Commit b5cf67a8 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'nf-25-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Fix imbalance between flowtable BIND and UNBIND calls to configure
   hardware offload, this fixes a possible kmemleak.

2) Clamp maximum conntrack hashtable size to INT_MAX to fix a possible
   WARN_ON_ONCE splat coming from kvmalloc_array(), only possible from
   init_netns.

* tag 'nf-25-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: conntrack: clamp maximum hashtable size to INT_MAX
  netfilter: nf_tables: imbalance in flowtable binding
====================

Link: https://patch.msgid.link/20250109123532.41768-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 2664bc9c b541ba7d

net/netfilter/nf_conntrack_core.c

+4 −1
Original line number Diff line number Diff line
@@ -2517,12 +2517,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) 
	struct hlist_nulls_head *hash;

	unsigned int nr_slots, i;



	if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head)))

	if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head)))

		return NULL;



	BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head));

	nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head));



	if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head)))

		return NULL;



	hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL);



	if (hash && nulls)

net/netfilter/nf_tables_api.c

+11 −4
Original line number Diff line number Diff line
@@ -8822,6 +8822,7 @@ static void nft_unregister_flowtable_hook(struct net *net, 
}



static void __nft_unregister_flowtable_net_hooks(struct net *net,

						 struct nft_flowtable *flowtable,

						 struct list_head *hook_list,

					         bool release_netdev)

{
@@ -8829,6 +8830,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, 


	list_for_each_entry_safe(hook, next, hook_list, list) {

		nf_unregister_net_hook(net, &hook->ops);

		flowtable->data.type->setup(&flowtable->data, hook->ops.dev,

					    FLOW_BLOCK_UNBIND);

		if (release_netdev) {

			list_del(&hook->list);

			kfree_rcu(hook, rcu);
@@ -8837,9 +8840,10 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, 
}



static void nft_unregister_flowtable_net_hooks(struct net *net,

					       struct nft_flowtable *flowtable,

					       struct list_head *hook_list)

{

	__nft_unregister_flowtable_net_hooks(net, hook_list, false);

	__nft_unregister_flowtable_net_hooks(net, flowtable, hook_list, false);

}



static int nft_register_flowtable_net_hooks(struct net *net,
@@ -9481,8 +9485,6 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 


	flowtable->data.type->free(&flowtable->data);

	list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {

		flowtable->data.type->setup(&flowtable->data, hook->ops.dev,

					    FLOW_BLOCK_UNBIND);

		list_del_rcu(&hook->list);

		kfree_rcu(hook, rcu);

	}
@@ -10870,6 +10872,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
							   &nft_trans_flowtable_hooks(trans),

							   trans->msg_type);

				nft_unregister_flowtable_net_hooks(net,

								   nft_trans_flowtable(trans),

								   &nft_trans_flowtable_hooks(trans));

			} else {

				list_del_rcu(&nft_trans_flowtable(trans)->list);
@@ -10878,6 +10881,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
							   NULL,

							   trans->msg_type);

				nft_unregister_flowtable_net_hooks(net,

						nft_trans_flowtable(trans),

						&nft_trans_flowtable(trans)->hook_list);

			}

			break;
@@ -11140,11 +11144,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
		case NFT_MSG_NEWFLOWTABLE:

			if (nft_trans_flowtable_update(trans)) {

				nft_unregister_flowtable_net_hooks(net,

						nft_trans_flowtable(trans),

						&nft_trans_flowtable_hooks(trans));

			} else {

				nft_use_dec_restore(&table->use);

				list_del_rcu(&nft_trans_flowtable(trans)->list);

				nft_unregister_flowtable_net_hooks(net,

						nft_trans_flowtable(trans),

						&nft_trans_flowtable(trans)->hook_list);

			}

			break;
@@ -11737,7 +11743,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table) 
	list_for_each_entry(chain, &table->chains, list)

		__nf_tables_unregister_hook(net, table, chain, true);

	list_for_each_entry(flowtable, &table->flowtables, list)

		__nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,

		__nft_unregister_flowtable_net_hooks(net, flowtable,

						     &flowtable->hook_list,

						     true);

}