mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-04-12 06:49:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/net/netfilter
History
Sebastian Andrzej Siewior 5cfe5612ca netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template. 
nft_ct_pcpu_template is a per-CPU variable and relies on disabled BH for its
locking. The refcounter is read and if its value is set to one then the
refcounter is incremented and variable is used - otherwise it is already
in use and left untouched.

Without per-CPU locking in local_bh_disable() on PREEMPT_RT the
read-then-increment operation is not atomic and therefore racy.

This can be avoided by using unconditionally __refcount_inc() which will
increment counter and return the old value as an atomic operation.
In case the returned counter is not one, the variable is in use and we
need to decrement counter. Otherwise we can use it.

Use __refcount_inc() instead of read and a conditional increment.

Fixes: edee4f1e9245 ("netfilter: nft_ct: add zone id set support")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2025-03-03 13:46:49 +01:00
..
ipset
netfilter: ipset: Fix for recursive locking warning
2024-12-19 00:28:47 +01:00
ipvs
ipvs: speed up reads from ip_vs_conn proc file
2025-01-05 18:41:31 +01:00
core.c
net/netfilter: make use of the helper macro LIST_HEAD()
2024-09-06 18:10:21 -07:00
Kconfig
netfilter: xtables: allow xtables-nft only builds
2024-01-29 15:43:21 +01:00
Makefile
netfilter: Add bpf_xdp_flow_lookup kfunc
2024-07-01 17:03:01 +02:00
nf_bpf_link.c
netfilter: bpf: Pass string literal as format argument of request_module()
2024-11-14 12:39:50 +01:00
nf_conncount.c
netfilter: move nf_ct_netns_get out of nf_conncount_init
2024-08-19 18:44:51 +02:00
nf_conntrack_acct.c
…
nf_conntrack_amanda.c
netfilter: conntrack: remove skb argument from nf_ct_refresh
2025-01-19 16:41:55 +01:00
nf_conntrack_bpf.c
net: netfilter: Make ct zone opts configurable for bpf ct helpers
2024-05-22 15:00:56 -07:00
nf_conntrack_broadcast.c
netfilter: conntrack: remove skb argument from nf_ct_refresh
2025-01-19 16:41:55 +01:00
nf_conntrack_core.c
netfilter: conntrack: rework offload nf_conn timeout extension logic
2025-01-19 16:41:55 +01:00
nf_conntrack_ecache.c
netfilter: conntrack: add conntrack event timestamp
2025-01-09 14:42:16 +01:00
nf_conntrack_expect.c
netfilter: expect: Simplify the allocation of slab caches in nf_conntrack_expect_init
2024-02-21 11:57:11 +01:00
nf_conntrack_extend.c
netfilter: conntrack: fix extension size table
2023-09-13 21:57:50 +02:00
nf_conntrack_ftp.c
…
nf_conntrack_h323_asn1.c
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
2024-03-07 03:10:35 +01:00
nf_conntrack_h323_main.c
netfilter: conntrack: remove skb argument from nf_ct_refresh
2025-01-19 16:41:55 +01:00
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c
netfilter: conntrack: simplify nf_conntrack_alter_reply
2023-10-10 16:34:28 +02:00
nf_conntrack_irc.c
…
nf_conntrack_labels.c
netfilter: conntrack: switch connlabels to atomic_t
2023-10-24 13:16:30 +02:00
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c
Networking changes for 6.14.
