This is a note to let you know that I've just added the patch titled Revert "netfilter: xt_recent: relax ip_pkt_list_tot restrictions" to the 3.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: revert-netfilter-xt_recent-relax-ip_pkt_list_tot.patch and it can be found in the queue-3.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 67a489124d8af094a9b654e242e4add150da0ab3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Date: Mon, 16 Mar 2015 14:52:21 +0100 Subject: Revert "netfilter: xt_recent: relax ip_pkt_list_tot restrictions" From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> This reverts commit abc86d0f99242b7f142b7cb8f90e30081dd3c256 as it is broken in 3.19 and is easier to revert here than try to fix it. Reported-by: Florian Westphal <fw@xxxxxxxxx Reported-by: David Miller <davem@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman gregkh@xxxxxxxxxxxxxxxxxxx --- net/netfilter/xt_recent.c | 64 ++++++++++++---------------------------------- 1 file changed, 17 insertions(+), 47 deletions(-) --- a/net/netfilter/xt_recent.c +++ b/net/netfilter/xt_recent.c @@ -43,29 +43,25 @@ MODULE_LICENSE("GPL"); MODULE_ALIAS("ipt_recent"); MODULE_ALIAS("ip6t_recent"); -static unsigned int ip_list_tot __read_mostly = 100; -static unsigned int ip_list_hash_size __read_mostly; -static unsigned int ip_list_perms __read_mostly = 0644; -static unsigned int ip_list_uid __read_mostly; -static unsigned int ip_list_gid __read_mostly; +static unsigned int ip_list_tot = 100; +static unsigned int ip_pkt_list_tot = 20; +static unsigned int ip_list_hash_size = 0; +static unsigned int ip_list_perms = 0644; +static unsigned int ip_list_uid = 0; +static unsigned int ip_list_gid = 0; module_param(ip_list_tot, uint, 0400); +module_param(ip_pkt_list_tot, uint, 0400); module_param(ip_list_hash_size, uint, 0400); module_param(ip_list_perms, uint, 0400); module_param(ip_list_uid, uint, S_IRUGO | S_IWUSR); module_param(ip_list_gid, uint, S_IRUGO | S_IWUSR); MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list"); +MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP address to remember (max. 255)"); MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs"); MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/xt_recent/* files"); MODULE_PARM_DESC(ip_list_uid, "default owner of /proc/net/xt_recent/* files"); MODULE_PARM_DESC(ip_list_gid, "default owning group of /proc/net/xt_recent/* files"); -/* retained for backwards compatibility */ -static unsigned int ip_pkt_list_tot __read_mostly; -module_param(ip_pkt_list_tot, uint, 0400); -MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP address to remember (max. 255)"); - -#define XT_RECENT_MAX_NSTAMPS 256 - struct recent_entry { struct list_head list; struct list_head lru_list; @@ -83,7 +79,6 @@ struct recent_table { union nf_inet_addr mask; unsigned int refcnt; unsigned int entries; - u8 nstamps_max_mask; struct list_head lru_list; struct list_head iphash[0]; }; @@ -95,8 +90,7 @@ struct recent_net { #endif }; -static int recent_net_id __read_mostly; - +static int recent_net_id; static inline struct recent_net *recent_pernet(struct net *net) { return net_generic(net, recent_net_id); @@ -177,15 +171,12 @@ recent_entry_init(struct recent_table *t u_int16_t family, u_int8_t ttl) { struct recent_entry *e; - unsigned int nstamps_max = t->nstamps_max_mask; if (t->entries >= ip_list_tot) { e = list_entry(t->lru_list.next, struct recent_entry, lru_list); recent_entry_remove(t, e); } - - nstamps_max += 1; - e = kmalloc(sizeof(*e) + sizeof(e->stamps[0]) * nstamps_max, + e = kmalloc(sizeof(*e) + sizeof(e->stamps[0]) * ip_pkt_list_tot, GFP_ATOMIC); if (e == NULL) return NULL; @@ -206,7 +197,7 @@ recent_entry_init(struct recent_table *t static void