Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1558319

[PATCH 4.9 02/59] net: vrf: Drop conntrack data after pass through VRF device on Tx

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Ahern <dsa@cumulusnetworks.com>


[ Upstream commit eb63ecc1706b3e094d0f57438b6c2067cfc299f2 ]

Locally originated traffic in a VRF fails in the presence of a POSTROUTING
rule. For example,

    $ iptables -t nat -A POSTROUTING -s 11.1.1.0/24  -j MASQUERADE
    $ ping -I red -c1 11.1.1.3
    ping: Warning: source address might be selected on device other than red.
    PING 11.1.1.3 (11.1.1.3) from 11.1.1.2 red: 56(84) bytes of data.
    ping: sendmsg: Operation not permitted

Worse, the above causes random corruption resulting in a panic in random
places (I have not seen a consistent backtrace).

Call nf_reset to drop the conntrack info following the pass through the
VRF device.  The nf_reset is needed on Tx but not Rx because of the order
in which NF_HOOK's are hit: on Rx the VRF device is after the real ingress
device and on Tx it is is before the real egress device. Connection
tracking should be tied to the real egress device and not the VRF device.

Fixes: 8f58336d3f78a ("net: Add ethernet header for pass through VRF device")
Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vrf.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -371,6 +371,8 @@ static int vrf_finish_output6(struct net
 	struct in6_addr *nexthop;
 	int ret;
 
+	nf_reset(skb);
+
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->dev = dev;
 
@@ -552,6 +554,8 @@ static int vrf_finish_output(struct net
 	u32 nexthop;
 	int ret = -EINVAL;
 
+	nf_reset(skb);
+
 	/* Be paranoid, rather than too clever. */
 	if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
 		struct sk_buff *skb2;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 46/59] ARM: zynq: Reserve correct amount of non-DMA RAM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 50/59] ARM: OMAP5: Fix mpuss_early_init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 47/59] ARM: qcom_defconfig: Fix MDM9515 LCC and GCC config Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 32/59] gro: Enter slow-path if there is no tailroom Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 35/59] net/mlx5e: Remove WARN_ONCE from adaptive moderation code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 28/59] r8152: split rtl8152_suspend function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 17/59] net: fix incorrect original ingress device index in PKTINFO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 33/59] gro: use min_t() in skb_gro_reset_offset() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 59/59] rtlwifi: rtl_usb: Fix missing entry in USB drivers private data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 08/59] net/sched: cls_flower: Fix missing addr_type in classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 39/59] ALSA: firewire-tascam: Fix to handle error from initialization of stream data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 53/59] ARM: 8631/1: clkdev: Detect errors in clk_hw_register_clkdev() for mass registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 29/59] r8152: fix rx issue for runtime suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 26/59] net: dsa: bcm_sf2: Do not clobber b53_switch_ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 58/59] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 23/59] ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 19/59] drop_monitor: add missing call to genlmsg_end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 42/59] arm64: dts: mt8173: Fix auxadc node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 13/59] net/mlx5: Prevent setting multicast macs for VFs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 02/59] net: vrf: Drop conntrack data after pass through VRF device on Tx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 05/59] ipv6: handle -EFAULT from skb_copy_bits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 30/59] net: dsa: Ensure validity of dst->ds[0] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 54/59] ARM: omap2+: am437x: rollback to use omap3_gptimer_timer_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 10/59] net/mlx5: Cancel recovery work in remove flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 06/59] net, sched: fix soft lockup in tc_classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 52/59] ARM: OMAP4+: Fix bad fallthrough for cpuidle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 01/59] net: vrf: Fix NAT within a VRF Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 16/59] rtnl: stats - add missing netlink message size checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 12/59] net/mlx5: Mask destination mac value in ethtool steering rules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 07/59] net: stmmac: Fix race between stmmac_drv_probe and stmmac_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 27/59] net: dsa: bcm_sf2: Utilize nested MDIO read/write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 48/59] svcrdma: Clear xpt_bc_xps in xprt_setup_rdma_bc() error exit arm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 38/59] HID: hid-cypress: validate length of report Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 11/59] net/mlx5: Avoid shadowing numa_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 51/59] ARM: OMAP5: Fix build for PM code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 22/59] igmp: Make igmp group member RFC 3376 compliant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 24/59] net: vrf: Add missing Rx counters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 56/59] ALSA: usb-audio: Add a quirk for Plantronics BT600 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
  [PATCH 4.9 21/59] flow_dissector: Update pptp handling to avoid null pointer deref. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 41/59] tools/virtio: fix READ_ONCE() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 49/59] bus: arm-ccn: Prevent hotplug callback leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 03/59] sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 09/59] net/mlx5: Check FW limitations on log_max_qp before setting it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 04/59] inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 20/59] drop_monitor: consider inserted data in genlmsg_end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 40/59] powerpc: Fix build warning on 32-bit PPC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 18/59] net: ipv4: dst for local input routes should use l3mdev if relevant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 45/59] ARM: pxa: fix pxa25x interrupt init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 37/59] net: vrf: do not allow table id 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 34/59] gro: Disable frag0 optimization on IPv6 ext headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 15/59] net/mlx5e: Disable netdev after close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 14/59] net/mlx5e: Dont sync netdev state when not registered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 25/59] bpf: change back to orig prog on too many passes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 36/59] net: ipv4: Fix multipath selection with vrf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  [PATCH 4.9 43/59] ARM64: dts: bcm2837-rpi-3-b: remove incorrect pwr LED Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
  Re: [PATCH 4.9 00/59] 4.9.4-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-13 21:30 +0100
    Re: [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-14 08:30 +0100
  Re: [PATCH 4.9 00/59] 4.9.4-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-13 23:00 +0100
    Re: [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-14 08:30 +0100

csiph-web