Commit 3ddbf7b6 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'nf-24-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

Patch #1 disable BH when collecting stats via hardware offload to ensure
         concurrent updates from packet path do not result in losing stats.
         From Sebastian Andrzej Siewior.

Patch #2 uses write seqcount to reset counters serialize against reader.
         Also from Sebastian Andrzej Siewior.

Patch #3 ensures vlan header is in place before accessing its fields,
         according to KMSAN splat triggered by syzbot.

* tag 'nf-24-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: flowtable: validate vlan header
  netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
  netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
====================

Link: https://patch.msgid.link/20240822101842.4234-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 2696c15c 6ea14ccb

net/netfilter/nf_flow_table_inet.c

+3 −0
Original line number Diff line number Diff line
@@ -17,6 +17,9 @@ nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb, 


	switch (skb->protocol) {

	case htons(ETH_P_8021Q):

		if (!pskb_may_pull(skb, skb_mac_offset(skb) + sizeof(*veth)))

			return NF_ACCEPT;



		veth = (struct vlan_ethhdr *)skb_mac_header(skb);

		proto = veth->h_vlan_encapsulated_proto;

		break;

net/netfilter/nf_flow_table_ip.c

+3 −0
Original line number Diff line number Diff line
@@ -281,6 +281,9 @@ static bool nf_flow_skb_encap_protocol(struct sk_buff *skb, __be16 proto, 


	switch (skb->protocol) {

	case htons(ETH_P_8021Q):

		if (!pskb_may_pull(skb, skb_mac_offset(skb) + sizeof(*veth)))

			return false;



		veth = (struct vlan_ethhdr *)skb_mac_header(skb);

		if (veth->h_vlan_encapsulated_proto == proto) {

			*offset += VLAN_HLEN;

net/netfilter/nft_counter.c

+7 −2
Original line number Diff line number Diff line
@@ -107,11 +107,16 @@ static void nft_counter_reset(struct nft_counter_percpu_priv *priv, 
			      struct nft_counter *total)

{

	struct nft_counter *this_cpu;

	seqcount_t *myseq;



	local_bh_disable();

	this_cpu = this_cpu_ptr(priv->counter);

	myseq = this_cpu_ptr(&nft_counter_seq);



	write_seqcount_begin(myseq);

	this_cpu->packets -= total->packets;

	this_cpu->bytes -= total->bytes;

	write_seqcount_end(myseq);

	local_bh_enable();

}
@@ -265,7 +270,7 @@ static void nft_counter_offload_stats(struct nft_expr *expr, 
	struct nft_counter *this_cpu;

	seqcount_t *myseq;



	preempt_disable();

	local_bh_disable();

	this_cpu = this_cpu_ptr(priv->counter);

	myseq = this_cpu_ptr(&nft_counter_seq);
@@ -273,7 +278,7 @@ static void nft_counter_offload_stats(struct nft_expr *expr, 
	this_cpu->packets += stats->pkts;

	this_cpu->bytes += stats->bytes;

	write_seqcount_end(myseq);

	preempt_enable();

	local_bh_enable();

}



void nft_counter_init_seqcount(void)