Alexander Maltsev 12fa993433 netfilter: ipset: Add list flush to cancel_gc ...

[ Upstream commit c1193d9bbb ]

Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.

Fixes: 97f7cf1cd8 ("netfilter: ipset: fix performance regression in swap operation")
Signed-off-by: Alexander Maltsev <keltar.gw@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-08-19 05:41:10 +02:00

..

ipset

netfilter: ipset: Add list flush to cancel_gc

2024-08-19 05:41:10 +02:00

ipvs

ipvs: Avoid unnecessary calls to skb_is_gso_sctp

2024-08-19 05:40:46 +02:00

core.c

Remove DECnet support from kernel

2023-06-21 15:45:38 +02:00

Kconfig

netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y

2022-09-05 10:28:58 +02:00

Makefile

…

nf_conncount.c

…

nf_conntrack_acct.c

…

nf_conntrack_amanda.c

…

nf_conntrack_broadcast.c

…

nf_conntrack_core.c

netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper

2023-06-14 11:09:41 +02:00

nf_conntrack_ecache.c

…

nf_conntrack_expect.c

…

nf_conntrack_extend.c

…

nf_conntrack_ftp.c

…

nf_conntrack_h323_asn1.c

netfilter: nf_conntrack_h323: Add protection for bmp length out of range

2024-03-15 10:48:15 -04:00

nf_conntrack_h323_main.c

…

nf_conntrack_h323_types.c

…

nf_conntrack_helper.c

netfilter: conntrack: Avoid nf_ct_helper_hash uses after free

2023-07-27 08:44:17 +02:00

nf_conntrack_irc.c

netfilter: nf_conntrack_irc: Tighten matching on DCC message

2022-09-28 11:10:30 +02:00

nf_conntrack_labels.c

…

nf_conntrack_netbios_ns.c

…

nf_conntrack_netlink.c

netfilter: ctnetlink: use helper function to calculate expect ID

2024-08-19 05:40:53 +02:00

nf_conntrack_pptp.c

…

nf_conntrack_proto_dccp.c

netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one

2023-07-27 08:43:43 +02:00

nf_conntrack_proto_generic.c

…

nf_conntrack_proto_gre.c

…

nf_conntrack_proto_icmp.c

…

nf_conntrack_proto_icmpv6.c

netfilter: conntrack: set icmpv6 redirects as RELATED

2023-01-14 10:15:35 +01:00

nf_conntrack_proto_sctp.c

netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new

2024-03-01 13:16:44 +01:00

nf_conntrack_proto_tcp.c

netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state

2023-02-01 08:23:18 +01:00

nf_conntrack_proto_udp.c

…

nf_conntrack_proto.c

…

nf_conntrack_sane.c

…

nf_conntrack_seqadj.c

…

nf_conntrack_sip.c

netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.