recent_entry_update(struct recent_table *t, struct recent_entry *e) { - e->index &= t->nstamps_max_mask; + e->index %= ip_pkt_list_tot; e->stamps[e->index++] = jiffies; if (e->index > e->nstamps) e->nstamps = e->index; @@ -335,7 +326,6 @@ static int recent_mt_check(const struct kuid_t uid; kgid_t gid; #endif - unsigned int nstamp_mask; unsigned int i; int ret = -EINVAL; size_t sz; @@ -359,33 +349,19 @@ static int recent_mt_check(const struct return -EINVAL; if ((info->check_set & XT_RECENT_REAP) && !info->seconds) return -EINVAL; - if (info->hit_count >= XT_RECENT_MAX_NSTAMPS) { - pr_info("hitcount (%u) is larger than allowed maximum (%u)\n", - info->hit_count, XT_RECENT_MAX_NSTAMPS - 1); + if (info->hit_count > ip_pkt_list_tot) { + pr_info("hitcount (%u) is larger than " + "packets to be remembered (%u)\n", + info->hit_count, ip_pkt_list_tot); return -EINVAL; } if (info->name[0] == '\0' || strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN) return -EINVAL; - if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot) - nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1; - else if (info->hit_count) - nstamp_mask = roundup_pow_of_two(info->hit_count) - 1; - else - nstamp_mask = 32 - 1; - mutex_lock(&recent_mutex); t = recent_table_lookup(recent_net, info->name); if (t != NULL) { - if (info->hit_count > t->nstamps_max_mask) { - pr_info("hitcount (%u) is larger than packets to be remembered (%u) for table %s\n", - info->hit_count, t->nstamps_max_mask + 1, - info->name); - ret = -EINVAL; - goto out; - } - t->refcnt++; ret = 0; goto out; @@ -401,7 +377,6 @@ static int recent_mt_check(const struct goto out; } t->refcnt = 1; - t->nstamps_max_mask = nstamp_mask; memcpy(&t->mask, &info->mask, sizeof(t->mask)); strcpy(t->name, info->name); @@ -522,12 +497,9 @@ static void recent_seq_stop(struct seq_f static int recent_seq_show(struct seq_file *seq, void *v) { const struct recent_entry *e = v; - struct recent_iter_state *st = seq->private; - const struct recent_table *t = st->table; unsigned int i; - i = (e->index - 1) & t->nstamps_max_mask; - + i = (e->index - 1) % ip_pkt_list_tot; if (e->family == NFPROTO_IPV4) seq_printf(seq, "src=%pI4 ttl: %u last_seen: %lu oldest_pkt: %u", &e->addr.ip, e->ttl, e->stamps[i], e->index); @@ -745,9 +717,7 @@ static int __init recent_mt_init(void) { int err; - BUILD_BUG_ON_NOT_POWER_OF_2(XT_RECENT_MAX_NSTAMPS); - - if (!ip_list_tot || ip_pkt_list_tot >= XT_RECENT_MAX_NSTAMPS) + if (!ip_list_tot || !ip_pkt_list_tot || ip_pkt_list_tot > 255) return -EINVAL; ip_list_hash_size = 1 << fls(ip_list_tot); Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are queue-3.19/team-don-t-traverse-port-list-using-rcu-in-team_set_mac_address.patch queue-3.19/alsa-oxfw-fix-a-condition-and-return-code-in-start_stream.patch queue-3.19/ipv6-make-__ipv6_select_ident-static.patch queue-3.19/usb-plusb-add-support-for-national-instruments-host-to-host-cable.patch queue-3.19/rtnetlink-ifla_vf_policy-fix-misuses-of-nla_binary.patch queue-3.19/sunxi-clk-set-sun6i-pll1-n_start-1.patch queue-3.19/drm-radeon-don-t-try-to-enable-write-combining-without-pat.patch queue-3.19/ib-core-when-marshaling-ucma-path-from-user-space-clear-unused-fields.patch queue-3.19/serial-8250-revert-tty-serial-8250_core-read-only-rx-if-there-is-something-in-the-fifo.patch queue-3.19/dm-snapshot-fix-a-possible-invalid-memory-access-on-unload.patch queue-3.19/net-bcmgenet-fix-software-maintained-statistics.patch queue-3.19/dm-fix-a-race-condition-in-dm_get_md.patch queue-3.19/revert-netfilter-xt_recent-relax-ip_pkt_list_tot.patch queue-3.19/drm-i915-check-obj-vma_list-under-the-struct_mutex.patch queue-3.19/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch queue-3.19/net-phy-fix-verification-of-eee-support-in-phy_init_eee.patch