8 files changed, 76 insertions, 27 deletions

diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 4515056ef1c2..f9b16f2b2219 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -193,21 +193,29 @@ struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *
 
         mutex_lock(&__ip_vs_app_mutex);
 
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc()) {
+                err = -ENOENT;
+                goto out_unlock;
+        }
+
         list_for_each_entry(a, &ipvs->app_list, a_list) {
                 if (!strcmp(app->name, a->name)) {
                         err = -EEXIST;
+                        /* decrease the module use count */
+                        ip_vs_use_count_dec();
                         goto out_unlock;
                 }
         }
         a = kmemdup(app, sizeof(*app), GFP_KERNEL);
         if (!a) {
                 err = -ENOMEM;
+                /* decrease the module use count */
+                ip_vs_use_count_dec();
                 goto out_unlock;
         }
         INIT_LIST_HEAD(&a->incs_list);
         list_add(&a->a_list, &ipvs->app_list);
-        /* increase the module use count */
-        ip_vs_use_count_inc();
 
 out_unlock:
         mutex_unlock(&__ip_vs_app_mutex);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 8b48e7ce1c2c..3cccc88ef817 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -93,7 +93,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net,
 static void update_defense_level(struct netns_ipvs *ipvs)
 {
         struct sysinfo i;
-        static int old_secure_tcp = 0;
         int availmem;
         int nomem;
         int to_change = -1;
@@ -174,35 +173,35 @@ static void update_defense_level(struct netns_ipvs *ipvs)
         spin_lock(&ipvs->securetcp_lock);
         switch (ipvs->sysctl_secure_tcp) {
         case 0:
-                if (old_secure_tcp >= 2)
+                if (ipvs->old_secure_tcp >= 2)
                         to_change = 0;
                 break;
         case 1:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                         ipvs->sysctl_secure_tcp = 2;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                 }
                 break;
         case 2:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                         ipvs->sysctl_secure_tcp = 1;
                 }
                 break;
         case 3:
-                if (old_secure_tcp < 2)
+                if (ipvs->old_secure_tcp < 2)
                         to_change = 1;
                 break;
         }
-        old_secure_tcp = ipvs->sysctl_secure_tcp;
+        ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(ipvs,
                                               ipvs->sysctl_secure_tcp > 1);
@@ -1275,7 +1274,8 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
         struct ip_vs_service *svc = NULL;
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
 
         /* Lookup the scheduler by 'u->sched_name' */
         if (strcmp(u->sched_name, "none")) {
@@ -2435,9 +2435,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
         if (copy_from_user(arg, user, len) != 0)
                 return -EFAULT;
 
-        /* increase the module use count */
-        ip_vs_use_count_inc();
-
         /* Handle daemons since they have another lock */
         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
             cmd == IP_VS_SO_SET_STOPDAEMON) {
@@ -2450,13 +2447,13 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                         ret = -EINVAL;
                         if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
                                     sizeof(cfg.mcast_ifn)) <= 0)
-                                goto out_dec;
+                                return ret;
                         cfg.syncid = dm->syncid;
                         ret = start_sync_thread(ipvs, &cfg, dm->state);
                 } else {
                         ret = stop_sync_thread(ipvs, dm->state);
                 }
-                goto out_dec;
+                return ret;
         }
 
         mutex_lock(&__ip_vs_mutex);
@@ -2551,10 +2548,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
   out_unlock:
         mutex_unlock(&__ip_vs_mutex);
-  out_dec:
-        /* decrease the module use count */
-        ip_vs_use_count_dec();
-
         return ret;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_pe.c b/net/netfilter/ipvs/ip_vs_pe.c
index 8e104dff7abc..166c669f0763 100644
--- a/net/netfilter/ipvs/ip_vs_pe.c
+++ b/net/netfilter/ipvs/ip_vs_pe.c
@@ -68,7 +68,8 @@ int register_ip_vs_pe(struct ip_vs_pe *pe)
         struct ip_vs_pe *tmp;
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
 
         mutex_lock(&ip_vs_pe_mutex);
         /* Make sure that the pe with this name doesn't exist
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 2f9d5cd5daee..d4903723be7e 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -179,7 +179,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         }
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
 
         mutex_lock(&ip_vs_sched_mutex);
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index a4a78c4b06de..8dc892a9dc91 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1762,6 +1762,10 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
                   sizeof(struct ip_vs_sync_conn_v0));
 
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
+
         /* Do not hold one mutex and then to block on another */
         for (;;) {
                 rtnl_lock();
@@ -1892,9 +1896,6 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         mutex_unlock(&ipvs->sync_mutex);
         rtnl_unlock();
 
-        /* increase the module use count */
-        ip_vs_use_count_inc();
-
         return 0;
 
 out:
@@ -1924,11 +1925,17 @@ out:
                 }
                 kfree(ti);
         }
+
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
         return result;
 
 out_early:
         mutex_unlock(&ipvs->sync_mutex);
         rtnl_unlock();
+
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
         return result;
 }
 
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 132f5228b431..128245efe84a 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -202,6 +202,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 {
         int err;
 
+        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+
         err = rhashtable_insert_fast(&flow_table->rhashtable,
                                      &flow->tuplehash[0].node,
                                      nf_flow_offload_rhash_params);
@@ -218,7 +220,6 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
                 return err;
         }
 
-        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
         return 0;
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index e546f759b7a7..ad783f4840ef 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -347,7 +347,7 @@ int nft_flow_rule_offload_commit(struct net *net)
 
                         policy = nft_trans_chain_policy(trans);
                         err = nft_flow_offload_chain(trans->ctx.chain, &policy,
-                                                     FLOW_BLOCK_BIND);
+                                                     FLOW_BLOCK_UNBIND);
                         break;
                 case NFT_MSG_NEWRULE:
                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 22a80eb60222..5cb2d8908d2a 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -161,13 +161,21 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct ethhdr, h_source):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                   src, ETH_ALEN, reg);
                 break;
         case offsetof(struct ethhdr, h_dest):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                   dst, ETH_ALEN, reg);
                 break;
+        default:
+                return -EOPNOTSUPP;
         }
 
         return 0;
@@ -181,14 +189,23 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct iphdr, saddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, src,
                                   sizeof(struct in_addr), reg);
                 break;
         case offsetof(struct iphdr, daddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, dst,
                                   sizeof(struct in_addr), reg);
                 break;
         case offsetof(struct iphdr, protocol):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                   sizeof(__u8), reg);
                 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -208,14 +225,23 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct ipv6hdr, saddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, src,
                                   sizeof(struct in6_addr), reg);
                 break;
         case offsetof(struct ipv6hdr, daddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, dst,
                                   sizeof(struct in6_addr), reg);
                 break;
         case offsetof(struct ipv6hdr, nexthdr):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                   sizeof(__u8), reg);
                 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -255,10 +281,16 @@ static int nft_payload_offload_tcp(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct tcphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                   sizeof(__be16), reg);
                 break;
         case offsetof(struct tcphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                   sizeof(__be16), reg);
                 break;
@@ -277,10 +309,16 @@ static int nft_payload_offload_udp(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct udphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                   sizeof(__be16), reg);
                 break;
         case offsetof(struct udphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                   sizeof(__be16), reg);
                 break;