Skip to content

Commit 237ad9f

Browse files
author
Herton R. Krzesinski
committed
Merge: netfilter: backports for 9.2 phase 2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/1899 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161695 Upstream Status: all mainline Signed-off-by: Florian Westphal <fwestpha@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
2 parents 0c207b7 + 2b1400f commit 237ad9f

File tree

13 files changed

+84
-77
lines changed

13 files changed

+84
-77
lines changed

‎include/net/ip_vs.h‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -351,11 +351,11 @@ struct ip_vs_seq {
351351

352352
/* counters per cpu */
353353
struct ip_vs_counters {
354-
__u64 conns; /* connections scheduled */
355-
__u64 inpkts; /* incoming packets */
356-
__u64 outpkts; /* outgoing packets */
357-
__u64 inbytes; /* incoming bytes */
358-
__u64 outbytes; /* outgoing bytes */
354+
u64_stats_t conns; /* connections scheduled */
355+
u64_stats_t inpkts; /* incoming packets */
356+
u64_stats_t outpkts; /* outgoing packets */
357+
u64_stats_t inbytes; /* incoming bytes */
358+
u64_stats_t outbytes; /* outgoing bytes */
359359
};
360360
/* Stats per cpu */
361361
struct ip_vs_cpu_stats {

‎net/netfilter/ipset/ip_set_bitmap_ip.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -308,8 +308,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
308308
return -IPSET_ERR_BITMAP_RANGE;
309309

310310
pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
311-
hosts = 2 << (32 - netmask - 1);
312-
elements = 2 << (netmask - mask_bits - 1);
311+
hosts = 2U << (32 - netmask - 1);
312+
elements = 2UL << (netmask - mask_bits - 1);
313313
}
314314
if (elements > IPSET_BITMAP_MAX_RANGE + 1)
315315
return -IPSET_ERR_BITMAP_RANGE_SIZE;

‎net/netfilter/ipset/ip_set_hash_gen.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -916,7 +916,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
916916
#ifdef IP_SET_HASH_WITH_MULTI
917917
if (h->bucketsize >= AHASH_MAX_TUNED)
918918
goto set_full;
919-
else if (h->bucketsize < multi)
919+
else if (h->bucketsize <= multi)
920920
h->bucketsize += AHASH_INIT_SIZE;
921921
#endif
922922
if (n->size >= AHASH_MAX(h)) {

‎net/netfilter/ipset/ip_set_hash_ip.c‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -151,18 +151,16 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
151151
if (((u64)ip_to - ip + 1) >> (32 - h->netmask) > IPSET_MAX_RANGE)
152152
return -ERANGE;
153153

154-
if (retried) {
154+
if (retried)
155155
ip = ntohl(h->next.ip);
156-
e.ip = htonl(ip);
157-
}
158156
for (; ip <= ip_to;) {
157+
e.ip = htonl(ip);
159158
ret = adtfn(set, &e, &ext, &ext, flags);
160159
if (ret && !ip_set_eexist(ret, flags))
161160
return ret;
162161

163162
ip += hosts;
164-
e.ip = htonl(ip);
165-
if (e.ip == 0)
163+
if (ip == 0)
166164
return 0;
167165

168166
ret = 0;

‎net/netfilter/ipset/ip_set_hash_netportnet.c‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -173,17 +173,26 @@ hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
173173
return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
174174
}
175175

176+
static u32
177+
hash_netportnet4_range_to_cidr(u32 from, u32 to, u8 *cidr)
178+
{
179+
if (from == 0 && to == UINT_MAX) {
180+
*cidr = 0;
181+
return to;
182+
}
183+
return ip_set_range_to_cidr(from, to, cidr);
184+
}
185+
176186
static int
177187
hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
178188
enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
179189
{
180-
const struct hash_netportnet4 *h = set->data;
190+
struct hash_netportnet4 *h = set->data;
181191
ipset_adtfn adtfn = set->variant->adt[adt];
182192
struct hash_netportnet4_elem e = { };
183193
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
184194
u32 ip = 0, ip_to = 0, p = 0, port, port_to;
185-
u32 ip2_from = 0, ip2_to = 0, ip2, ipn;
186-
u64 n = 0, m = 0;
195+
u32 ip2_from = 0, ip2_to = 0, ip2, i = 0;
187196
bool with_ports = false;
188197
int ret;
189198