queue-3.19/mm-fix-negative-nr_isolated-counts.patch queue-3.19/sched-autogroup-fix-failure-to-set-cpu.rt_runtime_us.patch queue-3.19/mac80211-send-eapol-frames-at-lowest-rate.patch queue-3.19/stable_kernel_rules-reorganize-and-update-submission-options.patch queue-3.19/procfs-fix-race-between-symlink-removals-and-traversals.patch queue-3.19/wd719x-add-missing-.module-to-wd719x_template.patch queue-3.19/firmware-dmi_scan-fix-dmi-scan-to-handle-end-of-table.patch queue-3.19/mm-compaction-fix-wrong-order-check-in-compact_finished.patch queue-3.19/pinctrl-imx25-fix-numbering-for-pins.patch queue-3.19/net-reject-creation-of-netdev-names-with-colons.patch queue-3.19/acpi-lpss-provide-con_id-for-the-clkdev.patch queue-3.19/locking-rtmutex-avoid-a-null-pointer-dereference-on-deadlock.patch queue-3.19/ecryptfs-don-t-pass-fs-specific-ioctl-commands-through.patch queue-3.19/tty-fix-up-atime-mtime-mess-take-four.patch queue-3.19/sched-fix-hrtick_start-on-up.patch queue-3.19/target-add-missing-write_same-end-of-device-sanity-check.patch queue-3.19/ib-qib-do-not-write-eeprom.patch queue-3.19/dm-mirror-do-not-degrade-the-mirror-on-discard-error.patch queue-3.19/alsa-hda-disable-runtime-pm-for-panther-point-again.patch queue-3.19/net-pktgen-disable-xmit_clone-on-virtual-devices.patch queue-3.19/coresight-etm-unlock-on-error-paths-in-mode_store.patch queue-3.19/iio-adc-mcp3422-fix-incorrect-scales-table.patch queue-3.19/clk-zynq-force-cpu_2x-clock-to-be-ungated.patch queue-3.19/iio-ad5686-fix-optional-reference-voltage-declaration.patch queue-3.19/alsa-pcm-don-t-leave-prepared-state-after-draining.patch queue-3.19/hid-wacom-report-abs_misc-event-for-cintiq-companion-hybrid.patch queue-3.19/debugfs-leave-freeing-a-symlink-body-until-inode-eviction.patch queue-3.19/clk-gate-fix-bit-check-in-clk_register_gate.patch queue-3.19/alsa-firewire-lib-remove-reference-counting.patch queue-3.19/dm-io-reject-unsupported-discard-requests-with-eopnotsupp.patch queue-3.19/iio-mxs-lradc-separate-touchscreen-and-buffer-virtual-channels.patch queue-3.19/asoc-omap-pcm-correct-dma-mask.patch queue-3.19/net-do-not-use-rcu-in-rtnl_dump_ifinfo.patch queue-3.19/x86-asm-entry-64-remove-a-bogus-ret_from_fork-optimization.patch queue-3.19/net-ping-return-eafnosupport-when-appropriate.patch queue-3.19/nfsd-fix-clp-cl_revoked-list-deletion-causing-softlock-in-nfsd.patch queue-3.19/autofs4-copy_dev_ioctl-keep-the-value-of-size-we-d-used-for-allocation.patch queue-3.19/drm-i915-check-for-driver-readyness-before-handling-an-underrun-interrupt.patch queue-3.19/efi-libstub-fix-boundary-checking-in-efi_high_alloc.patch queue-3.19/sunrpc-always-manipulate-rpc_rqst-rq_bc_pa_list-under-xprt-bc_pa_lock.patch queue-3.19/alsa-fireworks-bebob-dice-oxfw-make-it-possible-to-shutdown-safely.patch queue-3.19/target-check-for-lba-sectors-wrap-around-in-sbc_parse_cdb.patch queue-3.19/mm-memory.c-actually-remap-enough-memory.patch queue-3.19/ipv6-fix-fragment-id-assignment-on-le-arches.patch queue-3.19/alsa-hda-controller-code-do-not-export-static-functions.patch queue-3.19/acpi-video-load-the-module-even-if-acpi-is-disabled.patch queue-3.19/revert-iio-humidity-si7020-fix-pointer-to-i2c-client.patch queue-3.19/alsa-hda-add-pin-configs-for-asus-mobo-with-idt-92hd73xx-codec.patch queue-3.19/flowcache-fix-kernel-panic-in-flow_cache_flush_task.patch queue-3.19/hid-fixup-the-conflicting-keyboard-mappings-quirk.patch queue-3.19/ib-iser-use-correct-dma-direction-when-unmapping-sgs.patch queue-3.19/firmware-dmi_scan-fix-dmi_len-type.patch queue-3.19/kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch queue-3.19/hid-input-fix-confusion-on-conflicting-mappings.patch queue-3.19/nilfs2-fix-potential-memory-overrun-on-inode.patch