microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/net/netfilter
История
Jakub Kicinski dac1dc7e4d Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 
Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

1) netlink socket notifier might win race to release objects that are
   already pending to be released via commit release path, reported by
   syzbot.

2) No need to postpone flow rule release to commit release path, this
   triggered the syzbot report, complementary fix to previous patch.

3) Use explicit signed chars in IPVS to unbreak arm, from Jason A. Donenfeld.

4) Missing check for proc entry creation failure in IPVS, from Zhengchao Shao.

5) Incorrect error path handling when BPF NAT fails to register, from
   Chen Zhongjin.

6) Prevent huge memory allocation in ipset hash types, from Jozsef Kadlecsik.

Except the incorrect BPF NAT error path which is broken in 6.1-rc, anything
else has been broken for several releases.

* git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: ipset: enforce documented limit to prevent allocating huge memory
  netfilter: nf_nat: Fix possible memory leak in nf_nat_init()
  ipvs: fix WARNING in ip_vs_app_net_cleanup()
  ipvs: fix WARNING in __ip_vs_cleanup_batch()
  ipvs: use explicitly signed chars
  netfilter: nf_tables: release flow rule object from commit path
  netfilter: nf_tables: netlink notifier might race to release objects
====================

Link: https://lore.kernel.org/r/20221102184659.2502-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		2022-11-02 19:46:42 -07:00
..
ipset netfilter: ipset: enforce documented limit to prevent allocating huge memory 2022-11-02 19:22:23 +01:00
ipvs ipvs: fix WARNING in ip_vs_app_net_cleanup() 2022-11-02 09:39:14 +01:00
Kconfig netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y 2022-08-17 08:46:30 +02:00
Makefile net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c 2022-10-03 09:17:32 -07:00
core.c Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
nf_conncount.c netfilter: nf_conncount: reduce unnecessary GC 2022-05-16 13:05:40 +02:00
nf_conntrack_acct.c
…
nf_conntrack_amanda.c
…
nf_conntrack_bpf.c net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c 2022-10-03 09:17:32 -07:00
nf_conntrack_broadcast.c netfilter: nf_conntrack: use rcu accessors where needed 2022-07-11 16:25:15 +02:00
nf_conntrack_core.c Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2022-10-03 13:02:49 -07:00
nf_conntrack_ecache.c netfilter: conntrack: add nf_conntrack_events autodetect mode 2022-05-13 18:56:28 +02:00
nf_conntrack_expect.c
…
nf_conntrack_extend.c netfilter: extensions: introduce extension genid count 2022-05-13 18:52:16 +02:00
nf_conntrack_ftp.c netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed 2022-09-20 23:50:03 +02:00
nf_conntrack_h323_asn1.c
…
nf_conntrack_h323_main.c netfilter: nf_ct_h323: cap packet size at 64k 2022-08-11 16:50:49 +02:00
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c netfilter: remove nf_conntrack_helper sysctl and modparam toggles 2022-08-31 12:12:32 +02:00
nf_conntrack_irc.c netfilter: nf_conntrack_irc: Tighten matching on DCC message 2022-09-07 15:55:23 +02:00
nf_conntrack_labels.c
…
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c netfilter: remove nf_conntrack_helper sysctl and modparam toggles 2022-08-31 12:12:32 +02:00