@@ -285,19 +294,6 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
285294
} else {
286295
ip_set_mask_from_to(ip2_from, ip2_to, e.cidr[1]);
287296
}
288-
ipn = ip;
289-
do {
290-
ipn = ip_set_range_to_cidr(ipn, ip_to, &e.cidr[0]);
291-
n++;
292-
} while (ipn++ < ip_to);
293-
ipn = ip2_from;
294-
do {
295-
ipn = ip_set_range_to_cidr(ipn, ip2_to, &e.cidr[1]);
296-
m++;
297-
} while (ipn++ < ip2_to);
298-
299-
if (n*m*(port_to - port + 1) > IPSET_MAX_RANGE)
300-
return -ERANGE;
301297

302298
if (retried) {
303299
ip = ntohl(h->next.ip[0]);
@@ -310,13 +306,19 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
310306

311307
do {
312308
e.ip[0] = htonl(ip);
313-
ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
309+
ip = hash_netportnet4_range_to_cidr(ip, ip_to, &e.cidr[0]);
314310
for (; p <= port_to; p++) {
315311
e.port = htons(p);
316312
do {
313+
i++;
317314
e.ip[1] = htonl(ip2);
318-
ip2 = ip_set_range_to_cidr(ip2, ip2_to,
319-
&e.cidr[1]);
315+
if (i > IPSET_MAX_RANGE) {
316+
hash_netportnet4_data_next(&h->next,
317+
&e);
318+
return -ERANGE;
319+
}
320+
ip2 = hash_netportnet4_range_to_cidr(ip2,
321+
ip2_to, &e.cidr[1]);
320322
ret = adtfn(set, &e, &ext, &ext, flags);
321323
if (ret && !ip_set_eexist(ret, flags))
322324
return ret;

‎net/netfilter/ipvs/ip_vs_core.c‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -132,21 +132,21 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
132132

133133
s = this_cpu_ptr(dest->stats.cpustats);
134134
u64_stats_update_begin(&s->syncp);
135-
s->cnt.inpkts++;
136-
s->cnt.inbytes += skb->len;
135+
u64_stats_inc(&s->cnt.inpkts);
136+
u64_stats_add(&s->cnt.inbytes, skb->len);
137137
u64_stats_update_end(&s->syncp);
138138

139139
svc = rcu_dereference(dest->svc);
140140
s = this_cpu_ptr(svc->stats.cpustats);
141141
u64_stats_update_begin(&s->syncp);
142-
s->cnt.inpkts++;
143-
s->cnt.inbytes += skb->len;
142+
u64_stats_inc(&s->cnt.inpkts);
143+
u64_stats_add(&s->cnt.inbytes, skb->len);
144144
u64_stats_update_end(&s->syncp);
145145

146146
s = this_cpu_ptr(ipvs->tot_stats.cpustats);
147147
u64_stats_update_begin(&s->syncp);
148-
s->cnt.inpkts++;
149-
s->cnt.inbytes += skb->len;
148+
u64_stats_inc(&s->cnt.inpkts);
149+
u64_stats_add(&s->cnt.inbytes, skb->len);
150150
u64_stats_update_end(&s->syncp);
151151

152152
local_bh_enable();
@@ -168,21 +168,21 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
168168

169169
s = this_cpu_ptr(dest->stats.cpustats);
170170
u64_stats_update_begin(&s->syncp);
171-
s->cnt.outpkts++;
172-
s->cnt.outbytes += skb->len;
171+
u64_stats_inc(&s->cnt.outpkts);
172+
u64_stats_add(&s->cnt.outbytes, skb->len);
173173
u64_stats_update_end(&s->syncp);
174174

175175
svc = rcu_dereference(dest->svc);
176176
s = this_cpu_ptr(svc->stats.cpustats);
177177
u64_stats_update_begin(&s->syncp);
178-
s->cnt.outpkts++;
179-
s->cnt.outbytes += skb->len;
178+
u64_stats_inc(&s->cnt.outpkts);
179+
u64_stats_add(&s->cnt.outbytes, skb->len);
180180
u64_stats_update_end(&s->syncp);
181181

