On Thu, Jun 23, 2016 at 11:13:47AM +0200, Florian Westphal wrote:
> Florian Westphal <fw@xxxxxxxxx> wrote:
> > Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
> > > 3.14-stable review patch. If anyone has any objections, please let me know.
> >
> > I have -- this doesn't work in 3.14 as t->entries (the ruleset blob)
> > is still kept percpu.
> >
> > > +static bool find_jump_target(const struct xt_table_info *t,
> > > + const struct arpt_entry *target)
> > > +{
> > > + struct arpt_entry *iter;
> > > +
> > > + xt_entry_foreach(iter, t->entries, t->size) {
> >
> >
> > .. so this causes in kernel soft lockup when I try to insert a rule.
> >
> > I will go over the 3.14 stable queue and see if I can amend this to work
> > with 3.14.
>
> This amended patch works for me (iptables-test.py passes except those
> tests that I expected to fail due to some missing features in 3.14).
>
> I also briefly tried 32bit iptables/ip6tables and that seems happy
> as well. The reproduces for the two bugs fail with -EINVAL.
>
> ebtables doesn't work (even ebtables -A INPUT -j ACCEPT fails), but
> that should be solved by picking up
> d26e2c9ffa385dd1b646f43c1397ba12af9e, "Revert "netfilter: ensure number
> of counters is >0 in do_replace()" [ its a PARTIAL revert, so don't drop
> the original patch ... ]
>
> Subject: netfilter: x_tables: validate targets of jumps
>
> commit 36472341017529e2b12573093cc0f68719300997 upstream.
>
> When we see a jump also check that the offset gets us to beginning of
> a rule (an ipt_entry).
>
> The extra overhead is negible, even with absurd cases.
>
> 300k custom rules, 300k jumps to 'next' user chain:
> [ plus one jump from INPUT to first userchain ]:
>
> Before:
> real 0m24.874s
> user 0m7.532s
> sys 0m16.076s
>
> After:
> real 0m27.464s
> user 0m7.436s
> sys 0m18.840s
>
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
> Need to pass the start of the ruleset as extra argument as
> t->entries won't work in 3.14 (its percpu and not even set
> up for all processors at this point).
Thank you for the update, now applied.
greg k-h
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html