nf_conntrack_pptp.c netfilter: nf_conntrack: add missing __rcu annotations 2022-07-11 16:25:15 +02:00
nf_conntrack_proto.c netfilter: conntrack: add nf_ct_iter_data object for nf_ct_iterate_cleanup*() 2022-05-13 18:56:27 +02:00
nf_conntrack_proto_dccp.c
…
nf_conntrack_proto_generic.c
…
nf_conntrack_proto_gre.c
…
nf_conntrack_proto_icmp.c
…
nf_conntrack_proto_icmpv6.c
…
nf_conntrack_proto_sctp.c
…
nf_conntrack_proto_tcp.c netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst 2022-09-07 16:46:03 +02:00
nf_conntrack_proto_udp.c Revert "netfilter: conntrack: mark UDP zero checksum as CHECKSUM_UNNECESSARY" 2022-03-03 13:35:22 +01:00
nf_conntrack_sane.c netfilter: nf_ct_sane: remove pseudo skb linearization 2022-08-11 16:50:25 +02:00
nf_conntrack_seqadj.c
…
nf_conntrack_sip.c netfilter: nf_conntrack_sip: fix ct_sip_walk_headers 2022-09-07 15:06:26 +02:00
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c netfilter: remove nf_conntrack_helper sysctl and modparam toggles 2022-08-31 12:12:32 +02:00
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c netfilter: nf_conntrack: use rcu accessors where needed 2022-07-11 16:25:15 +02:00
nf_conntrack_timestamp.c
…
nf_dup_netdev.c netfilter: nf_dup_netdev: add and use recursion counter 2022-06-21 10:50:41 +02:00
nf_flow_table_core.c netfilter: flowtable: fix stuck flows on cleanup due to pending work 2022-08-24 07:43:21 +02:00
nf_flow_table_inet.c netfilter: flowtable: Fix QinQ and pppoe support for inet table 2022-03-16 11:25:04 +01:00
nf_flow_table_ip.c netfilter: flowtable: move dst_check to packet path 2022-05-18 17:34:26 +02:00
nf_flow_table_offload.c netfilter: flowtable: fix stuck flows on cleanup due to pending work 2022-08-24 07:43:21 +02:00
nf_flow_table_procfs.c netfilter: nf_flow_table: count pending offload workqueue tasks 2022-07-11 16:25:14 +02:00
nf_hooks_lwtunnel.c
…
nf_internals.h
…
nf_log.c netfilter: move from strlcpy with unused retval to strscpy 2022-09-07 16:46:03 +02:00
nf_log_syslog.c netfilter: nf_log: incorrect offset to network header 2022-07-09 09:55:43 +02:00
nf_nat_amanda.c netfilter: nat: move repetitive nat port reserve loop to a helper 2022-09-07 16:46:04 +02:00
nf_nat_bpf.c net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c 2022-10-03 09:17:32 -07:00
nf_nat_core.c netfilter: nf_nat: Fix possible memory leak in nf_nat_init() 2022-11-02 10:47:22 +01:00
nf_nat_ftp.c netfilter: nat: move repetitive nat port reserve loop to a helper 2022-09-07 16:46:04 +02:00
nf_nat_helper.c netfilter: nat: avoid long-running port range loop 2022-09-07 16:46:04 +02:00
nf_nat_irc.c netfilter: nat: move repetitive nat port reserve loop to a helper 2022-09-07 16:46:04 +02:00
nf_nat_masquerade.c netfilter: conntrack: add nf_ct_iter_data object for nf_ct_iterate_cleanup*() 2022-05-13 18:56:27 +02:00
nf_nat_proto.c
…
nf_nat_redirect.c
…
nf_nat_sip.c netfilter: nat: move repetitive nat port reserve loop to a helper 2022-09-07 16:46:04 +02:00
nf_nat_tftp.c
…
nf_queue.c netfilter: nf_queue: handle socket prefetch 2022-03-01 11:51:15 +01:00
nf_sockopt.c
…
nf_synproxy_core.c ip: Fix data-races around sysctl_ip_default_ttl. 2022-07-15 11:49:55 +01:00
nf_tables_api.c netfilter: nf_tables: release flow rule object from commit path 2022-11-01 12:19:47 +01:00
nf_tables_core.c netfilter: nf_tables: fix crash when nf_trace is enabled 2022-08-05 18:50:14 -07:00
