Merge tag 'ipvs-fixes-for-v4.2' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs

Simon Horman says:

====================
IPVS Fixes for v4.2

please consider this fix for v4.2.
For reasons that are not clear to me it is a bumper crop.

It seems to me that they are all relevant to stable.
Please let me know if you need my help to get the fixes into stable.

* ipvs: fix ipv6 route unreach panic

  This problem appears to be present since IPv6 support was added to
  IPVS in v2.6.28.

* ipvs: skb_orphan in case of forwarding

  This appears to resolve a problem resulting from a side effect of
  41063e9dd119 ("ipv4: Early TCP socket demux.") which was included in v3.6.

* ipvs: do not use random local source address for tunnels

  This appears to resolve a problem introduced by
  026ace060dfe ("ipvs: optimize dst usage for real server") in v3.10.

* ipvs: fix crash if scheduler is changed

  This appears to resolve a problem introduced by
  ceec4c381681 ("ipvs: convert services to rcu") in v3.10.

  Julian has provided backports of the fix:
  * [PATCHv2 3.10.81] ipvs: fix crash if scheduler is changed
    http://www.spinics.net/lists/lvs-devel/msg04008.html
  * [PATCHv2 3.12.44,3.14.45,3.18.16,4.0.6] ipvs: fix crash if scheduler is changed
    http://www.spinics.net/lists/lvs-devel/msg04007.html

  Please let me know how you would like to handle guiding these
  backports into stable.

* ipvs: fix crash with sync protocol v0 and FTP

  This appears to resolve a problem introduced by
  749c42b620a9 ("ipvs: reduce sync rate with time thresholds") in v3.5
====================

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

5 files changed, 110 insertions, 39 deletions

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 5d2b806a862e..38fbc194b9cb 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -319,7 +319,13 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  * return *ignored=0 i.e. ICMP and NF_DROP
                  */
                 sched = rcu_dereference(svc->scheduler);
-                dest = sched->schedule(svc, skb, iph);
+                if (sched) {
+                        /* read svc->sched_data after svc->scheduler */
+                        smp_rmb();
+                        dest = sched->schedule(svc, skb, iph);
+                } else {
+                        dest = NULL;
+                }
                 if (!dest) {
                         IP_VS_DBG(1, "p-schedule: no dest found.\n");
                         kfree(param.pe_data);
@@ -467,7 +473,13 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
         }
 
         sched = rcu_dereference(svc->scheduler);
-        dest = sched->schedule(svc, skb, iph);
+        if (sched) {
+                /* read svc->sched_data after svc->scheduler */
+                smp_rmb();
+                dest = sched->schedule(svc, skb, iph);
+        } else {
+                dest = NULL;
+        }
         if (dest == NULL) {
                 IP_VS_DBG(1, "Schedule: no dest found.\n");
                 return NULL;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 285eae3a1454..24c554201a76 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -842,15 +842,16 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         __ip_vs_dst_cache_reset(dest);
         spin_unlock_bh(&dest->dst_lock);
 
-        sched = rcu_dereference_protected(svc->scheduler, 1);
         if (add) {
                 ip_vs_start_estimator(svc->net, &dest->stats);
                 list_add_rcu(&dest->n_list, &svc->destinations);
                 svc->num_dests++;
-                if (sched->add_dest)
+                sched = rcu_dereference_protected(svc->scheduler, 1);
+                if (sched && sched->add_dest)
                         sched->add_dest(svc, dest);
         } else {
-                if (sched->upd_dest)
+                sched = rcu_dereference_protected(svc->scheduler, 1);
+                if (sched && sched->upd_dest)
                         sched->upd_dest(svc, dest);
         }
 }
@@ -1084,7 +1085,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
                 struct ip_vs_scheduler *sched;
 
                 sched = rcu_dereference_protected(svc->scheduler, 1);
-                if (sched->del_dest)
+                if (sched && sched->del_dest)
                         sched->del_dest(svc, dest);
         }
 }
@@ -1175,11 +1176,14 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
         ip_vs_use_count_inc();
 
         /* Lookup the scheduler by 'u->sched_name' */
-        sched = ip_vs_scheduler_get(u->sched_name);
-        if (sched == NULL) {
-                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
-                ret = -ENOENT;
-                goto out_err;
+        if (strcmp(u->sched_name, "none")) {
+                sched = ip_vs_scheduler_get(u->sched_name);
+                if (!sched) {
+                        pr_info("Scheduler module ip_vs_%s not found\n",
+                                u->sched_name);
+                        ret = -ENOENT;
+                        goto out_err;
+                }
         }
 
         if (u->pe_name && *u->pe_name) {
@@ -1240,10 +1244,12 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
         spin_lock_init(&svc->stats.lock);
 