2025-01-22 08:28:57 -08:00
nf_conntrack_ovs.c
netfilter: use nf_ip6_check_hbh_len in nf_ct_skb_network_trim
2023-03-08 14:25:41 +01:00
nf_conntrack_pptp.c
…
nf_conntrack_proto_dccp.c
netfilter: conntrack: dccp: try not to drop skb in conntrack
2024-05-06 11:13:56 +02:00
nf_conntrack_proto_generic.c
…
nf_conntrack_proto_gre.c
netfilter: conntrack: gre: don't set assured flag for clash entries
2023-07-05 14:42:15 +02:00
nf_conntrack_proto_icmp.c
…
nf_conntrack_proto_icmpv6.c
netfilter: conntrack: fix ct-state for ICMPv6 Multicast Router Discovery
2024-05-06 11:13:56 +02:00
nf_conntrack_proto_sctp.c
netfilter: conntrack: cleanup timeout definitions
2025-01-12 20:21:01 -08:00
nf_conntrack_proto_tcp.c
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
nf_conntrack_proto_udp.c
…
nf_conntrack_proto.c
netfilter: add missing module descriptions
2023-11-08 13:52:32 +01:00
nf_conntrack_sane.c
…
nf_conntrack_seqadj.c
…
nf_conntrack_sip.c
netfilter: conntrack: remove skb argument from nf_ct_refresh
2025-01-19 16:41:55 +01:00
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c
lsm: replace context+len with lsm_context
2024-12-04 14:42:31 -05:00
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c
…
nf_conntrack_timestamp.c
…
nf_dup_netdev.c
…
nf_flow_table_bpf.c
netfilter: Add bpf_xdp_flow_lookup kfunc
2024-07-01 17:03:01 +02:00
nf_flow_table_core.c
netfilter: flowtable: add CLOSING state
2025-01-19 16:41:56 +01:00
nf_flow_table_inet.c
net: netfilter: move nf flowtable bpf initialization in nf_flow_table_module_init()
2024-09-12 15:41:03 +02:00
nf_flow_table_ip.c
Revert "netfilter: flowtable: teardown flow if cached mtu is stale"
2025-02-12 10:35:20 +01:00
nf_flow_table_offload.c
netfilter: flowtable: initialise extack before use
2024-08-14 23:37:16 +02:00
nf_flow_table_procfs.c
…
nf_flow_table_xdp.c
netfilter: nf_tables: Add flowtable map for xdp offload
2024-07-01 17:01:53 +02:00
nf_hooks_lwtunnel.c
sysctl: treewide: constify the ctl_table argument of proc_handlers
2024-07-24 20:59:29 +02:00
nf_internals.h
netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
2024-06-19 18:41:59 +02:00
nf_log_syslog.c
netfilter: propagate net to nf_bridge_get_physindev
2024-01-17 12:02:48 +01:00
nf_log.c
sysctl: treewide: constify the ctl_table argument of proc_handlers
2024-07-24 20:59:29 +02:00
nf_nat_amanda.c
…
nf_nat_bpf.c
bpf: treewide: Annotate BPF kfuncs in BTF
2024-01-31 20:40:56 -08:00
nf_nat_core.c
net: convert to nla_get_*_default()
2024-11-11 10:32:06 -08:00
nf_nat_ftp.c
…
nf_nat_helper.c
…
nf_nat_irc.c
…
nf_nat_masquerade.c
…
nf_nat_ovs.c
netfilter: nf_nat: fix action not being set for all ct states
2024-01-03 11:17:17 +01:00
nf_nat_proto.c
ipsec-next-2023-10-28
2023-10-30 14:36:57 -07:00
nf_nat_redirect.c
netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
2023-11-08 16:40:30 +01:00
nf_nat_sip.c
…
nf_nat_tftp.c
…
nf_queue.c
netfilter: move nf_reinject into nfnetlink_queue modules
2024-02-21 12:03:22 +01:00
nf_sockopt.c
…
nf_synproxy_core.c
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
nf_tables_api.c
netfilter pull request 25-01-30
2025-01-30 09:01:00 -08:00
nf_tables_core.c
netfilter: nf_tables: don't initialize registers in nft_do_chain()
2024-08-20 12:37:25 +02:00
nf_tables_offload.c
netfilter: nf_tables: do not store nft_ctx in transaction objects
2024-06-25 20:40:47 +02:00
nf_tables_trace.c
net: add and use skb_get_hash_net
2024-06-12 14:33:38 -07:00
nfnetlink_acct.c
…
nfnetlink_cthelper.c
…
nfnetlink_cttimeout.c
netfilter: cttimeout: remove 'l3num' attr check
2024-06-26 00:54:53 +02:00
nfnetlink_hook.c
netfilter: nfnetlink hook: dump bpf prog id
2023-04-21 11:34:14 -07:00
nfnetlink_log.c
netfilter: nfnetlink_log: use proper helper for fetching physinif
2024-01-17 12:02:47 +01:00
nfnetlink_osf.c
netfilter: add missing module descriptions