182182
s = this_cpu_ptr(ipvs->tot_stats.cpustats);
183183
u64_stats_update_begin(&s->syncp);
184-
s->cnt.outpkts++;
185-
s->cnt.outbytes += skb->len;
184+
u64_stats_inc(&s->cnt.outpkts);
185+
u64_stats_add(&s->cnt.outbytes, skb->len);
186186
u64_stats_update_end(&s->syncp);
187187

188188
local_bh_enable();
@@ -200,17 +200,17 @@ ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
200200

201201
s = this_cpu_ptr(cp->dest->stats.cpustats);
202202
u64_stats_update_begin(&s->syncp);
203-
s->cnt.conns++;
203+
u64_stats_inc(&s->cnt.conns);
204204
u64_stats_update_end(&s->syncp);
205205

206206
s = this_cpu_ptr(svc->stats.cpustats);
207207
u64_stats_update_begin(&s->syncp);
208-
s->cnt.conns++;
208+
u64_stats_inc(&s->cnt.conns);
209209
u64_stats_update_end(&s->syncp);
210210

211211
s = this_cpu_ptr(ipvs->tot_stats.cpustats);
212212
u64_stats_update_begin(&s->syncp);
213-
s->cnt.conns++;
213+
u64_stats_inc(&s->cnt.conns);
214214
u64_stats_update_end(&s->syncp);
215215

216216
local_bh_enable();

‎net/netfilter/ipvs/ip_vs_ctl.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2293,13 +2293,13 @@ static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
22932293
u64 conns, inpkts, outpkts, inbytes, outbytes;
22942294

22952295
do {
2296-
start = u64_stats_fetch_begin_irq(&u->syncp);
2297-
conns = u->cnt.conns;
2298-
inpkts = u->cnt.inpkts;
2299-
outpkts = u->cnt.outpkts;
2300-
inbytes = u->cnt.inbytes;
2301-
outbytes = u->cnt.outbytes;
2302-
} while (u64_stats_fetch_retry_irq(&u->syncp, start));
2296+
start = u64_stats_fetch_begin(&u->syncp);
2297+
conns = u64_stats_read(&u->cnt.conns);
2298+
inpkts = u64_stats_read(&u->cnt.inpkts);
2299+
outpkts = u64_stats_read(&u->cnt.outpkts);
2300+
inbytes = u64_stats_read(&u->cnt.inbytes);
2301+
outbytes = u64_stats_read(&u->cnt.outbytes);
2302+
} while (u64_stats_fetch_retry(&u->syncp, start));
23032303

23042304
seq_printf(seq, "%3X %8LX %8LX %8LX %16LX %16LX\n",
23052305
i, (u64)conns, (u64)inpkts,

‎net/netfilter/ipvs/ip_vs_est.c‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,11 @@ static void ip_vs_read_cpu_stats(struct ip_vs_kstats *sum,
6767
if (add) {
6868
do {
6969
start = u64_stats_fetch_begin(&s->syncp);
70-
conns = s->cnt.conns;
71-
inpkts = s->cnt.inpkts;
72-
outpkts = s->cnt.outpkts;
73-
inbytes = s->cnt.inbytes;
74-
outbytes = s->cnt.outbytes;
70+
conns = u64_stats_read(&s->cnt.conns);
71+
inpkts = u64_stats_read(&s->cnt.inpkts);
72+
outpkts = u64_stats_read(&s->cnt.outpkts);
73+
inbytes = u64_stats_read(&s->cnt.inbytes);
74+
outbytes = u64_stats_read(&s->cnt.outbytes);
7575
} while (u64_stats_fetch_retry(&s->syncp, start));
7676
sum->conns += conns;
7777
sum->inpkts += inpkts;
@@ -82,11 +82,11 @@ static void ip_vs_read_cpu_stats(struct ip_vs_kstats *sum,
8282
add = true;
8383
do {
8484
start = u64_stats_fetch_begin(&s->syncp);
85-
sum->conns = s->cnt.conns;
86-
sum->inpkts = s->cnt.inpkts;
87-
sum->outpkts = s->cnt.outpkts;
88-
sum->inbytes = s->cnt.inbytes;
89-
sum->outbytes = s->cnt.outbytes;
85+
sum->conns = u64_stats_read(&s->cnt.conns);
86+
sum->inpkts = u64_stats_read(&s->cnt.inpkts);
87+
sum->outpkts = u64_stats_read(&s->cnt.outpkts);
88+
sum->inbytes = u64_stats_read(&s->cnt.inbytes);
89+
sum->outbytes = u64_stats_read(&s->cnt.outbytes);
9090
} while (u64_stats_fetch_retry(&s->syncp, start));
9191
}
9292
}

