Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1447640
| From | Jiri Slaby <jirislaby@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps |
| Date | 2016-07-21 08:40 +0200 |
| Message-ID | <rXfOh-3JM-7@gated-at.bofh.it> (permalink) |
| References | <rUK2e-75j-27@gated-at.bofh.it> <rUKvg-7nE-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On 07/14/2016, 10:15 AM, Jiri Slaby wrote:
> From: Florian Westphal <fw@strlen.de>
>
> 3.12-stable review patch. If anyone has any objections, please let me know.
>
> ===============
>
> commit 36472341017529e2b12573093cc0f68719300997 upstream.
I am now dropping this one. 3.12.62 will be released without that patch.
After the performance issue is resolved, it will be requeued.
> When we see a jump also check that the offset gets us to beginning of
> a rule (an ipt_entry).
>
> The extra overhead is negible, even with absurd cases.
>
> 300k custom rules, 300k jumps to 'next' user chain:
> [ plus one jump from INPUT to first userchain ]:
>
> Before:
> real 0m24.874s
> user 0m7.532s
> sys 0m16.076s
>
> After:
> real 0m27.464s
> user 0m7.436s
> sys 0m18.840s
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> ---
> net/ipv4/netfilter/arp_tables.c | 17 +++++++++++++++++
> net/ipv4/netfilter/ip_tables.c | 17 +++++++++++++++++
> net/ipv6/netfilter/ip6_tables.c | 17 +++++++++++++++++
> 3 files changed, 51 insertions(+)
>
> diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
> index 7460b7bef3ab..473ec559ce7b 100644
> --- a/net/ipv4/netfilter/arp_tables.c
> +++ b/net/ipv4/netfilter/arp_tables.c
> @@ -358,6 +358,19 @@ static inline bool unconditional(const struct arpt_entry *e)
> memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
> }
>
> +static bool find_jump_target(const struct xt_table_info *t,
> + const void *entry0,
> + const struct arpt_entry *target)
> +{
> + struct arpt_entry *iter;
> +
> + xt_entry_foreach(iter, entry0, t->size) {
> + if (iter == target)
> + return true;
> + }
> + return false;
> +}
> +
> /* Figures out from what hook each rule can be called: returns 0 if
> * there are loops. Puts hook bitmask in comefrom.
> */
> @@ -451,6 +464,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
> /* This a jump; chase it. */
> duprintf("Jump rule %u -> %u\n",
> pos, newpos);
> + e = (struct arpt_entry *)
> + (entry0 + newpos);
> + if (!find_jump_target(newinfo, entry0, e))
> + return 0;
> } else {
> /* ... this is a fallthru */
> newpos = pos + e->next_offset;
> diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
> index 8fc22eed9603..dba9d8070d07 100644
> --- a/net/ipv4/netfilter/ip_tables.c
> +++ b/net/ipv4/netfilter/ip_tables.c
> @@ -434,6 +434,19 @@ ipt_do_table(struct sk_buff *skb,
> #endif
> }
>
> +static bool find_jump_target(const struct xt_table_info *t,
> + const void *entry0,
> + const struct ipt_entry *target)
> +{
> + struct ipt_entry *iter;
> +
> + xt_entry_foreach(iter, entry0, t->size) {
> + if (iter == target)
> + return true;
> + }
> + return false;
> +}
> +
> /* Figures out from what hook each rule can be called: returns 0 if
> there are loops. Puts hook bitmask in comefrom. */
> static int
> @@ -531,6 +544,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
> /* This a jump; chase it. */
> duprintf("Jump rule %u -> %u\n",
> pos, newpos);
> + e = (struct ipt_entry *)
> + (entry0 + newpos);
> + if (!find_jump_target(newinfo, entry0, e))
> + return 0;
> } else {
> /* ... this is a fallthru */
> newpos = pos + e->next_offset;
> diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
> index 63f7876c4f29..97a8d2525c26 100644
> --- a/net/ipv6/netfilter/ip6_tables.c
> +++ b/net/ipv6/netfilter/ip6_tables.c
> @@ -444,6 +444,19 @@ ip6t_do_table(struct sk_buff *skb,
> #endif
> }
>
> +static bool find_jump_target(const struct xt_table_info *t,
> + const void *entry0,
> + const struct ip6t_entry *target)
> +{
> + struct ip6t_entry *iter;
> +
> + xt_entry_foreach(iter, entry0, t->size) {
> + if (iter == target)
> + return true;
> + }
> + return false;
> +}
> +
> /* Figures out from what hook each rule can be called: returns 0 if
> there are loops. Puts hook bitmask in comefrom. */
> static int
> @@ -541,6 +554,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
> /* This a jump; chase it. */
> duprintf("Jump rule %u -> %u\n",
> pos, newpos);
> + e = (struct ip6t_entry *)
> + (entry0 + newpos);
> + if (!find_jump_target(newinfo, entry0, e))
> + return 0;
> } else {
> /* ... this is a fallthru */
> newpos = pos + e->next_offset;
>