2023-11-08 13:52:32 +01:00
nfnetlink_queue.c
net: corrections for security_secid_to_secctx returns
2025-01-04 22:11:22 -05:00
nfnetlink.c
netfilter: nfnetlink: Report extack policy errors for batched ops
2024-11-14 12:39:40 +01:00
nft_bitwise.c
netfilter: bitwise: add support for doing AND, OR and XOR directly
2024-11-15 12:07:04 +01:00
nft_byteorder.c
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
nft_chain_filter.c
netfilter: nf_tables: Simplify chain netdev notifier
2025-01-19 16:41:54 +01:00
nft_chain_nat.c
netfilter: add missing module descriptions
2023-11-08 13:52:32 +01:00
nft_chain_route.c
…
nft_cmp.c
netfilter: nf_tables: pass context structure to nft_parse_register_load
2024-08-20 12:37:24 +02:00
nft_compat.c
netfilter: nf_tables: missing objects with no memcg accounting
2024-09-26 13:03:02 +02:00
nft_connlimit.c
netfilter: nf_tables: allow clone callbacks to sleep
2024-05-10 11:13:45 +02:00
nft_counter.c
netfilter: nft_counter: Use u64_stats_t for statistic.
2024-09-03 10:47:16 +02:00
nft_ct_fast.c
netfilter: nf_tables: fix ct untracked match breakage
2023-05-03 13:49:08 +02:00
nft_ct.c
netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
2025-03-03 13:46:49 +01:00
nft_dup_netdev.c
netfilter: nf_tables: pass context structure to nft_parse_register_load
2024-08-20 12:37:24 +02:00
nft_dynset.c
netfilter: nf_tables: set element timeout update support
2024-09-03 18:19:44 +02:00
nft_exthdr.c
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
nft_fib_inet.c
…
nft_fib_netdev.c
…
nft_fib.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_flow_offload.c
netfilter: nft_flow_offload: update tcp state flags under lock
2025-01-19 16:41:54 +01:00
nft_fwd_netdev.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_hash.c
netfilter: nf_tables: pass context structure to nft_parse_register_load
2024-08-20 12:37:24 +02:00
nft_immediate.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_inner.c
netfilter: nft_inner: incorrect percpu area handling under softirq
2024-12-03 22:10:58 +01:00
nft_last.c
netfilter: nf_tables: allow clone callbacks to sleep
2024-05-10 11:13:45 +02:00
nft_limit.c
netfilter: nf_tables: allow clone callbacks to sleep
2024-05-10 11:13:45 +02:00
nft_log.c
netfilter: nf_tables: missing objects with no memcg accounting
2024-09-26 13:03:02 +02:00
nft_lookup.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_masq.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_meta.c
netfilter: nf_tables: missing objects with no memcg accounting
2024-09-26 13:03:02 +02:00
nft_nat.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_numgen.c
netfilter: nf_tables: missing objects with no memcg accounting
2024-09-26 13:03:02 +02:00
nft_objref.c
netfilter: nf_tables: pass context structure to nft_parse_register_load
2024-08-20 12:37:24 +02:00
nft_osf.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_payload.c
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
2024-10-31 10:54:49 +01:00
nft_queue.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_quota.c
netfilter: nf_tables: allow clone callbacks to sleep
2024-05-10 11:13:45 +02:00
nft_range.c
netfilter: nf_tables: pass context structure to nft_parse_register_load
2024-08-20 12:37:24 +02:00
nft_redir.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_reject_inet.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_reject_netdev.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_reject.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_rt.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_set_bitmap.c
netfilter: nf_tables: avoid false-positive lockdep splats in set walker
2024-11-05 22:06:22 +01:00
nft_set_hash.c
netfilter: nft_set_hash: skip duplicated elements pending gc run
2024-12-04 21:37:41 +01:00
nft_set_pipapo_avx2.c
