Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for your net tree:

1) Null pointer dereference when dumping conntrack helper configuration,
   from Taehee Yoo.

2) Missing sanitization in ebtables extension name through compat,
   from Paolo Abeni.

3) Broken fetch of tracing value, from Taehee Yoo.

4) Incorrect arithmetics in packet ratelimiting.

5) Buffer overflow in IPVS sync daemon, from Julian Anastasov.

6) Wrong argument to nla_strlcpy() in nfnetlink_{acct,cthelper},
   from Eric Dumazet.

7) Fix splat in nft_update_chain_stats().

8) Null pointer dereference from object netlink dump path, from
   Taehee Yoo.

9) Missing static_branch_inc() when enabling counters in existing
   chain, from Taehee Yoo.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

9 files changed, 71 insertions, 43 deletions

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28a4c3490359..6ba639f6c51d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1954,7 +1954,8 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
         int off, pad = 0;
         unsigned int size_kern, match_size = mwt->match_size;
 
-        strlcpy(name, mwt->u.name, sizeof(name));
+        if (strscpy(name, mwt->u.name, sizeof(name)) < 0)
+                return -EINVAL;
 
         if (state->buf_kern_start)
                 dst = state->buf_kern_start + state->buf_kern_offset;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index f36098887ad0..3ecca0616d8c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2381,8 +2381,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                         struct ipvs_sync_daemon_cfg cfg;
 
                         memset(&cfg, 0, sizeof(cfg));
-                        strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
-                                sizeof(cfg.mcast_ifn));
+                        ret = -EINVAL;
+                        if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
+                                    sizeof(cfg.mcast_ifn)) <= 0)
+                                goto out_dec;
                         cfg.syncid = dm->syncid;
                         ret = start_sync_thread(ipvs, &cfg, dm->state);
                 } else {
@@ -2420,12 +2422,19 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 }
         }
 
+        if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) &&
+            strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) ==
+            IP_VS_SCHEDNAME_MAXLEN) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
+
         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
             usvc.protocol != IPPROTO_SCTP) {
-                pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
+                pr_err("set_ctl: invalid protocol: %d %pI4:%d\n",
                        usvc.protocol, &usvc.addr.ip,
-                       ntohs(usvc.port), usvc.sched_name);
+                       ntohs(usvc.port));
                 ret = -EFAULT;
                 goto out_unlock;
         }
@@ -2847,7 +2856,7 @@ static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
-                                            .len = IP_VS_IFNAME_MAXLEN },
+                                            .len = IP_VS_IFNAME_MAXLEN - 1 },
         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
         [IPVS_DAEMON_ATTR_SYNC_MAXLEN]  = { .type = NLA_U16 },
         [IPVS_DAEMON_ATTR_MCAST_GROUP]  = { .type = NLA_U32 },
@@ -2865,7 +2874,7 @@ static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
-                                            .len = IP_VS_SCHEDNAME_MAXLEN },
+                                            .len = IP_VS_SCHEDNAME_MAXLEN - 1 },
         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
                                             .len = IP_VS_PENAME_MAXLEN },
         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 91e80aa852d6..501e48a7965b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1298,8 +1298,10 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
                 rcu_assign_pointer(chain->stats, newstats);
                 synchronize_rcu();
                 free_percpu(oldstats);
-        } else
+        } else {
                 rcu_assign_pointer(chain->stats, newstats);
+                static_branch_inc(&nft_counters_enabled);
+        }
 }
 
 static void nf_tables_chain_destroy(struct nft_ctx *ctx)
@@ -4706,7 +4708,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
                         if (idx > s_idx)
                                 memset(&cb->args[1], 0,
                                        sizeof(cb->args) - sizeof(cb->args[0]));
-                        if (filter && filter->table[0] &&
+                        if (filter && filter->table &&
                             strcmp(filter->table, table->name))
                                 goto cont;
                         if (filter &&
@@ -5380,7 +5382,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
                         if (idx > s_idx)
                                 memset(&cb->args[1], 0,
                                        sizeof(cb->args) - sizeof(cb->args[0]));
-                        if (filter && filter->table[0] &&
+                        if (filter && filter->table &&
                             strcmp(filter->table, table->name))
                                 goto cont;
 
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 942702a2776f..40e744572283 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -126,15 +126,15 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
         if (!base_chain->stats)
                 return;
 
+        local_bh_disable();
         stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
         if (stats) {
-                local_bh_disable();
                 u64_stats_update_begin(&stats->syncp);
                 stats->pkts++;
                 stats->bytes += pkt->skb->len;
                 u64_stats_update_end(&stats->syncp);
-                local_bh_enable();
         }
+        local_bh_enable();
 }
 
 struct nft_jumpstack {
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 6ddf89183e7b..a0e5adf0b3b6 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
                 nfacct->flags = flags;
         }
 