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.12 00/88] 3.12.62-stable review Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 01/88] PCI/AER: Clear error status registers during enumeration and restore Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 10/88] sparc64: Fix return from trap window fill crashes. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 86/88] cdc_ncm: workaround for EM7455 "silent" data interface Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 40/88] netfilter: x_tables: xt_compat_match_from_user doesn't need a retval Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 15/88] tcp: record TLP and ER timer stats in v6 stats Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 62/88] NFS: Fix another OPEN_DOWNGRADE bug Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 38/88] netfilter: ip_tables: simplify translate_compat_table args Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 61/88] make nfs_atomic_open() call d_drop() on all ->open_context() errors. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 85/88] HID: elo: kill not flush the work Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 83/88] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:20 +0200
[PATCH 3.12 64/88] mm: Export migrate_page_move_mapping and migrate_page_copy Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 53/88] mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 60/88] x86/amd_nb: Fix boot crash on non-AMD systems Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 65/88] UBIFS: Implement ->migratepage() Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 81/88] KVM: x86: expose invariant tsc cpuid bit (v2) Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
Re: [PATCH 3.12 81/88] KVM: x86: expose invariant tsc cpuid bit (v2) Paolo Bonzini <pbonzini@redhat.com> - 2016-07-14 10:50 +0200
Re: [PATCH 3.12 81/88] KVM: x86: expose invariant tsc cpuid bit (v2) Jiri Slaby <jslaby@suse.cz> - 2016-07-14 11:30 +0200
Re: [PATCH 3.12 81/88] KVM: x86: expose invariant tsc cpuid bit (v2) Paolo Bonzini <pbonzini@redhat.com> - 2016-07-14 11:50 +0200
[PATCH 3.12 79/88] KEYS: potential uninitialized variable Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 76/88] rds: fix an infoleak in rds_inc_info_copy Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 80/88] base: make module_create_drivers_dir race-free Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 78/88] SCSI: Increase REPORT_LUNS timeout Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 71/88] ALSA: hrtimer: Handle start/stop more properly Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 84/88] ALSA: compress: fix an integer overflow check Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 58/88] x86, build: copy ldlinux.c32 to image.iso Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 75/88] net/qlge: Avoids recursive EEH error Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 69/88] USB: usbfs: fix potential infoleak in devio Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 52/88] mac80211: mesh: flush mesh paths unconditionally Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 54/88] IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 70/88] ktime: export ktime_divns Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 57/88] USB: EHCI: declare hostpc register as zero-length array Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 50/88] usb: musb: Stop bulk endpoint while queue is rotated Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 72/88] ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 73/88] ALSA: timer: Fix leak in events via snd_timer_user_ccallback Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 56/88] powerpc/pseries: Fix PCI config address for DDW Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 68/88] Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 63/88] ARM: 8578/1: mm: ensure pmd_present only checks the valid bit Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 74/88] ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 67/88] scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 77/88] EDAC: Remove arbitrary limit on number of channels Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 59/88] kprobes/x86: Clear TF bit in fault on single-stepping Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 55/88] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 66/88] scsi: remove scsi_end_request Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:30 +0200
[PATCH 3.12 37/88] netfilter: arp_tables: simplify translate_compat_table args Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 51/88] usb: musb: Ensure rx reinit occurs for shared_fifo endpoints Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 45/88] crypto: ux500 - memmove the right size Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 43/88] Revert "netfilter: ensure number of counters is >0 in do_replace()" Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 48/88] net: alx: Work around the DMA RX overflow issue Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 47/88] ipmr/ip6mr: Initialize the last assert time of mfc entries. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 44/88] netfilter: x_tables: introduce and use xt_copy_counters_from_user Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 46/88] sit: correct IP protocol used in ipip6_err Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 41/88] netfilter: ensure number of counters is >0 in do_replace() Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 42/88] netfilter: x_tables: do compat validation via translate_table Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
