Merge tag 'nf-23-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

This patch contains two late Netfilter's flowtable fixes for net:

1) Flowtable GC pushes back packets to classic path in every GC run,
   ie. every second. This is because NF_FLOW_HW_ESTABLISHED is only
   used by sched/act_ct (never set) and IPS_SEEN_REPLY might be unset
   by the time the flow is offloaded (this status bit is only reliable
   in the sched/act_ct datapath).

2) sched/act_ct logic to push back packets to classic path to reevaluate
   if UDP flow is unidirectional only applies if IPS_HW_OFFLOAD_BIT is
   set on and no hardware offload request is pending to be handled.
   From Vlad Buslov.

These two patches fixes two problems that were introduced in the
previous 6.5 development cycle.

* tag 'nf-23-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  net/sched: act_ct: additional checks for outdated flows
  netfilter: flowtable: GC pushes back packets to classic path
====================

Link: https://lore.kernel.org/r/20231025100819.2664-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 05d562e..44b19e6 100644 (file)
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -54,7 +54,7 @@ static int cn_filter(struct sock *dsk, struct sk_buff *skb, void *data)
        enum proc_cn_mcast_op mc_op;
        uintptr_t val;
 
-       if (!dsk || !data)
+       if (!dsk || !dsk->sk_user_data || !data)
                return 0;
 
        ptr = (__u32 *)data;

diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index 1efd179..b82b898 100644 (file)
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -678,7 +678,7 @@ ph_state(struct dchannel *dch)
 }
 
 /*
- * disable/enable BChannel for desired protocoll
+ * disable/enable BChannel for desired protocol
  */
 static int
 hfcsusb_setup_bch(struct bchannel *bch, int protocol)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 50c70a8..b047c58 100644 (file)
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2854,7 +2854,7 @@ tx_only:
                return budget;
        }
 
-       if (vsi->back->flags & I40E_TXR_FLAGS_WB_ON_ITR)
+       if (q_vector->tx.ring[0].flags & I40E_TXR_FLAGS_WB_ON_ITR)
                q_vector->arm_wb_state = false;
 
        /* Exit the polling mode, but don't re-enable interrupts if stack might

diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
index 834f000..30ebef8 100644 (file)
--- a/drivers/net/ethernet/sfc/tc.c
+++ b/drivers/net/ethernet/sfc/tc.c
@@ -629,14 +629,14 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx,
                        }
                        if (child_ip_tos_mask != old->child_ip_tos_mask) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Pseudo encap match for TOS mask %#04x conflicts with existing pseudo(MASK) entry for TOS mask %#04x",
+                                                      "Pseudo encap match for TOS mask %#04x conflicts with existing mask %#04x",
                                                       child_ip_tos_mask,
                                                       old->child_ip_tos_mask);
                                return -EEXIST;
                        }
                        if (child_udp_sport_mask != old->child_udp_sport_mask) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Pseudo encap match for UDP src port mask %#x conflicts with existing pseudo(MASK) entry for mask %#x",
+                                                      "Pseudo encap match for UDP src port mask %#x conflicts with existing mask %#x",
                                                       child_udp_sport_mask,
                                                       old->child_udp_sport_mask);
                                return -EEXIST;
@@ -1081,7 +1081,7 @@ static int efx_tc_pedit_add(struct efx_nic *efx, struct efx_tc_action_set *act,
                        /* check that we do not decrement ttl twice */
                        if (!efx_tc_flower_action_order_ok(act,
                                                           EFX_TC_AO_DEC_TTL)) {
-                               NL_SET_ERR_MSG_MOD(extack, "Unsupported: multiple dec ttl");
+                               NL_SET_ERR_MSG_MOD(extack, "multiple dec ttl are not supported");
                                return -EOPNOTSUPP;
                        }
                        act->do_ttl_dec = 1;
@@ -1106,7 +1106,7 @@ static int efx_tc_pedit_add(struct efx_nic *efx, struct efx_tc_action_set *act,
                        /* check that we do not decrement hoplimit twice */
                        if (!efx_tc_flower_action_order_ok(act,
                                                           EFX_TC_AO_DEC_TTL)) {
-                               NL_SET_ERR_MSG_MOD(extack, "Unsupported: multiple dec ttl");
+                               NL_SET_ERR_MSG_MOD(extack, "multiple dec ttl are not supported");
                                return -EOPNOTSUPP;
                        }
                        act->do_ttl_dec = 1;
@@ -1120,7 +1120,7 @@ static int efx_tc_pedit_add(struct efx_nic *efx, struct efx_tc_action_set *act,
        }
 