netfilter: nft_set_pipapo_avx2: disable softinterrupts
2024-07-24 10:01:59 +02:00
nft_set_pipapo_avx2.h
…
nft_set_pipapo.c
netfilter: nf_tables: missing objects with no memcg accounting
2024-09-26 13:03:02 +02:00
nft_set_pipapo.h
netfilter: nf_set_pipapo: fix initial map fill
2024-07-17 19:00:47 +02:00
nft_set_rbtree.c
netfilter: nf_tables: fix set size with rbtree backend
2025-01-19 16:41:41 +01:00
nft_socket.c
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
2024-11-28 13:14:24 +01:00
nft_synproxy.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_tproxy.c
netfilter: nf_tables: drop unused 3rd argument from validate callback ops
2024-09-03 10:47:17 +02:00
nft_tunnel.c
net: convert to nla_get_*_default()
2024-11-11 10:32:06 -08:00
nft_xfrm.c
xfrm: add generic iptfs defines and functionality
2024-12-05 10:01:28 +01:00
utils.c
netfilter: move nf_reinject into nfnetlink_queue modules
2024-02-21 12:03:22 +01:00
x_tables.c
netfilter: Fix use-after-free in get_info()
2024-10-30 13:17:36 +01:00
xt_addrtype.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_AUDIT.c
…
xt_bpf.c
…
xt_cgroup.c
…
xt_CHECKSUM.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_CLASSIFY.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_cluster.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_comment.c
…
xt_connbytes.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_connlabel.c
…
xt_connlimit.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_connmark.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_CONNSECMARK.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_conntrack.c
…
xt_cpu.c
…
xt_CT.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_DSCP.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c
netfilter: xt_hashlimit: htable_selective_cleanup() optimization
2025-01-05 18:41:32 +01:00
xt_helper.c
…
xt_hl.c
…
xt_HL.c
…
xt_HMARK.c
…
xt_IDLETIMER.c
netfilter: IDLETIMER: Fix for possible ABBA deadlock
2024-12-11 23:15:19 +01:00
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c
…
xt_l2tp.c
…
xt_LED.c
netfilter: x_tables: fix LED ID check in led_tg_check()
2024-11-28 13:14:24 +01:00
xt_length.c
…
xt_limit.c
…
xt_LOG.c
…
xt_mac.c
…
xt_mark.c
netfilter: xtables: fix typo causing some targets not to load on IPv6
2024-10-21 11:31:26 +02:00
xt_MASQUERADE.c
…
xt_multiport.c
…
xt_nat.c
…
xt_NETMAP.c
…
xt_nfacct.c
…
xt_NFLOG.c
netfilter: xtables: fix typo causing some targets not to load on IPv6
2024-10-21 11:31:26 +02:00
xt_NFQUEUE.c
…
xt_osf.c
netfilter: nfnetlink_osf: fix module autoload
2023-06-20 22:43:42 +02:00
xt_owner.c
netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
2023-12-06 17:52:15 +01:00
xt_physdev.c
netfilter: propagate net to nf_bridge_get_physindev
2024-01-17 12:02:48 +01:00
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_RATEEST.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_realm.c
…
xt_recent.c
netfilter: xt_recent: Lift restrictions on max hitcount value
2024-06-28 17:57:50 +02:00
xt_REDIRECT.c
netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs
2023-03-22 21:48:59 +01:00
xt_repldata.h
netfilter: xtables: refactor deprecated strncpy
2023-08-22 15:13:21 +02:00
xt_sctp.c
netfilter: xt_sctp: validate the flag_info count
2023-08-30 17:34:01 +02:00
xt_SECMARK.c
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
2024-10-09 23:20:46 +02:00
xt_set.c
…
xt_socket.c
net: annotate data-races around sk->sk_mark
2023-07-29 18:13:41 +01:00
xt_state.c
…
xt_statistic.c
…
xt_string.c
…
xt_tcpmss.c
…
xt_TCPMSS.c
…
xt_TCPOPTSTRIP.c
…
xt_tcpudp.c
xtables: move icmp/icmpv6 logic to xt_tcpudp
2023-03-22 21:48:59 +01:00
xt_TEE.c
…
xt_time.c
…
xt_TPROXY.c
…
xt_TRACE.c
netfilter: xtables: fix typo causing some targets not to load on IPv6
2024-10-21 11:31:26 +02:00
xt_u32.c
netfilter: xt_u32: validate user space input
2023-08-30 17:34:01 +02:00