2023-07-27 08:43:43 +02:00

nf_conntrack_snmp.c

…

nf_conntrack_standalone.c

netfilter: conntrack: fix possible bug_on with enable_hooks=1

2023-05-30 12:57:46 +01:00

nf_conntrack_tftp.c

…

nf_conntrack_timeout.c

…

nf_conntrack_timestamp.c

…

nf_dup_netdev.c

…

nf_flow_table_core.c

…

nf_flow_table_inet.c

…

nf_flow_table_ip.c

…

nf_flow_table_offload.c

netfilter: flowtable: really fix NAT IPv6 offload

2023-01-14 10:16:08 +01:00

nf_internals.h

…

nf_log_common.c

…

nf_log_netdev.c

…

nf_log.c

netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger

2024-02-23 08:42:17 +01:00

nf_nat_amanda.c

…

nf_nat_core.c

…

nf_nat_ftp.c

…

nf_nat_helper.c

…

nf_nat_irc.c

…

nf_nat_masquerade.c

…

nf_nat_proto.c

…

nf_nat_redirect.c

netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses

2023-11-20 11:06:56 +01:00

nf_nat_sip.c

…

nf_nat_tftp.c

…

nf_queue.c

…

nf_sockopt.c

…

nf_synproxy_core.c

…

nf_tables_api.c

netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

2024-07-05 09:12:49 +02:00

nf_tables_core.c

netfilter: nf_tables: add and use nft_thoff helper

2023-10-10 21:53:29 +02:00

nf_tables_offload.c

netfilter: nf_tables: use net_generic infra for transaction data

2023-07-27 08:44:15 +02:00

nf_tables_trace.c

netfilter: nf_tables: add and use nft_thoff helper

2023-10-10 21:53:29 +02:00

nfnetlink_acct.c

netfilter: add helper function to set up the nfnetlink header and use it

2022-08-25 11:38:11 +02:00

nfnetlink_cthelper.c

netfilter: add helper function to set up the nfnetlink header and use it

2022-08-25 11:38:11 +02:00

nfnetlink_cttimeout.c

netfilter: add helper function to set up the nfnetlink header and use it

2022-08-25 11:38:11 +02:00

nfnetlink_log.c

netfilter: nfnetlink_log: silence bogus compiler warning

2023-11-08 17:30:49 +01:00

nfnetlink_osf.c

netfilter: nfnetlink_osf: avoid OOB read

2023-09-19 12:20:27 +02:00

nfnetlink_queue.c

netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()

2024-06-16 13:32:28 +02:00

nfnetlink.c

netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM

2023-06-21 15:45:38 +02:00

nft_bitwise.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:15:18 +02:00

nft_byteorder.c

netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()

2024-02-23 08:42:32 +01:00

nft_chain_filter.c

netfilter: nf_tables: honor table dormant flag from netdev release event path

2024-05-02 16:23:42 +02:00

nft_chain_nat.c

…

nft_chain_route.c

…

nft_cmp.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:15:18 +02:00

nft_compat.c

netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()

2024-03-06 14:37:49 +00:00

nft_connlimit.c

…

nft_counter.c

…

nft_ct.c

netfilter: nft_ct: fix l3num expectations with inet pseudo family

2024-03-15 10:48:15 -04:00

nft_dup_netdev.c

…

nft_dynset.c

netfilter: nft_dynset: disallow object maps

2023-08-26 15:26:52 +02:00

nft_exthdr.c

netfilter: nf_tables: fix 'exist' matching on bigendian arches

2023-12-20 15:44:26 +01:00

nft_fib_inet.c

…

nft_fib_netdev.c

…

nft_fib.c

netfilter: nf_tables: fix 'exist' matching on bigendian arches

2023-12-20 15:44:26 +01:00

nft_flow_offload.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

nft_fwd_netdev.c

…

nft_hash.c

…

nft_immediate.c

netfilter: nft_immediate: drop chain reference counter on error

2024-01-15 18:48:04 +01:00

nft_limit.c

…

nft_log.c

…

nft_lookup.c

netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

2024-07-05 09:12:49 +02:00

nft_masq.c

netfilter: nft_masq: correct length for loading protocol registers

2023-03-22 13:29:56 +01:00

nft_meta.c

netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()