-        nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
+        nla_strlcpy(nfacct->name, tb[NFACCT_NAME], NFACCT_NAME_MAX);
 
         if (tb[NFACCT_BYTES]) {
                 atomic64_set(&nfacct->bytes,
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index fa026b269b36..cb5b5f207777 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -150,7 +150,7 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
                 return -EINVAL;
 
         nla_strlcpy(expect_policy->name,
-                    nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
+                    tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
         expect_policy->max_expected =
                 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
         if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
@@ -235,7 +235,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                 goto err1;
 
         nla_strlcpy(helper->name,
-                    nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
+                    tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN);
         size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
         if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
                 ret = -ENOMEM;
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index ea737fd789e8..5c0de704bad5 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -880,22 +880,26 @@ static int nft_ct_helper_obj_dump(struct sk_buff *skb,
                                   struct nft_object *obj, bool reset)
 {
         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
-        const struct nf_conntrack_helper *helper = priv->helper4;
+        const struct nf_conntrack_helper *helper;
         u16 family;
 
+        if (priv->helper4 && priv->helper6) {
+                family = NFPROTO_INET;
+                helper = priv->helper4;
+        } else if (priv->helper6) {
+                family = NFPROTO_IPV6;
+                helper = priv->helper6;
+        } else {
+                family = NFPROTO_IPV4;
+                helper = priv->helper4;
+        }
+
         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
                 return -1;
 
         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
                 return -1;
 
-        if (priv->helper4 && priv->helper6)
-                family = NFPROTO_INET;
-        else if (priv->helper6)
-                family = NFPROTO_IPV6;
-        else
-                family = NFPROTO_IPV4;
-
         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
                 return -1;
 
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index a9fc298ef4c3..72f13a1144dd 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -51,10 +51,13 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
         return !limit->invert;
 }
 
+/* Use same default as in iptables. */
+#define NFT_LIMIT_PKT_BURST_DEFAULT     5
+
 static int nft_limit_init(struct nft_limit *limit,
-                          const struct nlattr * const tb[])
+                          const struct nlattr * const tb[], bool pkts)
 {
-        u64 unit;
+        u64 unit, tokens;
 
         if (tb[NFTA_LIMIT_RATE] == NULL ||
             tb[NFTA_LIMIT_UNIT] == NULL)
@@ -68,18 +71,25 @@ static int nft_limit_init(struct nft_limit *limit,
 
         if (tb[NFTA_LIMIT_BURST])
                 limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
-        else
-                limit->burst = 0;
+
+        if (pkts && limit->burst == 0)
+                limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
 
         if (limit->rate + limit->burst < limit->rate)
                 return -EOVERFLOW;
 
-        /* The token bucket size limits the number of tokens can be
-         * accumulated. tokens_max specifies the bucket size.
-         * tokens_max = unit * (rate + burst) / rate.
-         */
-        limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
-                                limit->rate);
+        if (pkts) {
+                tokens = div_u64(limit->nsecs, limit->rate) * limit->burst;
+        } else {
+                /* The token bucket size limits the number of tokens can be
+                 * accumulated. tokens_max specifies the bucket size.
+                 * tokens_max = unit * (rate + burst) / rate.
+                 */
+                tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
+                                 limit->rate);
+        }
+
+        limit->tokens = tokens;
         limit->tokens_max = limit->tokens;
 
         if (tb[NFTA_LIMIT_FLAGS]) {
@@ -144,7 +154,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
         struct nft_limit_pkts *priv = nft_expr_priv(expr);
         int err;
 
-        err = nft_limit_init(&priv->limit, tb);
+        err = nft_limit_init(&priv->limit, tb, true);
         if (err < 0)
                 return err;
 
@@ -185,7 +195,7 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
 {
         struct nft_limit *priv = nft_expr_priv(expr);
 
-        return nft_limit_init(priv, tb);
+        return nft_limit_init(priv, tb, false);
 }
 
 static int nft_limit_bytes_dump(struct sk_buff *skb,
@@ -246,7 +256,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
         struct nft_limit_pkts *priv = nft_obj_data(obj);
         int err;
 
-        err = nft_limit_init(&priv->limit, tb);
+        err = nft_limit_init(&priv->limit, tb, true);
         if (err < 0)
                 return err;
 
@@ -289,7 +299,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
 {
         struct nft_limit *priv = nft_obj_data(obj);
 
-        return nft_limit_init(priv, tb);
+        return nft_limit_init(priv, tb, false);
 }
 
 static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 8fb91940e2e7..204af9899482 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -234,7 +234,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
         struct sk_buff *skb = pkt->skb;
         u32 *sreg = &regs->data[meta->sreg];
         u32 value = *sreg;
-        u8 pkt_type;
+        u8 value8;
 
         switch (meta->key) {
         case NFT_META_MARK:
@@ -244,15 +244,17 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                 skb->priority = value;
                 break;
         case NFT_META_PKTTYPE:
-                pkt_type = nft_reg_load8(sreg);
+                value8 = nft_reg_load8(sreg);
 
-                if (skb->pkt_type != pkt_type &&
-                    skb_pkt_type_ok(pkt_type) &&
+                if (skb->pkt_type != value8 &&
+                    skb_pkt_type_ok(value8) &&
                     skb_pkt_type_ok(skb->pkt_type))
-                        skb->pkt_type = pkt_type;
+                        skb->pkt_type = value8;
                 break;
         case NFT_META_NFTRACE:
-                skb->nf_trace = !!value;
+                value8 = nft_reg_load8(sreg);
+
+                skb->nf_trace = !!value8;
                 break;
         default:
                 WARN_ON(1);