‎net/netfilter/nf_conntrack_core.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -891,7 +891,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
891891
zone = nf_ct_zone(ct);
892892

893893
if (!nf_ct_ext_valid_pre(ct->ext)) {
894-
NF_CT_STAT_INC(net, insert_failed);
894+
NF_CT_STAT_INC_ATOMIC(net, insert_failed);
895895
return -ETIMEDOUT;
896896
}
897897

@@ -938,7 +938,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
938938

939939
if (!nf_ct_ext_valid_post(ct->ext)) {
940940
nf_ct_kill(ct);
941-
NF_CT_STAT_INC(net, drop);
941+
NF_CT_STAT_INC_ATOMIC(net, drop);
942942
return -ETIMEDOUT;
943943
}
944944

@@ -1275,7 +1275,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
12751275
*/
12761276
if (!nf_ct_ext_valid_post(ct->ext)) {
12771277
nf_ct_kill(ct);
1278-
NF_CT_STAT_INC(net, drop);
1278+
NF_CT_STAT_INC_ATOMIC(net, drop);
12791279
return NF_DROP;
12801280
}
12811281

‎net/netfilter/nf_flow_table_offload.c‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -376,12 +376,12 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule,
376376
const __be32 *addr, const __be32 *mask)
377377
{
378378
struct flow_action_entry *entry;
379-
int i, j;
379+
int i;
380380

381-
for (i = 0, j = 0; i < sizeof(struct in6_addr) / sizeof(u32); i += sizeof(u32), j++) {
381+
for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i++) {
382382
entry = flow_action_entry_next(flow_rule);
383383
flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6,
384-
offset + i, &addr[j], mask);
384+
offset + i * sizeof(u32), &addr[i], mask);
385385
}
386386
}
387387

@@ -987,13 +987,13 @@ static void flow_offload_queue_work(struct flow_offload_work *offload)
987987
struct net *net = read_pnet(&offload->flowtable->net);
988988

989989
if (offload->cmd == FLOW_CLS_REPLACE) {
990-
NF_FLOW_TABLE_STAT_INC(net, count_wq_add);
990+
NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_add);
991991
queue_work(nf_flow_offload_add_wq, &offload->work);
992992
} else if (offload->cmd == FLOW_CLS_DESTROY) {
993-
NF_FLOW_TABLE_STAT_INC(net, count_wq_del);
993+
NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_del);
994994
queue_work(nf_flow_offload_del_wq, &offload->work);
995995
} else {
996-
NF_FLOW_TABLE_STAT_INC(net, count_wq_stats);
996+
NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_stats);
997997
queue_work(nf_flow_offload_stats_wq, &offload->work);
998998
}
999999
}
@@ -1089,6 +1089,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,
10891089
struct flow_block_cb *block_cb, *next;
10901090
int err = 0;
10911091

1092+
down_write(&flowtable->flow_block_lock);
10921093
switch (cmd) {
10931094
case FLOW_BLOCK_BIND:
10941095
list_splice(&bo->cb_list, &flowtable->flow_block.cb_list);
@@ -1103,6 +1104,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,
11031104
WARN_ON_ONCE(1);
11041105
err = -EOPNOTSUPP;
11051106
}
1107+
up_write(&flowtable->flow_block_lock);
11061108

11071109
return err;
11081110
}
@@ -1159,7 +1161,9 @@ static int nf_flow_table_offload_cmd(struct flow_block_offload *bo,
11591161

11601162
nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable,
11611163
extack);
1164+
down_write(&flowtable->flow_block_lock);
11621165
err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo);
1166+
up_write(&flowtable->flow_block_lock);
11631167
if (err < 0)
11641168
return err;
11651169

0 commit comments

Comments
 (0)