2024-02-23 08:42:32 +01:00

nft_nat.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

nft_numgen.c

…

nft_objref.c

netfilter: nf_tables: report use refcount overflow

2023-08-16 18:21:03 +02:00

nft_osf.c

netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families

2022-08-31 17:15:18 +02:00

nft_payload.c

netfilter: nft_payload: restore vlan q-in-q match support

2024-06-16 13:32:28 +02:00

nft_queue.c

…

nft_quota.c

…

nft_range.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:15:18 +02:00

nft_redir.c

netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs

2023-11-20 11:06:56 +01:00

nft_reject_inet.c

netfilter: nf_tables: add and use nft_sk helper

2023-10-10 21:53:29 +02:00

nft_reject.c

…

nft_rt.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

nft_set_bitmap.c

netfilter: nf_tables: drop map element references from preparation phase

2023-07-27 08:44:17 +02:00

nft_set_hash.c

netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration

2023-10-10 21:53:26 +02:00

nft_set_pipapo_avx2.c

netfilter: nft_set_pipapo_avx2: disable softinterrupts

2024-08-19 05:41:04 +02:00

nft_set_pipapo_avx2.h

…

nft_set_pipapo.c

netfilter: nft_set_pipapo: do not free live element

2024-05-02 16:23:36 +02:00

nft_set_pipapo.h

netfilter: nft_set_pipapo: remove scratch_aligned pointer

2024-02-23 08:42:21 +01:00

nft_set_rbtree.c

netfilter: nft_set_rbtree: skip end interval element from gc

2024-02-23 08:42:22 +01:00

nft_socket.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

nft_synproxy.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

nft_tproxy.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

nft_tunnel.c

netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV

2024-06-16 13:32:31 +02:00

nft_xfrm.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:41:57 +01:00

utils.c

…

x_tables.c

…

xt_addrtype.c

…

xt_AUDIT.c

…

xt_bpf.c

…

xt_cgroup.c

…

xt_CHECKSUM.c

…

xt_CLASSIFY.c

…

xt_cluster.c

…

xt_comment.c

…

xt_connbytes.c

…

xt_connlabel.c

…

xt_connlimit.c

…

xt_connmark.c

netfilter: conntrack: Fix data-races around ct mark

2022-12-02 17:40:00 +01:00

xt_CONNSECMARK.c

…

xt_conntrack.c

…

xt_cpu.c

…

xt_CT.c

…

xt_dccp.c

…

xt_devgroup.c

…

xt_dscp.c

…

xt_DSCP.c

…

xt_ecn.c

…

xt_esp.c

…

xt_hashlimit.c

…

xt_helper.c

…

xt_hl.c

…

xt_HL.c

…

xt_HMARK.c

…

xt_IDLETIMER.c

…

xt_ipcomp.c

…

xt_iprange.c

…

xt_ipvs.c

…

xt_l2tp.c

…

xt_LED.c

…

xt_length.c

…

xt_limit.c

…

xt_LOG.c

…

xt_mac.c

…

xt_mark.c

…

xt_MASQUERADE.c

…

xt_multiport.c

…

xt_nat.c

…

xt_NETMAP.c

…

xt_nfacct.c

…

xt_NFLOG.c

…

xt_NFQUEUE.c

…

xt_osf.c

netfilter: nfnetlink_osf: fix module autoload

2023-06-28 10:28:13 +02:00

xt_owner.c

netfilter: xt_owner: Fix for unsafe access of sk->sk_socket

2023-12-13 18:27:00 +01:00

xt_physdev.c

…

xt_pkttype.c

…

xt_policy.c

…

xt_quota.c

…

xt_rateest.c

…

xt_RATEEST.c

…

xt_realm.c

…

xt_recent.c

netfilter: xt_recent: fix (increase) ipv6 literal buffer length

2023-11-20 11:06:56 +01:00

xt_REDIRECT.c

netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs

2023-11-20 11:06:56 +01:00

xt_repldata.h

…

xt_sctp.c

netfilter: xt_sctp: validate the flag_info count

2023-09-19 12:20:20 +02:00

xt_SECMARK.c

…

xt_set.c

…

xt_socket.c

…

xt_state.c

…

xt_statistic.c

…

xt_string.c

…

xt_tcpmss.c

…

xt_TCPMSS.c

…

xt_TCPOPTSTRIP.c

…

xt_tcpudp.c

…

xt_TEE.c

…

xt_time.c

…

xt_TPROXY.c

…

xt_TRACE.c

…

xt_u32.c

netfilter: xt_u32: validate user space input

2023-09-19 12:20:20 +02:00