         /* Bind the scheduler */
-        ret = ip_vs_bind_scheduler(svc, sched);
-        if (ret)
-                goto out_err;
-        sched = NULL;
+        if (sched) {
+                ret = ip_vs_bind_scheduler(svc, sched);
+                if (ret)
+                        goto out_err;
+                sched = NULL;
+        }
 
         /* Bind the ct retriever */
         RCU_INIT_POINTER(svc->pe, pe);
@@ -1291,17 +1297,20 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
 static int
 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 {
-        struct ip_vs_scheduler *sched, *old_sched;
+        struct ip_vs_scheduler *sched = NULL, *old_sched;
         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
         int ret = 0;
 
         /*
          * Lookup the scheduler, by 'u->sched_name'
          */
-        sched = ip_vs_scheduler_get(u->sched_name);
-        if (sched == NULL) {
-                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
-                return -ENOENT;
+        if (strcmp(u->sched_name, "none")) {
+                sched = ip_vs_scheduler_get(u->sched_name);
+                if (!sched) {
+                        pr_info("Scheduler module ip_vs_%s not found\n",
+                                u->sched_name);
+                        return -ENOENT;
+                }
         }
         old_sched = sched;
 
@@ -1329,14 +1338,20 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 
         old_sched = rcu_dereference_protected(svc->scheduler, 1);
         if (sched != old_sched) {
+                if (old_sched) {
+                        ip_vs_unbind_scheduler(svc, old_sched);
+                        RCU_INIT_POINTER(svc->scheduler, NULL);
+                        /* Wait all svc->sched_data users */
+                        synchronize_rcu();
+                }
                 /* Bind the new scheduler */
-                ret = ip_vs_bind_scheduler(svc, sched);
-                if (ret) {
-                        old_sched = sched;
-                        goto out;
+                if (sched) {
+                        ret = ip_vs_bind_scheduler(svc, sched);
+                        if (ret) {
+                                ip_vs_scheduler_put(sched);
+                                goto out;
+                        }
                 }
-                /* Unbind the old scheduler on success */
-                ip_vs_unbind_scheduler(svc, old_sched);
         }
 
         /*
@@ -1982,6 +1997,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                 const struct ip_vs_iter *iter = seq->private;
                 const struct ip_vs_dest *dest;
                 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+                char *sched_name = sched ? sched->name : "none";
 
                 if (iter->table == ip_vs_svc_table) {
 #ifdef CONFIG_IP_VS_IPV6
@@ -1990,18 +2006,18 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                                            ip_vs_proto_name(svc->protocol),
                                            &svc->addr.in6,
                                            ntohs(svc->port),
-                                           sched->name);
+                                           sched_name);
                         else
 #endif
                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
                                            ip_vs_proto_name(svc->protocol),
                                            ntohl(svc->addr.ip),
                                            ntohs(svc->port),
-                                           sched->name,
+                                           sched_name,
                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
                 } else {
                         seq_printf(seq, "FWM  %08X %s %s",
-                                   svc->fwmark, sched->name,
+                                   svc->fwmark, sched_name,
                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
                 }
 
@@ -2427,13 +2443,15 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
 {
         struct ip_vs_scheduler *sched;
         struct ip_vs_kstats kstats;
+        char *sched_name;
 
         sched = rcu_dereference_protected(src->scheduler, 1);
+        sched_name = sched ? sched->name : "none";
         dst->protocol = src->protocol;
         dst->addr = src->addr.ip;
         dst->port = src->port;
         dst->fwmark = src->fwmark;
-        strlcpy(dst->sched_name, sched->name, sizeof(dst->sched_name));
+        strlcpy(dst->sched_name, sched_name, sizeof(dst->sched_name));
         dst->flags = src->flags;
         dst->timeout = src->timeout / HZ;
         dst->netmask = src->netmask;
@@ -2892,6 +2910,7 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         struct ip_vs_flags flags = { .flags = svc->flags,
                                      .mask = ~0 };
         struct ip_vs_kstats kstats;
+        char *sched_name;
 
         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
         if (!nl_service)
@@ -2910,8 +2929,9 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         }
 
         sched = rcu_dereference_protected(svc->scheduler, 1);
+        sched_name = sched ? sched->name : "none";
         pe = rcu_dereference_protected(svc->pe, 1);
-        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched->name) ||
+        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
             (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 199760c71f39..7e8141647943 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -74,7 +74,7 @@ void ip_vs_unbind_scheduler(struct ip_vs_service *svc,
 
         if (sched->done_service)
                 sched->done_service(svc);
-        /* svc->scheduler can not be set to NULL */
+        /* svc->scheduler can be set to NULL only by caller */
 }
 