nf_tables_offload.c netfilter: nf_tables: bail out early if hardware offload is not supported 2022-06-06 19:19:15 +02:00
nf_tables_trace.c netfilter: nf_tables: avoid skb access on nf_stolen 2022-06-27 19:22:54 +02:00
nfnetlink.c netfilter: nfnetlink: re-enable conntrack expectation events 2022-08-11 18:09:54 +02:00
nfnetlink_acct.c
…
nfnetlink_cthelper.c netfilter: nf_conntrack: use rcu accessors where needed 2022-07-11 16:25:15 +02:00
nfnetlink_cttimeout.c netfilter: cttimeout: fix slab-out-of-bounds read typo in cttimeout_net_exit 2022-06-17 23:31:20 +02:00
nfnetlink_hook.c Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
nfnetlink_log.c net: Get rcv tstamp if needed in nfnetlink_{log, queue}.c 2022-03-03 14:38:48 +00:00
nfnetlink_osf.c netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() 2022-09-07 15:55:28 +02:00
nfnetlink_queue.c netfilter: nf_queue: do not allow packet truncation below transport header offset 2022-07-26 21:12:42 +02:00
nft_bitwise.c netfilter: nf_tables: upfront validation of data via nft_data_init() 2022-08-09 20:13:29 +02:00
nft_byteorder.c netfilter: nf_tables: use the correct get/put helpers 2022-07-11 16:40:46 +02:00
nft_chain_filter.c
…
nft_chain_nat.c
…
nft_chain_route.c
…
nft_cmp.c netfilter: nf_tables: upfront validation of data via nft_data_init() 2022-08-09 20:13:29 +02:00
nft_compat.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_connlimit.c netfilter: nf_tables: memcg accounting for dynamically allocated objects 2022-04-05 11:55:46 +02:00
nft_counter.c netfilter: nf_tables: memcg accounting for dynamically allocated objects 2022-04-05 11:55:46 +02:00
nft_ct.c netfilter: remove nf_conntrack_helper sysctl and modparam toggles 2022-08-31 12:12:32 +02:00
nft_dup_netdev.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_dynset.c netfilter: nf_tables: validate variable length element extension 2022-08-09 19:38:16 +02:00
nft_exthdr.c netfilter: nf_tables: use correct integer types 2022-07-11 16:40:46 +02:00
nft_fib.c netfilter: nft_fib: reverse path filter for policy-based routing on iif 2022-04-11 12:10:09 +02:00
nft_fib_inet.c netfilter: nft_fib: add reduce support 2022-03-20 00:29:47 +01:00
nft_fib_netdev.c netfilter: nft_fib: add reduce support 2022-03-20 00:29:47 +01:00
nft_flow_offload.c netfilter: flowtable: fix nft_flow_route source address for nat case 2022-05-31 23:32:53 +02:00
nft_fwd_netdev.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_hash.c netfilter: nft_hash: track register operations 2022-03-20 00:29:47 +01:00
nft_immediate.c netfilter: nf_tables: upfront validation of data via nft_data_init() 2022-08-09 20:13:29 +02:00
nft_last.c netfilter: nf_tables: memcg accounting for dynamically allocated objects 2022-04-05 11:55:46 +02:00
nft_limit.c netfilter: nft_limit: Clone packet limits' cost value 2022-05-26 22:50:34 +02:00
nft_log.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_lookup.c netfilter: nft_lookup: only cancel tracking for clobbered dregs 2022-03-20 00:29:46 +01:00
nft_masq.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_meta.c netfilter: use get_random_u32 instead of prandom 2022-06-08 12:30:59 +02:00
nft_nat.c netfilter: nat: really support inet nat without l3 address 2022-06-01 15:53:39 +02:00
nft_numgen.c netfilter: use get_random_u32 instead of prandom 2022-06-08 12:30:59 +02:00
