Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains updates for your net tree, they are:

1) Fix removal of destination in IPVS when the new mixed family support
   is used, from Alexey Andriyanov via Simon Horman.

2) Fix module refcount undeflow in nft_compat when reusing a match /
   target.

3) Fix iptables-restore when the recent match is used with a new hitcount
   that exceeds threshold, from Florian Westphal.

4) Fix stack corruption in xt_socket due to using stack storage to save
   the inner IPv6 header, from Eric Dumazet.

I'll follow up soon with another batch with more fixes that are still
cooking.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --combined net/netfilter/ipvs/ip_vs_ctl.c
index e55759056361c47ed1fcfa5c656541ba39bfd260,fdcda8be1f0f8fcb3bd0325aa89e0bb8599c9893..ed99448671c3003374fc947bee6e91ab0f0d3fce
--- 1/net/netfilter/ipvs/ip_vs_ctl.c
--- 2/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@@ -2887,8 -2887,7 +2887,8 @@@ static int ip_vs_genl_dump_service(stru
        if (ip_vs_genl_fill_service(skb, svc) < 0)
                goto nla_put_failure;
  
 -      return genlmsg_end(skb, hdr);
 +      genlmsg_end(skb, hdr);
 +      return 0;
  
  nla_put_failure:
        genlmsg_cancel(skb, hdr);
@@@ -3080,8 -3079,7 +3080,8 @@@ static int ip_vs_genl_dump_dest(struct 
        if (ip_vs_genl_fill_dest(skb, dest) < 0)
                goto nla_put_failure;
  
 -      return genlmsg_end(skb, hdr);
 +      genlmsg_end(skb, hdr);
 +      return 0;
  
  nla_put_failure:
        genlmsg_cancel(skb, hdr);
@@@ -3217,8 -3215,7 +3217,8 @@@ static int ip_vs_genl_dump_daemon(struc
        if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
                goto nla_put_failure;
  
 -      return genlmsg_end(skb, hdr);
 +      genlmsg_end(skb, hdr);
 +      return 0;
  
  nla_put_failure:
        genlmsg_cancel(skb, hdr);
@@@ -3402,7 -3399,7 +3402,7 @@@ static int ip_vs_genl_set_cmd(struct sk
                if (udest.af == 0)
                        udest.af = svc->af;
  
-               if (udest.af != svc->af) {
+               if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
                        /* The synchronization protocol is incompatible
                         * with mixed family services
                         */

diff --combined net/netfilter/nft_compat.c
index c598f74063a19ebd51ea786530c0669d6f92b8c3,b6364869c2e098685b5179ebe0f9a033d5537bdb..1279cd85663e67594ac7e3a6be052577cc47284e
--- 1/net/netfilter/nft_compat.c
--- 2/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@@ -19,7 -19,6 +19,7 @@@
  #include <linux/netfilter/x_tables.h>
  #include <linux/netfilter_ipv4/ip_tables.h>
  #include <linux/netfilter_ipv6/ip6_tables.h>
 +#include <linux/netfilter_bridge/ebtables.h>
  #include <net/netfilter/nf_tables.h>
  
  static int nft_compat_chain_validate_dependency(const char *tablename,
@@@ -41,7 -40,6 +41,7 @@@
  union nft_entry {
        struct ipt_entry e4;
        struct ip6t_entry e6;
 +      struct ebt_entry ebt;
  };
  
  static inline void
@@@ -52,9 -50,9 +52,9 @@@ nft_compat_set_par(struct xt_action_par
        par->hotdrop    = false;
  }
  
 -static void nft_target_eval(const struct nft_expr *expr,
 -                          struct nft_data data[NFT_REG_MAX + 1],
 -                          const struct nft_pktinfo *pkt)
 +static void nft_target_eval_xt(const struct nft_expr *expr,
 +                             struct nft_data data[NFT_REG_MAX + 1],
 +                             const struct nft_pktinfo *pkt)
  {
        void *info = nft_expr_priv(expr);
        struct xt_target *target = expr->ops->data;
@@@ -68,7 -66,7 +68,7 @@@
        if (pkt->xt.hotdrop)
                ret = NF_DROP;
  