queue-3.19/revert-usb-serial-make-bulk_out_size-a-lower-limit.patch queue-3.19/staging-comedi-cb_pcidas64-fix-incorrect-ai-range-code-handling.patch queue-3.19/ib-core-fix-deadlock-on-uverbs-modify_qp-error-flow.patch queue-3.19/mm-page_alloc-revert-inadvertent-__gfp_fs-retry-behavior-change.patch queue-3.19/net-compat-ignore-msg_cmsg_compat-in-compat_sys_-send-recv-msg.patch queue-3.19/alsa-hda-one-more-dell-macine-needs-dell1_mic_no_presence-quirk.patch queue-3.19/ipv6-fix-ipv6_cow_metrics-for-non-dst_host-case.patch queue-3.19/drm-i915-correct-the-iosf-dev_fn-field-for-iosf-transfers.patch queue-3.19/iio-mxs-lradc-make-adc-reads-not-disable-touchscreen-interrupts.patch queue-3.19/iio-mxs-lradc-fix-iio-channel-map-regression.patch queue-3.19/iio-si7020-allocate-correct-amount-of-memory-in-devm_iio_device_alloc.patch queue-3.19/drm-radeon-dp-set-edp_configuration_set-for-bridge-chips-if-necessary.patch queue-3.19/mm-hugetlb-add-migration-hwpoisoned-entry-check-in-hugetlb_change_protection.patch queue-3.19/pinctrl-pinctrl-imx-don-t-use-invalid-value-of-conf_reg.patch queue-3.19/drm-radeon-fix-voltage-setup-on-hawaii.patch queue-3.19/ath5k-fix-spontaneus-ar5312-freezes.patch queue-3.19/mm-when-stealing-freepages-also-take-pages-created-by-splitting-buddy-page.patch queue-3.19/drm-i915-prevent-use-after-free-in-invalidate_range_start-callback.patch queue-3.19/drm-i915-bdw-pci-ids-ending-in-0xb-are-ult.patch queue-3.19/revert-r8169-add-support-for-byte-queue-limits.patch queue-3.19/iio-mxs-lradc-make-adc-reads-not-unschedule-touchscreen-conversions.patch queue-3.19/btrfs-fix-data-loss-in-the-fast-fsync-path.patch queue-3.19/ib-iser-fix-memory-regions-possible-leak.patch queue-3.19/tcp-make-sure-skb-is-not-shared-before-using-skb_get.patch queue-3.19/ib-core-properly-handle-registration-of-on-demand-paging-mrs-after-dereg.patch queue-3.19/openvswitch-fix-net-exit.patch queue-3.19/gen_stats.c-duplicate-xstats-buffer-for-later-use.patch queue-3.19/cxl-add-missing-return-statement-after-handling-afu-errror.patch queue-3.19/x86-fpu-xsaves-fix-improper-uses-of-__ex_table.patch queue-3.19/mm-mmap.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch queue-3.19/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch queue-3.19/fixed-invalid-assignment-of-64bit-mask-to-host-dma_boundary-for-scatter-gather-segment-boundary-limit.patch queue-3.19/net-bcmgenet-fix-throughtput-regression.patch queue-3.19/iio-imu-adis16400-fix-sign-extension.patch queue-3.19/usb-dwc3-dwc3-omap-fix-disable-irq.patch queue-3.19/iio-mxs-lradc-only-update-the-buffer-when-its-conversions-have-finished.patch queue-3.19/drm-radeon-use-drm_mode_vrefresh-rather-than-mode-vrefresh.patch queue-3.19/drm-i915-insert-a-command-barrier-on-blt-bsd-cache-flushes.patch queue-3.19/arc-fix-kstk_esp.patch queue-3.19/btrfs-__add_inode_ref-out-of-bounds-memory-read-when-looking-for-extended-ref.patch queue-3.19/alsa-fireworks-bebob-dice-oxfw-add-reference-counting-for-firewire-unit.patch queue-3.19/autofs4-wrong-format-for-printing-dentry.patch queue-3.19/alsa-fireworks-bebob-dice-oxfw-allow-stream-destructor-after-releasing-runtime.patch queue-3.19/drm-radeon-fix-1-rb-harvest-config-setup-for-tn-rl.patch queue-3.19/efi-small-leak-on-error-in-runtime-map-code.patch queue-3.19/staging-comedi-comedi_compat32.c-fix-comedi_cmd-copy-back.patch queue-3.19/drm-i915-avoid-processing-spurious-shared-interrupts-in-low-power-states.patch queue-3.19/ipv6-addrconf-add-missing-validate_link_af-handler.patch queue-3.19/usb-serial-fix-infinite-wait_until_sent-timeout.patch queue-3.19/mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch queue-3.19/usb-serial-cp210x-adding-seletek-device-id-s.patch queue-3.19/sunrpc-fix-braino-in-poll.patch