 
@@ -147,21 +147,21 @@ void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler)
 
 void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg)
 {
-        struct ip_vs_scheduler *sched;
+        struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+        char *sched_name = sched ? sched->name : "none";
 
-        sched = rcu_dereference(svc->scheduler);
         if (svc->fwmark) {
                 IP_VS_ERR_RL("%s: FWM %u 0x%08X - %s\n",
-                             sched->name, svc->fwmark, svc->fwmark, msg);
+                             sched_name, svc->fwmark, svc->fwmark, msg);
 #ifdef CONFIG_IP_VS_IPV6
         } else if (svc->af == AF_INET6) {
                 IP_VS_ERR_RL("%s: %s [%pI6c]:%d - %s\n",
-                             sched->name, ip_vs_proto_name(svc->protocol),
+                             sched_name, ip_vs_proto_name(svc->protocol),
                              &svc->addr.in6, ntohs(svc->port), msg);
 #endif
         } else {
                 IP_VS_ERR_RL("%s: %s %pI4:%d - %s\n",
-                             sched->name, ip_vs_proto_name(svc->protocol),
+                             sched_name, ip_vs_proto_name(svc->protocol),
                              &svc->addr.ip, ntohs(svc->port), msg);
         }
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index b08ba9538d12..d99ad93eb855 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
                         pkts = atomic_add_return(1, &cp->in_pkts);
                 else
                         pkts = sysctl_sync_threshold(ipvs);
-                ip_vs_sync_conn(net, cp->control, pkts);
+                ip_vs_sync_conn(net, cp, pkts);
         }
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index bf66a8657a5f..258a0b0e82a2 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -130,7 +130,6 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr,
 
         memset(&fl4, 0, sizeof(fl4));
         fl4.daddr = daddr;
-        fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
         fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
                            FLOWI_FLAG_KNOWN_NH : 0;
 
@@ -505,6 +504,13 @@ err_put:
         return -1;
 
 err_unreach:
+        /* The ip6_link_failure function requires the dev field to be set
+         * in order to get the net (further for the sake of fwmark
+         * reflection).
+         */
+        if (!skb->dev)
+                skb->dev = skb_dst(skb)->dev;
+
         dst_link_failure(skb);
         return -1;
 }
@@ -523,10 +529,27 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb,
         if (ret == NF_ACCEPT) {
                 nf_reset(skb);
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
         }
         return ret;
 }
 
+/* In the event of a remote destination, it's possible that we would have
+ * matches against an old socket (particularly a TIME-WAIT socket). This
+ * causes havoc down the line (ip_local_out et. al. expect regular sockets
+ * and invalid memory accesses will happen) so simply drop the association
+ * in this case.
+*/
+static inline void ip_vs_drop_early_demux_sk(struct sk_buff *skb)
+{
+        /* If dev is set, the packet came from the LOCAL_IN callback and
+         * not from a local TCP socket.
+         */
+        if (skb->dev)
+                skb_orphan(skb);
+}
+
 /* return NF_STOLEN (sent) or NF_ACCEPT if local=1 (not sent) */
 static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
                                          struct ip_vs_conn *cp, int local)
@@ -538,12 +561,23 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
                 ip_vs_notrack(skb);
         else
                 ip_vs_update_conntrack(skb, cp, 1);
+
+        /* Remove the early_demux association unless it's bound for the
+         * exact same port and address on this host after translation.
+         */
+        if (!local || cp->vport != cp->dport ||
+            !ip_vs_addr_equal(cp->af, &cp->vaddr, &cp->daddr))
+                ip_vs_drop_early_demux_sk(skb);
+
         if (!local) {
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
                 NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
                         NULL, skb_dst(skb)->dev, dst_output_sk);
         } else
                 ret = NF_ACCEPT;
+
         return ret;
 }
 
@@ -557,7 +591,10 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,
         if (likely(!(cp->flags & IP_VS_CONN_F_NFCT)))
                 ip_vs_notrack(skb);
         if (!local) {
+                ip_vs_drop_early_demux_sk(skb);
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
                 NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
                         NULL, skb_dst(skb)->dev, dst_output_sk);
         } else
@@ -845,6 +882,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
         struct ipv6hdr *old_ipv6h = NULL;
 #endif
 
+        ip_vs_drop_early_demux_sk(skb);
+
         if (skb_headroom(skb) < max_headroom || skb_cloned(skb)) {
                 new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb)