patch provides a possibility to pass custom structure
    able to provide info that event listener needs to know.

    Signed-off-by: Jiri Pirko

    v2->v3: fix typo on simeth
    shortened dev_getter
    shortened notifier_info struct name
    v1->v2: fix notifier_call parameter in call_netdevice_notifier()
    Signed-off-by: David S. Miller

    Jiri Pirko
     

17 Oct, 2012

1 commit

  • 2ad5b9e4b   netfilter: xt_TEE: don't use destination address found in header ... Browse Code »

    Torsten Luettgert bisected TEE regression starting with commit
    f8126f1d5136be1 (ipv4: Adjust semantics of rt->rt_gateway.)

    The problem is that it tries to ARP-lookup the original destination
    address of the forwarded packet, not the address of the gateway.

    Fix this using FLOWI_FLAG_KNOWN_NH Julian added in commit
    c92b96553a80c1 (ipv4: Add FLOWI_FLAG_KNOWN_NH), so that known
    nexthop (info->gw.ip) has preference on resolving.

    Reported-by: Torsten Luettgert
    Bisected-by: Torsten Luettgert
    Tested-by: Torsten Luettgert
    Cc: Julian Anastasov
    Signed-off-by: Eric Dumazet
    Signed-off-by: Pablo Neira Ayuso

    Eric Dumazet
     

15 May, 2012

1 commit

  • 19e8d69c5   net: replace percpu_xxx funcs with this_cpu_xxx or __this_cpu_xxx ... Browse Code »

    percpu_xxx funcs are duplicated with this_cpu_xxx funcs, so replace
    them for further code clean up.

    And in preempt safe scenario, __this_cpu_xxx funcs may has a bit
    better performance since __this_cpu_xxx has no redundant
    preempt_enable/preempt_disable on some architectures.

    Signed-off-by: Alex Shi
    Acked-by: Eric Dumazet
    Acked-by: David S. Miller
    Cc: Patrick McHardy
    Signed-off-by: Andrew Morton
    Signed-off-by: Tejun Heo

    Alex Shi
     

23 Feb, 2012

1 commit

17 Dec, 2011

1 commit

12 Dec, 2011

1 commit

13 Mar, 2011

3 commits

03 Mar, 2011

1 commit

18 Nov, 2010

1 commit

15 Jun, 2010

1 commit

11 Jun, 2010

1 commit

08 Jun, 2010

1 commit

  • 5bfddbd46   netfilter: nf_conntrack: IPS_UNTRACKED bit ... Browse Code »

    NOTRACK makes all cpus share a cache line on nf_conntrack_untracked
    twice per packet. This is bad for performance.
    __read_mostly annotation is also a bad choice.

    This patch introduces IPS_UNTRACKED bit so that we can use later a
    per_cpu untrack structure more easily.

    A new helper, nf_ct_untracked_get() returns a pointer to
    nf_conntrack_untracked.

    Another one, nf_ct_untracked_status_or() is used by nf_nat_init() to add
    IPS_NAT_DONE_MASK bits to untracked status.

    nf_ct_is_untracked() prototype is changed to work on a nf_conn pointer.

    Signed-off-by: Eric Dumazet
    Signed-off-by: Patrick McHardy

    Eric Dumazet
     

28 May, 2010

1 commit

  • 50636af71   xt_tee: use skb_dst_drop() ... Browse Code »

    After commit 7fee226a (net: add a noref bit on skb dst), its wrong to
    use : dst_release(skb_dst(skb)), since we could decrement a refcount
    while skb dst was not refcounted.

    We should use skb_dst_drop(skb) instead.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

12 May, 2010

1 commit

20 Apr, 2010

1 commit

19 Apr, 2010

2 commits