        NL_SET_ERR_MSG_FMT_MOD(extack,
-                              "Unsupported: ttl add action type %x %x %x/%x",
+                              "ttl add action type %x %x %x/%x is not supported",
                               fa->mangle.htype, fa->mangle.offset,
                               fa->mangle.val, fa->mangle.mask);
        return -EOPNOTSUPP;
@@ -1164,7 +1164,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                case 0:
                        if (fa->mangle.mask) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: mask (%#x) of eth.dst32 mangle",
+                                                      "mask (%#x) of eth.dst32 mangle is not supported",
                                                       fa->mangle.mask);
                                return -EOPNOTSUPP;
                        }
@@ -1184,7 +1184,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                                mung->dst_mac_16 = 1;
                        } else {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: mask (%#x) of eth+4 mangle is not high or low 16b",
+                                                      "mask (%#x) of eth+4 mangle is not high or low 16b",
                                                       fa->mangle.mask);
                                return -EOPNOTSUPP;
                        }
@@ -1192,7 +1192,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                case 8:
                        if (fa->mangle.mask) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: mask (%#x) of eth.src32 mangle",
+                                                      "mask (%#x) of eth.src32 mangle is not supported",
                                                       fa->mangle.mask);
                                return -EOPNOTSUPP;
                        }
@@ -1201,7 +1201,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        mung->src_mac_32 = 1;
                        return efx_tc_complete_mac_mangle(efx, act, mung, extack);
                default:
-                       NL_SET_ERR_MSG_FMT_MOD(extack, "Unsupported: mangle eth+%u %x/%x",
+                       NL_SET_ERR_MSG_FMT_MOD(extack, "mangle eth+%u %x/%x is not supported",
                                               fa->mangle.offset, fa->mangle.val, fa->mangle.mask);
                        return -EOPNOTSUPP;
                }
@@ -1217,7 +1217,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        /* check that pedit applies to ttl only */
                        if (fa->mangle.mask != ~EFX_TC_HDR_TYPE_TTL_MASK) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: mask (%#x) out of range, only support mangle action on ipv4.ttl",
+                                                      "mask (%#x) out of range, only support mangle action on ipv4.ttl",
                                                       fa->mangle.mask);
                                return -EOPNOTSUPP;
                        }
@@ -1227,7 +1227,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                         */
                        if (match->mask.ip_ttl != U8_MAX) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: only support mangle ipv4.ttl when we have an exact match on ttl, mask used for match (%#x)",
+                                                      "only support mangle ttl when we have an exact match, current mask (%#x)",
                                                       match->mask.ip_ttl);
                                return -EOPNOTSUPP;
                        }
@@ -1237,7 +1237,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                         */
                        if (match->value.ip_ttl == 0) {
                                NL_SET_ERR_MSG_MOD(extack,
-                                                  "Unsupported: we cannot decrement ttl past 0");
+                                                  "decrement ttl past 0 is not supported");
                                return -EOPNOTSUPP;
                        }
 
@@ -1245,7 +1245,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        if (!efx_tc_flower_action_order_ok(act,
                                                           EFX_TC_AO_DEC_TTL)) {
                                NL_SET_ERR_MSG_MOD(extack,
-                                                  "Unsupported: multiple dec ttl");
+                                                  "multiple dec ttl is not supported");
                                return -EOPNOTSUPP;
                        }
 
@@ -1259,7 +1259,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        fallthrough;
                default:
                        NL_SET_ERR_MSG_FMT_MOD(extack,
-                                              "Unsupported: only support mangle on the ttl field (offset is %u)",
+                                              "only support mangle on the ttl field (offset is %u)",
                                               fa->mangle.offset);
                        return -EOPNOTSUPP;
                }
@@ -1275,7 +1275,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        /* check that pedit applies to ttl only */
                        if (fa->mangle.mask != EFX_TC_HDR_TYPE_HLIMIT_MASK) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: mask (%#x) out of range, only support mangle action on ipv6.hop_limit",
+                                                      "mask (%#x) out of range, only support mangle action on ipv6.hop_limit",
                                                       fa->mangle.mask);
 
                                return -EOPNOTSUPP;
@@ -1286,7 +1286,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                         */
                        if (match->mask.ip_ttl != U8_MAX) {
                                NL_SET_ERR_MSG_FMT_MOD(extack,
-                                                      "Unsupported: only support mangle ipv6.hop_limit when we have an exact match on ttl, mask used for match (%#x)",
+                                                      "only support hop_limit when we have an exact match, current mask (%#x)",
                                                       match->mask.ip_ttl);
                                return -EOPNOTSUPP;
                        }
@@ -1296,7 +1296,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                         */
                        if (match->value.ip_ttl == 0) {
                                NL_SET_ERR_MSG_MOD(extack,
-                                                  "Unsupported: we cannot decrement hop_limit past 0");
+                                                  "decrementing hop_limit past 0 is not supported");
                                return -EOPNOTSUPP;
                        }
 
