Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
netfilter fixes for net

The following patchset contains Netfilter fixes for your net tree:

1) memleak in ebtables from the error path for the 32/64 compat layer,
   from Florian Westphal.

2) Fix inverted meta ifname/ifidx matching when no interface is set
   on either from the input/output path, from Phil Sutter.

3) Remove goto label in nft_meta_bridge, also from Phil.

4) Missing include guard in xt_connlabel, from Masahiro Yamada.

5) Two patch to fix ipset destination MAC matching coming from
   Stephano Brivio, via Jozsef Kadlecsik.

6) Fix set rename and listing concurrency problem, from Shijie Luo.
   Patch also coming via Jozsef Kadlecsik.

7) ebtables 32/64 compat missing base chain policy in rule count,
   from Florian Westphal.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 35 insertions, 39 deletions

diff --git a/include/uapi/linux/netfilter/xt_connlabel.h b/include/uapi/linux/netfilter/xt_connlabel.h
index 2312f0ec07b2..323f0dfc2a4e 100644
--- a/include/uapi/linux/netfilter/xt_connlabel.h
+++ b/include/uapi/linux/netfilter/xt_connlabel.h
@@ -1,4 +1,8 @@
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+
+#ifndef _UAPI_XT_CONNLABEL_H
+#define _UAPI_XT_CONNLABEL_H
+
 #include <linux/types.h>
 
 #define XT_CONNLABEL_MAXBIT 127
@@ -11,3 +15,5 @@ struct xt_connlabel_mtinfo {
         __u16 bit;
         __u16 options;
 };
+
+#endif /* _UAPI_XT_CONNLABEL_H */
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 963dfdc14827..c8177a89f52c 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1770,20 +1770,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
         return 0;
 }
 
+static int ebt_compat_init_offsets(unsigned int number)
+{
+        if (number > INT_MAX)
+                return -EINVAL;
+
+        /* also count the base chain policies */
+        number += NF_BR_NUMHOOKS;
+
+        return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
+}
 
 static int compat_table_info(const struct ebt_table_info *info,
                              struct compat_ebt_replace *newinfo)
 {
         unsigned int size = info->entries_size;
         const void *entries = info->entries;
+        int ret;
 
         newinfo->entries_size = size;
-        if (info->nentries) {
-                int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
-                                                 info->nentries);
-                if (ret)
-                        return ret;
-        }
+        ret = ebt_compat_init_offsets(info->nentries);
+        if (ret)
+                return ret;
 
         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
                                                         entries, newinfo);
@@ -2234,11 +2242,9 @@ static int compat_do_replace(struct net *net, void __user *user,
 
         xt_compat_lock(NFPROTO_BRIDGE);
 
-        if (tmp.nentries) {
-                ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
-                if (ret < 0)
-                        goto out_unlock;
-        }
+        ret = ebt_compat_init_offsets(tmp.nentries);
+        if (ret < 0)
+                goto out_unlock;
 
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
         if (ret < 0)
@@ -2261,8 +2267,10 @@ static int compat_do_replace(struct net *net, void __user *user,
         state.buf_kern_len = size64;
 
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
-        if (WARN_ON(ret < 0))
+        if (WARN_ON(ret < 0)) {
+                vfree(entries_tmp);
                 goto out_unlock;
+        }
 
         vfree(entries_tmp);
         tmp.entries_size = size64;
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index bed66f536b34..1804e867f715 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -30,13 +30,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
         switch (priv->key) {
         case NFT_META_BRI_IIFNAME:
                 br_dev = nft_meta_get_bridge(in);
-                if (!br_dev)
-                        goto err;
                 break;
         case NFT_META_BRI_OIFNAME:
                 br_dev = nft_meta_get_bridge(out);
-                if (!br_dev)
-                        goto err;
                 break;
         case NFT_META_BRI_IIFPVID: {
                 u16 p_pvid;
@@ -61,13 +57,11 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
                 return;
         }
         default:
-                goto out;
+                return nft_meta_get_eval(expr, regs, pkt);
         }
 
-        strncpy((char *)dest, br_dev->name, IFNAMSIZ);
+        strncpy((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);
         return;
-out:
-        return nft_meta_get_eval(expr, regs, pkt);
 err:
         regs->verdict.code = NFT_BREAK;
 }
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index ca7ac4a25ada..1d4e63326e68 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -226,7 +226,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 
         e.id = ip_to_id(map, ip);
 
-        if (opt->flags & IPSET_DIM_ONE_SRC)
+        if (opt->flags & IPSET_DIM_TWO_SRC)
                 ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
         else
                 ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 2e151856ad99..e64d5f9a89dd 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1161,7 +1161,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
                 return -ENOENT;
 
         write_lock_bh(&ip_set_ref_lock);
-        if (set->ref != 0) {
+        if (set->ref != 0 || set->ref_netlink != 0) {
                 ret = -IPSET_ERR_REFERENCED;
                 goto out;
         }
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index faf59b6a998f..24d8f4df4230 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -89,15 +89,11 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
         struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 
-         /* MAC can be src only */
-        if (!(opt->flags & IPSET_DIM_TWO_SRC))
-                return 0;
-
         if (skb_mac_header(skb) < skb->head ||
             (skb_mac_header(skb) + ETH_HLEN) > skb->data)
                 return -EINVAL;
 
-        if (opt->flags & IPSET_DIM_ONE_SRC)
+        if (opt->flags & IPSET_DIM_TWO_SRC)
                 ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
         else
                 ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index f1b1d948c07b..f69afb9ff3cb 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -60,24 +60,16 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                 *dest = skb->mark;
                 break;
         case NFT_META_IIF:
-                if (in == NULL)
-                        goto err;
-                *dest = in->ifindex;
+                *dest = in ? in->ifindex : 0;
                 break;
         case NFT_META_OIF:
-                if (out == NULL)
-                        goto err;
-                *dest = out->ifindex;
+                *dest = out ? out->ifindex : 0;
                 break;
         case NFT_META_IIFNAME:
-                if (in == NULL)
-                        goto err;
-                strncpy((char *)dest, in->name, IFNAMSIZ);
+                strncpy((char *)dest, in ? in->name : "", IFNAMSIZ);
                 break;
         case NFT_META_OIFNAME:
-                if (out == NULL)
-                        goto err;
-                strncpy((char *)dest, out->name, IFNAMSIZ);
+                strncpy((char *)dest, out ? out->name : "", IFNAMSIZ);
                 break;
         case NFT_META_IIFTYPE:
                 if (in == NULL)