iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/include/net/netfilter
History
Florian Westphal cf5000a778 netfilter: nf_tables: fix memleak when more than 255 elements expired 
When more than 255 elements expired we're supposed to switch to a new gc
container structure.

This never happens: u8 type will wrap before reaching the boundary
and nft_trans_gc_space() always returns true.

This means we recycle the initial gc container structure and
lose track of the elements that came before.

While at it, don't deref 'gc' after we've passed it to call_rcu.

Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
2023-09-20 10:35:23 +02:00
..
ipv4
netfilter: disable defrag once its no longer needed
2021-04-26 03:20:07 +02:00
ipv6
netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
2021-09-28 13:04:55 +02:00
br_netfilter.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_bpf_link.h
bpf: minimal support for programs hooked into netfilter framework
2023-04-21 11:34:14 -07:00
nf_conntrack_acct.h
netfilter: conntrack: Remove unused function declarations
2023-08-08 13:02:00 +02:00
nf_conntrack_act_ct.h
net/sched: act_ct: Fill offloading tuple iifidx
2022-01-04 12:12:55 +00:00
nf_conntrack_bpf.h
net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c
2022-10-03 09:17:32 -07:00
nf_conntrack_bridge.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_conntrack_core.h
netfilter: conntrack: fix wrong ct->timeout value
2023-04-19 12:08:38 +02:00
nf_conntrack_count.h
netfilter: nf_conncount: reduce unnecessary GC
2022-05-16 13:05:40 +02:00
nf_conntrack_ecache.h
netfilter: prefer extension check to pointer check
2022-05-13 18:56:28 +02:00
nf_conntrack_expect.h
netfilter: allow exp not to be removed in nf_ct_find_expectation
2023-07-20 10:06:36 +02:00
nf_conntrack_extend.h
netfilter: extensions: introduce extension genid count
2022-05-13 18:52:16 +02:00
nf_conntrack_helper.h
netfilter: helper: Remove unused function declarations
2023-08-08 13:01:59 +02:00
nf_conntrack_l4proto.h
netfilter: conntrack: pass hook state to log functions
2021-06-18 14:47:43 +02:00
nf_conntrack_labels.h
netfilter: conntrack: Remove unused function declarations
2023-08-08 13:02:00 +02:00
nf_conntrack_seqadj.h
netfilter: conntrack: remove extension register api
2022-02-04 06:30:28 +01:00
nf_conntrack_synproxy.h
netfilter: conntrack: wrap two inline functions in config checks.
2019-09-13 12:47:10 +02:00
nf_conntrack_timeout.h
netfilter: nf_conntrack: add missing __rcu annotations
2022-07-11 16:25:15 +02:00
nf_conntrack_timestamp.h
netfilter: conntrack: remove extension register api
2022-02-04 06:30:28 +01:00
nf_conntrack_tuple.h
netfilter: conntrack: don't fold port numbers into addresses before hashing
2023-07-05 14:42:16 +02:00
nf_conntrack_zones.h
netfilter: conntrack: remove CONFIG_NF_CONNTRACK checks from nf_conntrack_zones.h.
2019-09-13 12:47:41 +02:00
nf_conntrack.h
netfilter: conntrack: Remove unused function declarations
2023-08-08 13:02:00 +02:00
nf_dup_netdev.h
netfilter: nft_{fwd,dup}_netdev: add offload support
2019-09-10 22:44:29 +02:00
nf_flow_table.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2023-06-15 22:19:41 -07:00
nf_hooks_lwtunnel.h
netfilter: add netfilter hooks to SRv6 data plane
2021-08-30 01:51:36 +02:00
nf_log.h
netfilter: nf_log_common: merge with nf_log_syslog
2021-03-31 22:34:10 +02:00
nf_nat_helper.h
netfilter: nat: move repetitive nat port reserve loop to a helper
2022-09-07 16:46:04 +02:00
nf_nat_masquerade.h
netfilter: update include directives.
2019-09-13 12:33:06 +02:00
nf_nat_redirect.h
netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs
2023-03-22 21:48:59 +01:00
nf_nat.h
net: move the nat function to nf_nat_ovs for ovs and tc
2022-12-12 10:14:03 +00:00
nf_queue.h
treewide: use get_random_u32() when possible
2022-10-11 17:42:58 -06:00
nf_reject.h
netfilter: conntrack: skip verification of zero UDP checksum
2022-05-13 18:56:28 +02:00
nf_socket.h
…
nf_synproxy.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_tables_core.h
netfilter: nf_tables: avoid retpoline overhead for some ct expression calls
2023-01-18 13:05:25 +01:00
nf_tables_ipv4.h
netfilter: use skb_ip_totlen and iph_totlen
2023-02-01 20:54:27 -08:00
nf_tables_ipv6.h
netfilter: nf_tables: reduce nft_pktinfo by 8 bytes
2022-10-25 13:44:14 +02:00
nf_tables_offload.h
netfilter: nf_tables: bail out early if hardware offload is not supported
2022-06-06 19:19:15 +02:00
nf_tables.h
netfilter: nf_tables: fix memleak when more than 255 elements expired
2023-09-20 10:35:23 +02:00
nf_tproxy.h
netfilter: tproxy: fix deadlock due to missing BH disable
2023-03-06 12:09:48 +01:00
nft_fib.h
netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters
2022-11-15 10:46:34 +01:00
nft_meta.h
netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters
2022-11-15 10:46:34 +01:00
nft_reject.h
netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters
2022-11-15 10:46:34 +01:00
xt_rateest.h
net: sched: Merge Qdisc::bstats and Qdisc::cpu_bstats data types
2021-10-18 12:54:41 +01:00