@@ -1304,7 +1304,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        if (!efx_tc_flower_action_order_ok(act,
                                                           EFX_TC_AO_DEC_TTL)) {
                                NL_SET_ERR_MSG_MOD(extack,
-                                                  "Unsupported: multiple dec ttl");
+                                                  "multiple dec ttl is not supported");
                                return -EOPNOTSUPP;
                        }
 
@@ -1318,7 +1318,7 @@ static int efx_tc_mangle(struct efx_nic *efx, struct efx_tc_action_set *act,
                        fallthrough;
                default:
                        NL_SET_ERR_MSG_FMT_MOD(extack,
-                                              "Unsupported: only support mangle on the hop_limit field");
+                                              "only support mangle on the hop_limit field");
                        return -EOPNOTSUPP;
                }
        default:

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 144ec62..b22596b 100644 (file)
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -872,8 +872,9 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
 
        skb_dst_update_pmtu_no_confirm(skb, mtu);
 
-       if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
-           mtu < ntohs(iph->tot_len)) {
+       if (iph->frag_off & htons(IP_DF) &&
+           ((!skb_is_gso(skb) && skb->len > mtu) ||
+            (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu)))) {
                netdev_dbg(dev, "packet too big, fragmentation needed\n");
                icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                              htonl(mtu));

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index bd2f6e1..b24fb80 100644 (file)
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -4356,6 +4356,35 @@ static inline bool ieee80211_is_public_action(struct ieee80211_hdr *hdr,
 }
 
 /**
+ * ieee80211_is_protected_dual_of_public_action - check if skb contains a
+ * protected dual of public action management frame
+ * @skb: the skb containing the frame, length will be checked
+ *
+ * Return: true if the skb contains a protected dual of public action
+ * management frame, false otherwise.
+ */
+static inline bool
+ieee80211_is_protected_dual_of_public_action(struct sk_buff *skb)
+{
+       u8 action;
+
+       if (!ieee80211_is_public_action((void *)skb->data, skb->len) ||
+           skb->len < IEEE80211_MIN_ACTION_SIZE + 1)
+               return false;
+
+       action = *(u8 *)(skb->data + IEEE80211_MIN_ACTION_SIZE);
+
+       return action != WLAN_PUB_ACTION_20_40_BSS_COEX &&
+               action != WLAN_PUB_ACTION_DSE_REG_LOC_ANN &&
+               action != WLAN_PUB_ACTION_MSMT_PILOT &&
+               action != WLAN_PUB_ACTION_TDLS_DISCOVER_RES &&
+               action != WLAN_PUB_ACTION_LOC_TRACK_NOTI &&
+               action != WLAN_PUB_ACTION_FTM_REQUEST &&
+               action != WLAN_PUB_ACTION_FTM_RESPONSE &&
+               action != WLAN_PUB_ACTION_FILS_DISCOVERY;
+}
+
+/**
  * _ieee80211_is_group_privacy_action - check if frame is a group addressed
  * privacy action frame
  * @hdr: the frame

diff --git a/include/uapi/linux/gtp.h b/include/uapi/linux/gtp.h
index 2f61298..3dcdb9e 100644 (file)
--- a/include/uapi/linux/gtp.h
+++ b/include/uapi/linux/gtp.h
@@ -33,6 +33,6 @@ enum gtp_attrs {
        GTPA_PAD,
        __GTPA_MAX,
 };
-#define GTPA_MAX (__GTPA_MAX + 1)
+#define GTPA_MAX (__GTPA_MAX - 1)
 
 #endif /* _UAPI_LINUX_GTP_H_ */

diff --git a/net/handshake/netlink.c b/net/handshake/netlink.c
index d0bc1dd..80c7302 100644 (file)
--- a/net/handshake/netlink.c
+++ b/net/handshake/netlink.c
@@ -87,29 +87,6 @@ struct nlmsghdr *handshake_genl_put(struct sk_buff *msg,
 }
 EXPORT_SYMBOL(handshake_genl_put);
 
