Re: [Patch net v2] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

2018-02-08 Thread Florian Westphal
Cong Wang wrote: > In clusterip_config_find_get() we hold RCU read lock so it could > run concurrently with clusterip_config_entry_put(), as a result, > the refcnt could go back to 1 from 0, which leads to a double > list_del()... Just replace refcount_inc() with > refcount_inc_not_zero(), as for

[Patch net v2] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

2018-02-08 Thread Cong Wang
In clusterip_config_find_get() we hold RCU read lock so it could run concurrently with clusterip_config_entry_put(), as a result, the refcnt could go back to 1 from 0, which leads to a double list_del()... Just replace refcount_inc() with refcount_inc_not_zero(), as for c->refcount. Fixes: d73f33b

Re: [Patch net] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

2018-02-08 Thread Cong Wang
On Thu, Feb 8, 2018 at 12:01 AM, Florian Westphal wrote: > Cong Wang wrote: >> In clusterip_config_find_get() we hold RCU read lock so it could >> run concurrently with clusterip_config_entry_put(), as a result, >> the refcnt could go back to 1 from 0, which leads to a double >> list_del()... Jus

Re: [Patch net] ipt_CLUSTERIP: fix a race condition of proc file creation

2018-02-08 Thread Pablo Neira Ayuso
On Wed, Feb 07, 2018 at 09:59:17PM -0800, Cong Wang wrote: > There is a race condition between clusterip_config_entry_put() > and clusterip_config_init(), after we release the spinlock in > clusterip_config_entry_put(), a new proc file with a same IP could > be created immediately since it is alrea

Re: How to retrieve original source address with FTP/NAT/TPROXY

2018-02-08 Thread Pablo Neira Ayuso
Hi Gregory, On Tue, Feb 06, 2018 at 03:40:20PM +0100, Gregory Vander Schueren wrote: > Hello, > > I have the following IPv4 network: > > FTPClient <-> Proxy <--> FTPServer. > 10.0.0.2 10.0.0.1 1.1.1.11.1.1.2 > > FTPClient connects to FTPServer

Re: [PATCH RFC 2/4] netlink: add generic object description infrastructure

2018-02-08 Thread Pablo Neira Ayuso
Hi Randy, On Wed, Feb 07, 2018 at 05:28:20PM -0800, Randy Dunlap wrote: [...] > > diff --git a/include/net/nldesc.h b/include/net/nldesc.h > > new file mode 100644 > > index ..19306a648f10 > > --- /dev/null > > +++ b/include/net/nldesc.h > > @@ -0,0 +1,160 @@ > > +/* SPDX-License-Ident

Re: linux-next: Signed-off-by missing for commit in the netfilter tree

2018-02-08 Thread Pablo Neira Ayuso
Hi Stephen, On Thu, Feb 08, 2018 at 07:33:01AM +1100, Stephen Rothwell wrote: > Hi all, > > Commit > > d8ed9600581d ("netfilter: remove useless prototype") > > is missing a Signed-off-by from its committer. That's my fault, sorry about that, it was unintentional. -- To unsubscribe from this

Re: [PATCH net v2] netfilter: drop outermost socket lock in getsockopt()

2018-02-08 Thread Xin Long
On Thu, Feb 8, 2018 at 7:19 PM, Paolo Abeni wrote: > The Syzbot reported a possible deadlock in the netfilter area caused by > rtnl lock, xt lock and socket lock being acquired with a different order > on different code paths, leading to the following backtrace: > > ===

Re: [Patch net] ipt_CLUSTERIP: fix a race condition of proc file creation

2018-02-08 Thread Xin Long
On Thu, Feb 8, 2018 at 1:59 PM, Cong Wang wrote: > There is a race condition between clusterip_config_entry_put() > and clusterip_config_init(), after we release the spinlock in > clusterip_config_entry_put(), a new proc file with a same IP could > be created immediately since it is already remove

[PATCH net v2] netfilter: drop outermost socket lock in getsockopt()

2018-02-08 Thread Paolo Abeni
The Syzbot reported a possible deadlock in the netfilter area caused by rtnl lock, xt lock and socket lock being acquired with a different order on different code paths, leading to the following backtrace: == WARNING: possible circular locking de

Re: [PATCH net] netfilter: on setsockopt() acquire sock lock only in the required scope

2018-02-08 Thread Xin Long
On Thu, Feb 8, 2018 at 6:38 PM, Paolo Abeni wrote: > The Syzbot reported a possible deadlock in the netfilter area caused by > rtnl lock, xt lock and socket lock being acquired with a different order > on different code paths, leading to the following backtrace: > > ===

[PATCH net] netfilter: on setsockopt() acquire sock lock only in the required scope

2018-02-08 Thread Paolo Abeni
The Syzbot reported a possible deadlock in the netfilter area caused by rtnl lock, xt lock and socket lock being acquired with a different order on different code paths, leading to the following backtrace: == WARNING: possible circular locking de

Re: [Patch net] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

2018-02-08 Thread Florian Westphal
Cong Wang wrote: > In clusterip_config_find_get() we hold RCU read lock so it could > run concurrently with clusterip_config_entry_put(), as a result, > the refcnt could go back to 1 from 0, which leads to a double > list_del()... Just replace refcount_inc() with > refcount_inc_not_zero(), as for