Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

9 files changed, 46 insertions, 29 deletions

diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 43d8c9896fa3..f0f688db6213 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -164,8 +164,6 @@ hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb,
         };
         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 
-        if (e.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
                 e.cidr = HOST_MASK;
 
@@ -377,8 +375,6 @@ hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb,
         };
         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 
-        if (e.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
                 e.cidr = HOST_MASK;
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3cb3cb831591..58882de06bd7 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -66,6 +66,21 @@ EXPORT_SYMBOL_GPL(nf_conntrack_locks);
 __cacheline_aligned_in_smp DEFINE_SPINLOCK(nf_conntrack_expect_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_expect_lock);
 
+static __read_mostly spinlock_t nf_conntrack_locks_all_lock;
+static __read_mostly bool nf_conntrack_locks_all;
+
+void nf_conntrack_lock(spinlock_t *lock) __acquires(lock)
+{
+        spin_lock(lock);
+        while (unlikely(nf_conntrack_locks_all)) {
+                spin_unlock(lock);
+                spin_lock(&nf_conntrack_locks_all_lock);
+                spin_unlock(&nf_conntrack_locks_all_lock);
+                spin_lock(lock);
+        }
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_lock);
+
 static void nf_conntrack_double_unlock(unsigned int h1, unsigned int h2)
 {
         h1 %= CONNTRACK_LOCKS;
@@ -82,12 +97,12 @@ static bool nf_conntrack_double_lock(struct net *net, unsigned int h1,
         h1 %= CONNTRACK_LOCKS;
         h2 %= CONNTRACK_LOCKS;
         if (h1 <= h2) {
-                spin_lock(&nf_conntrack_locks[h1]);
+                nf_conntrack_lock(&nf_conntrack_locks[h1]);
                 if (h1 != h2)
                         spin_lock_nested(&nf_conntrack_locks[h2],
                                          SINGLE_DEPTH_NESTING);
         } else {
-                spin_lock(&nf_conntrack_locks[h2]);
+                nf_conntrack_lock(&nf_conntrack_locks[h2]);
                 spin_lock_nested(&nf_conntrack_locks[h1],
                                  SINGLE_DEPTH_NESTING);
         }
@@ -102,16 +117,19 @@ static void nf_conntrack_all_lock(void)
 {
         int i;
 
-        for (i = 0; i < CONNTRACK_LOCKS; i++)
-                spin_lock_nested(&nf_conntrack_locks[i], i);
+        spin_lock(&nf_conntrack_locks_all_lock);
+        nf_conntrack_locks_all = true;
+
+        for (i = 0; i < CONNTRACK_LOCKS; i++) {
+                spin_lock(&nf_conntrack_locks[i]);
+                spin_unlock(&nf_conntrack_locks[i]);
+        }
 }
 
 static void nf_conntrack_all_unlock(void)
 {
-        int i;
-
-        for (i = 0; i < CONNTRACK_LOCKS; i++)
-                spin_unlock(&nf_conntrack_locks[i]);
+        nf_conntrack_locks_all = false;
+        spin_unlock(&nf_conntrack_locks_all_lock);
 }
 
 unsigned int nf_conntrack_htable_size __read_mostly;
@@ -757,7 +775,7 @@ restart:
         hash = hash_bucket(_hash, net);
         for (; i < net->ct.htable_size; i++) {
                 lockp = &nf_conntrack_locks[hash % CONNTRACK_LOCKS];
-                spin_lock(lockp);
+                nf_conntrack_lock(lockp);
                 if (read_seqcount_retry(&net->ct.generation, sequence)) {
                         spin_unlock(lockp);
                         goto restart;
@@ -1382,7 +1400,7 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
         for (; *bucket < net->ct.htable_size; (*bucket)++) {
                 lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS];
                 local_bh_disable();
-                spin_lock(lockp);
+                nf_conntrack_lock(lockp);
                 if (*bucket < net->ct.htable_size) {
                         hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
                                 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index bd9d31537905..3b40ec575cd5 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -425,7 +425,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
         }
         local_bh_disable();
         for (i = 0; i < net->ct.htable_size; i++) {
-                spin_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
                 if (i < net->ct.htable_size) {
                         hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                                 unhelp(h, me);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dbb1bb3edb45..355e8552fd5b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -840,7 +840,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
                 lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS];
-                spin_lock(lockp);
+                nf_conntrack_lock(lockp);
                 if (cb->args[0] >= net->ct.htable_size) {
                         spin_unlock(lockp);
                         goto out;
diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index b6605e000801..5eefe4a355c6 100644
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -224,12 +224,12 @@ static int __init nf_tables_netdev_init(void)
 
         nft_register_chain_type(&nft_filter_chain_netdev);
         ret = register_pernet_subsys(&nf_tables_netdev_net_ops);
-        if (ret < 0)
+        if (ret < 0) {
                 nft_unregister_chain_type(&nft_filter_chain_netdev);
-
+                return ret;
+        }
         register_netdevice_notifier(&nf_tables_netdev_notifier);
-
-        return ret;
+        return 0;
 }
 
 static void __exit nf_tables_netdev_exit(void)
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 5d010f27ac01..94837d236ab0 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -307,12 +307,12 @@ static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
 
         local_bh_disable();
         for (i = 0; i < net->ct.htable_size; i++) {
-                spin_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
                 if (i < net->ct.htable_size) {
                         hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                                 untimeout(h, timeout);
                 }
-                spin_unlock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
         }
         local_bh_enable();
 }
diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
index 383c17138399..b78c28ba465f 100644
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -46,16 +46,14 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
                 switch (priv->op) {
                 case NFT_BYTEORDER_NTOH:
                         for (i = 0; i < priv->len / 8; i++) {
-                                src64 = get_unaligned_be64(&src[i]);
-                                src64 = be64_to_cpu((__force __be64)src64);
+                                src64 = get_unaligned((u64 *)&src[i]);
                                 put_unaligned_be64(src64, &dst[i]);
                         }
                         break;
                 case NFT_BYTEORDER_HTON:
                         for (i = 0; i < priv->len / 8; i++) {
                                 src64 = get_unaligned_be64(&src[i]);
-                                src64 = (__force u64)cpu_to_be64(src64);
-                                put_unaligned_be64(src64, &dst[i]);
+                                put_unaligned(src64, (u64 *)&dst[i]);
                         }
                         break;
                 }
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a0eb2161e3ef..d4a4619fcebc 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -127,6 +127,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                                NF_CT_LABELS_MAX_SIZE - size);
                 return;
         }
+#endif
         case NFT_CT_BYTES: /* fallthrough */
         case NFT_CT_PKTS: {
                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
@@ -138,7 +139,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                 memcpy(dest, &count, sizeof(count));
                 return;
         }
-#endif
         default:
                 break;
         }
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index b7c43def0dc6..e118397254af 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -228,7 +228,7 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         u8 nexthdr;
-        __be16 frag_off;
+        __be16 frag_off, oldlen, newlen;
         int tcphoff;
         int ret;
 
@@ -244,7 +244,12 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                 return NF_DROP;
         if (ret > 0) {
                 ipv6h = ipv6_hdr(skb);
-                ipv6h->payload_len = htons(ntohs(ipv6h->payload_len) + ret);
+                oldlen = ipv6h->payload_len;
+                newlen = htons(ntohs(oldlen) + ret);
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
+                        skb->csum = csum_add(csum_sub(skb->csum, oldlen),
+                                             newlen);
+                ipv6h->payload_len = newlen;
         }
         return XT_CONTINUE;
 }