queue-3.19/ipv4-ip_check_defrag-should-not-assume-that-skb_network_offset-is-zero.patch queue-3.19/pktgen-fix-udp-checksum-computation.patch queue-3.19/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch queue-3.19/drm-i915-dell-chromebook-11-has-pwm-backlight.patch queue-3.19/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch queue-3.19/usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch queue-3.19/usb-mxuport-fix-null-deref-when-used-as-a-console.patch queue-3.19/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch queue-3.19/cxl-use-image-state-defaults-for-reloading-fpga.patch queue-3.19/mm-hugetlb-fix-getting-refcount-0-page-in-hugetlb_fault.patch queue-3.19/ematch-fix-auto-loading-of-ematch-modules.patch queue-3.19/vmstat-do-not-use-deferrable-delayed-work-for-vmstat_update.patch queue-3.19/cxl-fix-device_node-reference-counting.patch queue-3.19/ib-mlx5-fix-error-code-in-get_port_caps.patch queue-3.19/udp-only-allow-ufo-for-packets-from-sock_dgram-sockets.patch queue-3.19/asoc-rt5670-set-rt5670_irq_ctrl1-non-volatile.patch queue-3.19/team-fix-possible-null-pointer-dereference-in-team_handle_frame.patch queue-3.19/sh_eth-fix-lost-mac-address-on-kexec.patch queue-3.19/usb-serial-fix-potential-use-after-free-after-failed-probe.patch queue-3.19/mm-hwpoison-drop-lru_add_drain_all-in-__soft_offline_page.patch queue-3.19/mm-hugetlb-add-migration-entry-check-in-__unmap_hugepage_range.patch queue-3.19/clk-fix-debugfs-clk-removal-before-inited.patch queue-3.19/drm-i915-drop-vblank-wait-from-intel_dp_link_down.patch queue-3.19/xhci-allocate-correct-amount-of-scratchpad-buffers.patch queue-3.19/nfs-don-t-invalidate-a-submounted-dentry-in-nfs_prime_dcache.patch queue-3.19/btrfs-fix-lost-return-value-due-to-variable-shadowing.patch queue-3.19/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch queue-3.19/drm-i915-clamp-efficient-frequency-to-valid-range.patch queue-3.19/mm-nommu-fix-memory-leak.patch queue-3.19/drm-radeon-only-enable-kv-kb-dpm-interrupts-once-v3.patch queue-3.19/sg-fix-read-error-reporting.patch queue-3.19/btrfs-fix-fsync-race-leading-to-ordered-extent-memory-leaks.patch queue-3.19/mei-make-device-disabled-on-stop-unconditionally.patch queue-3.19/ib-mlx4-fix-memory-leak-in-__mlx4_ib_modify_qp.patch queue-3.19/sock-sock_dequeue_err_skb-needs-hard-irq-safety.patch queue-3.19/macvtap-make-sure-neighbour-code-can-push-ethernet-header.patch queue-3.19/gfs2-fix-crash-during-acl-deletion-in-acl-max-entry-check-in-gfs2_set_acl.patch queue-3.19/net-irda-fix-wait_until_sent-poll-timeout.patch queue-3.19/rtnetlink-call-dellink-on-failure-when-newlink-exists.patch queue-3.19/of-pci-free-resources-on-failure-in-of_pci_get_host_bridge_resources.patch queue-3.19/drm-tegra-use-correct-relocation-target-offsets.patch queue-3.19/uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch queue-3.19/target-fix-pr_aptpl_buf_len-buffer-size-limitation.patch queue-3.19/nfsv4-don-t-call-put_rpccred-under-the-rcu_read_lock.patch queue-3.19/usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch queue-3.19/usb-serial-fix-tty-device-error-handling-at-probe.patch queue-3.19/ib-mlx4-fix-wrong-usage-of-ipv4-protocol-for-multicast-attach-detach.patch queue-3.19/kvm-mips-fix-trace-event-to-save-pc-directly.patch queue-3.19/mm-nommu.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch queue-3.19/drm-radeon-enable-native-backlight-control-on-old-macs.patch queue-3.19/mm-hugetlb-remove-unnecessary-lower-bound-on-sysctl-handlers.patch queue-3.19/ipv4-ip_check_defrag-should-correctly-check-return-value-of-skb_copy_bits.patch queue-3.19/reservation-remove-shadowing-local-variable-ret.patch queue-3.19/drm-radeon-workaround-for-cp-hw-bug-on-cik.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html