-/*
- * dup() a kernel socket for use as a user space file descriptor
- * in the current process. The kernel socket must have an
- * instatiated struct file.
- *
- * Implicit argument: "current()"
- */
-static int handshake_dup(struct socket *sock)
-{
-       struct file *file;
-       int newfd;
-
-       file = get_file(sock->file);
-       newfd = get_unused_fd_flags(O_CLOEXEC);
-       if (newfd < 0) {
-               fput(file);
-               return newfd;
-       }
-
-       fd_install(newfd, file);
-       return newfd;
-}
-
 int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
 {
        struct net *net = sock_net(skb->sk);
@@ -133,17 +110,20 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
                goto out_status;
 
        sock = req->hr_sk->sk_socket;
-       fd = handshake_dup(sock);
+       fd = get_unused_fd_flags(O_CLOEXEC);
        if (fd < 0) {
                err = fd;
                goto out_complete;
        }
+
        err = req->hr_proto->hp_accept(req, info, fd);
        if (err) {
-               fput(sock->file);
+               put_unused_fd(fd);
                goto out_complete;
        }
 
+       fd_install(fd, get_file(sock->file));
+
        trace_handshake_cmd_accept(net, req, req->hr_sk, fd);
        return 0;
 

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index d18f0f0..4ccfc10 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -786,7 +786,7 @@ int esp_input_done2(struct sk_buff *skb, int err)
 
                /*
                 * 1) if the NAT-T peer's IP or port changed then
-                *    advertize the change to the keying daemon.
+                *    advertise the change to the keying daemon.
                 *    This is an inbound SA, so just compare
                 *    SRC ports.
                 */

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index e023d29..2cc1a45 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -833,7 +833,7 @@ int esp6_input_done2(struct sk_buff *skb, int err)
 
                /*
                 * 1) if the NAT-T peer's IP or port changed then
-                *    advertize the change to the keying daemon.
+                *    advertise the change to the keying daemon.
                 *    This is an inbound SA, so just compare
                 *    SRC ports.
                 */

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index e751cda..8f6b6f5 100644 (file)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2468,8 +2468,7 @@ static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
 
                /* drop unicast public action frames when using MPF */
                if (is_unicast_ether_addr(mgmt->da) &&
-                   ieee80211_is_public_action((void *)rx->skb->data,
-                                              rx->skb->len))
+                   ieee80211_is_protected_dual_of_public_action(rx->skb))
                        return -EACCES;
        }
 

diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index e95df84..b80bf68 100644 (file)
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -555,6 +555,11 @@ static int virtio_vsock_vqs_init(struct virtio_vsock *vsock)
 
        virtio_device_ready(vdev);
 
+       return 0;
+}
+
+static void virtio_vsock_vqs_start(struct virtio_vsock *vsock)
+{
        mutex_lock(&vsock->tx_lock);
        vsock->tx_run = true;
        mutex_unlock(&vsock->tx_lock);
@@ -569,7 +574,16 @@ static int virtio_vsock_vqs_init(struct virtio_vsock *vsock)
        vsock->event_run = true;
        mutex_unlock(&vsock->event_lock);
 
-       return 0;
+       /* virtio_transport_send_pkt() can queue packets once
+        * the_virtio_vsock is set, but they won't be processed until
+        * vsock->tx_run is set to true. We queue vsock->send_pkt_work
+        * when initialization finishes to send those packets queued
+        * earlier.
+        * We don't need to queue the other workers (rx, event) because
+        * as long as we don't fill the queues with empty buffers, the
+        * host can't send us any notification.
+        */
+       queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work);
 }
 
 static void virtio_vsock_vqs_del(struct virtio_vsock *vsock)
@@ -664,6 +678,7 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
                goto out;
 
        rcu_assign_pointer(the_virtio_vsock, vsock);
+       virtio_vsock_vqs_start(vsock);
 
        mutex_unlock(&the_virtio_vsock_mutex);
 
@@ -736,6 +751,7 @@ static int virtio_vsock_restore(struct virtio_device *vdev)
                goto out;
 
        rcu_assign_pointer(the_virtio_vsock, vsock);
+       virtio_vsock_vqs_start(vsock);
 
 out:
        mutex_unlock(&the_virtio_vsock_mutex);

diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 3e2c398..55a1d36 100644 (file)
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -43,10 +43,11 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
 
        for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
                cr.links[link_id].status = data->links[link_id].status;
+               cr.links[link_id].bss = data->links[link_id].bss;
+
                WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS &&
                             (!cr.ap_mld_addr || !cr.links[link_id].bss));
 
-               cr.links[link_id].bss = data->links[link_id].bss;
                if (!cr.links[link_id].bss)
                        continue;
                cr.links[link_id].bssid = data->links[link_id].bss->bssid;

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 939deec..8210a60 100644 (file)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2125,7 +2125,7 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
        if (!res)
                goto drop;
 
-       rdev_inform_bss(rdev, &res->pub, ies, data->drv_data);
+       rdev_inform_bss(rdev, &res->pub, ies, drv_data->drv_data);
 
        if (data->bss_source == BSS_SOURCE_MBSSID) {
                /* this is a nontransmitting bss, we need to add it to