nft_objref.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_osf.c netfilter: move from strlcpy with unused retval to strscpy 2022-09-07 16:46:03 +02:00
nft_payload.c netlink: introduce bigendian integer types 2022-11-01 21:29:06 -07:00
nft_queue.c netfilter: nft_queue: only allow supported familes and hooks 2022-07-26 21:12:42 +02:00
nft_quota.c netfilter: nf_tables: memcg accounting for dynamically allocated objects 2022-04-05 11:55:46 +02:00
nft_range.c netfilter: nf_tables: upfront validation of data via nft_data_init() 2022-08-09 20:13:29 +02:00
nft_redir.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_reject.c
…
nft_reject_inet.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_reject_netdev.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_rt.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_set_bitmap.c netfilter: nft_set_bitmap: Fix spelling mistake 2022-07-11 16:40:37 +02:00
nft_set_hash.c netfilter: nft_dynset: restore set element counter when failing to update 2022-06-27 19:03:37 +02:00
nft_set_pipapo.c netfilter: nft_set_pipapo: release elements in clone from abort path 2022-07-02 21:04:19 +02:00
nft_set_pipapo.h
…
nft_set_pipapo_avx2.c
…
nft_set_pipapo_avx2.h
…
nft_set_rbtree.c netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion 2022-04-22 15:49:15 +02:00
nft_socket.c cgroup: Replace cgroup->ancestor_ids[] with ->ancestors[] 2022-08-15 11:16:47 -10:00
nft_synproxy.c netfilter: nf_tables: do not reduce read-only expressions 2022-03-20 00:29:46 +01:00
nft_tproxy.c netfilter: nft_tproxy: restrict to prerouting hook 2022-08-23 21:24:34 +02:00
nft_tunnel.c netfilter: nft_tunnel: restrict it to netdev family 2022-08-24 07:43:21 +02:00
nft_xfrm.c netfilter: nf_tables: use the correct get/put helpers 2022-07-11 16:40:46 +02:00
utils.c
…
x_tables.c netfilter: move from strlcpy with unused retval to strscpy 2022-09-07 16:46:03 +02:00
xt_AUDIT.c
…
xt_CHECKSUM.c
…
xt_CLASSIFY.c
…
xt_CONNSECMARK.c
…
xt_CT.c netfilter: nf_conntrack: use rcu accessors where needed 2022-07-11 16:25:15 +02:00
xt_DSCP.c netfilter: x_tables: use correct integer types 2022-07-11 16:40:45 +02:00
xt_HL.c
…
xt_HMARK.c
…
xt_IDLETIMER.c
…
xt_LED.c
…
xt_LOG.c
…
xt_MASQUERADE.c
…
xt_NETMAP.c
…
xt_NFLOG.c
…
xt_NFQUEUE.c
…
xt_RATEEST.c netfilter: move from strlcpy with unused retval to strscpy 2022-09-07 16:46:03 +02:00
xt_REDIRECT.c
…
xt_SECMARK.c
…
xt_TCPMSS.c netfilter: x_tables: use correct integer types 2022-07-11 16:40:45 +02:00
xt_TCPOPTSTRIP.c
…
xt_TEE.c
…
xt_TPROXY.c netfilter: xt_TPROXY: remove pr_debug invocations 2022-07-21 00:56:00 +02:00
xt_TRACE.c
…
xt_addrtype.c
…
xt_bpf.c
…
xt_cgroup.c
…
xt_cluster.c
…
xt_comment.c
…
xt_connbytes.c
…
xt_connlabel.c
…
xt_connlimit.c netfilter: x_tables: use correct integer types 2022-07-11 16:40:45 +02:00
xt_connmark.c
…
xt_conntrack.c
…
xt_cpu.c
…
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c
…
xt_helper.c
…
xt_hl.c
…
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c
…
xt_l2tp.c
…
xt_length.c
…
xt_limit.c
…
xt_mac.c
…
xt_mark.c
…
xt_multiport.c
…
xt_nat.c
…
xt_nfacct.c
…
xt_osf.c
…
xt_owner.c
…
xt_physdev.c
…
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_realm.c
…
xt_recent.c
…
xt_repldata.h
…
xt_sctp.c
…
xt_set.c
…
xt_socket.c
…
xt_state.c
…
xt_statistic.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
xt_string.c
…
xt_tcpmss.c
…
xt_tcpudp.c
…
xt_time.c
…
xt_u32.c
…