 -      switch(ret) {
 +      switch (ret) {
        case XT_CONTINUE:
                data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
                break;
@@@ -76,41 -74,7 +76,41 @@@
                data[NFT_REG_VERDICT].verdict = ret;
                break;
        }
 -      return;
 +}
 +
 +static void nft_target_eval_bridge(const struct nft_expr *expr,
 +                                 struct nft_data data[NFT_REG_MAX + 1],
 +                                 const struct nft_pktinfo *pkt)
 +{
 +      void *info = nft_expr_priv(expr);
 +      struct xt_target *target = expr->ops->data;
 +      struct sk_buff *skb = pkt->skb;
 +      int ret;
 +
 +      nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info);
 +
 +      ret = target->target(skb, &pkt->xt);
 +
 +      if (pkt->xt.hotdrop)
 +              ret = NF_DROP;
 +
 +      switch (ret) {
 +      case EBT_ACCEPT:
 +              data[NFT_REG_VERDICT].verdict = NF_ACCEPT;
 +              break;
 +      case EBT_DROP:
 +              data[NFT_REG_VERDICT].verdict = NF_DROP;
 +              break;
 +      case EBT_CONTINUE:
 +              data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
 +              break;
 +      case EBT_RETURN:
 +              data[NFT_REG_VERDICT].verdict = NFT_RETURN;
 +              break;
 +      default:
 +              data[NFT_REG_VERDICT].verdict = ret;
 +              break;
 +      }
  }
  
  static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
@@@ -136,10 -100,6 +136,10 @@@ nft_target_set_tgchk_param(struct xt_tg
                entry->e6.ipv6.proto = proto;
                entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                break;
 +      case NFPROTO_BRIDGE:
 +              entry->ebt.ethproto = proto;
 +              entry->ebt.invflags = inv ? EBT_IPROTO : 0;
 +              break;
        }
        par->entryinfo  = entry;
        par->target     = target;
@@@ -347,10 -307,6 +347,10 @@@ nft_match_set_mtchk_param(struct xt_mtc
                entry->e6.ipv6.proto = proto;
                entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                break;
 +      case NFPROTO_BRIDGE:
 +              entry->ebt.ethproto = proto;
 +              entry->ebt.invflags = inv ? EBT_IPROTO : 0;
 +              break;
        }
        par->entryinfo  = entry;
        par->match      = match;
@@@ -534,9 -490,6 +534,9 @@@ nfnl_compat_get(struct sock *nfnl, stru
        case AF_INET6:
                fmt = "ip6t_%s";
                break;
 +      case NFPROTO_BRIDGE:
 +              fmt = "ebt_%s";
 +              break;
        default:
                pr_err("nft_compat: unsupported protocol %d\n",
                        nfmsg->nfgen_family);
@@@ -625,8 -578,12 +625,12 @@@ nft_match_select_ops(const struct nft_c
                struct xt_match *match = nft_match->ops.data;
  
                if (strcmp(match->name, mt_name) == 0 &&
-                   match->revision == rev && match->family == family)
+                   match->revision == rev && match->family == family) {
+                       if (!try_module_get(match->me))
+                               return ERR_PTR(-ENOENT);
+ 
                        return &nft_match->ops;
+               }
        }
  
        match = xt_request_find_match(family, mt_name, rev);
@@@ -695,8 -652,12 +699,12 @@@ nft_target_select_ops(const struct nft_
                struct xt_target *target = nft_target->ops.data;
  
                if (strcmp(target->name, tg_name) == 0 &&
-                   target->revision == rev && target->family == family)
+                   target->revision == rev && target->family == family) {
+                       if (!try_module_get(target->me))
+                               return ERR_PTR(-ENOENT);
+ 
                        return &nft_target->ops;
+               }
        }
  
        target = xt_request_find_target(family, tg_name, rev);
@@@ -710,17 -671,13 +718,17 @@@
  
        nft_target->ops.type = &nft_target_type;
        nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
 -      nft_target->ops.eval = nft_target_eval;
        nft_target->ops.init = nft_target_init;
        nft_target->ops.destroy = nft_target_destroy;
        nft_target->ops.dump = nft_target_dump;
        nft_target->ops.validate = nft_target_validate;
        nft_target->ops.data = target;
  
 +      if (family == NFPROTO_BRIDGE)
 +              nft_target->ops.eval = nft_target_eval_bridge;
 +      else
 +              nft_target->ops.eval = nft_target_eval_xt;
 +
        list_add(&nft_target->head, &nft_target_list);
  
        return &nft_target->ops;