Re: [PATCH 3.12 42/88] netfilter: x_tables: do compat validation via translate_table Michal Kubecek <mkubecek@suse.cz> - 2016-07-19 09:20 +0200
Re: [PATCH 3.12 42/88] netfilter: x_tables: do compat validation via translate_table Florian Westphal <fw@strlen.de> - 2016-07-19 10:50 +0200
Re: [PATCH 3.12 42/88] netfilter: x_tables: do compat validation via translate_table Florian Westphal <fw@strlen.de> - 2016-07-19 11:20 +0200
Re: [PATCH 3.12 42/88] netfilter: x_tables: do compat validation via translate_table Michal Kubecek <mkubecek@suse.cz> - 2016-07-19 11:50 +0200
[PATCH 3.12 49/88] usb: quirks: Add no-lpm quirk for Acer C120 LED Projector Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:40 +0200
[PATCH 3.12 19/88] KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Jiri Slaby <jirislaby@gmail.com> - 2016-07-21 08:40 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Greg KH <greg@kroah.com> - 2016-07-21 21:00 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Jiri Slaby <jslaby@suse.cz> - 2016-07-21 21:10 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Michal Kubecek <mkubecek@suse.cz> - 2016-07-25 07:50 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Michal Kubecek <mkubecek@suse.cz> - 2016-07-25 09:00 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Florian Westphal <fw@strlen.de> - 2016-07-25 09:30 +0200
Re: [PATCH 3.12 28/88] netfilter: x_tables: validate targets of jumps Florian Westphal <fw@strlen.de> - 2016-07-25 09:10 +0200
[PATCH 3.12 11/88] perf/x86: Honor the architectural performance monitoring version Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 09/88] sparc: Harden signal return frame checks. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 22/88] powerpc: Use privileged SPR number for MMCR2 Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 20/88] ARM: fix PTRACE_SETVFPREGS on SMP systems Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 21/88] powerpc: Fix definition of SIAR and SDAR registers Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 02/88] MIPS: Fix 64k page support for 32 bit kernels. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 25/88] wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 13/88] netlink: Fix dump skb leak/double free Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 29/88] netfilter: x_tables: add and use xt_check_entry_offsets Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 24/88] ecryptfs: forbid opening files without mmap handler Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 18/88] drivers: macintosh: rack-meter: limit idle ticks to total ticks Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 17/88] macintosh/therm_windtunnel: Export I2C module alias information Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 06/88] sparc64: Fix sparc64_set_context stack handling. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 36/88] netfilter: x_tables: don't reject valid target size on some architectures Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 05/88] sparc64: Fix bootup regressions on some Kconfig combinations. Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 26/88] fix d_walk()/non-delayed __d_free() race Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 23/88] parisc: Fix pagefault crash in unaligned __get_user() call Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 31/88] netfilter: x_tables: assert minimum target size Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 33/88] netfilter: x_tables: check standard target size too Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 12/88] perf/x86: Fix undefined shift on 32-bit kernels Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 30/88] netfilter: x_tables: kill check_entry helper Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 16/88] ipv6: Skip XFRM lookup if dst_entry in socket cache is valid Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 34/88] netfilter: x_tables: check for bogus target offset Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 32/88] netfilter: x_tables: add compat version of xt_check_entry_offsets Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 07/88] sparc/PCI: Fix for panic while enabling SR-IOV Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 35/88] netfilter: x_tables: validate all offsets and sizes in a rule Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
[PATCH 3.12 27/88] netfilter: x_tables: don't move to non-existent next rule Jiri Slaby <jslaby@suse.cz> - 2016-07-14 10:50 +0200
Re: [PATCH 3.12 00/88] 3.12.62-stable review Guenter Roeck <linux@roeck-us.net> - 2016-07-14 22:30 +0200
Re: [PATCH 3.12 00/88] 3.12.62-stable review Jiri Slaby <jslaby@suse.cz> - 2016-07-15 09:40 +0200
Re: [PATCH 3.12 00/88] 3.12.62-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-07-14 23:50 +0200
csiph-web