Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

This merges (3f509c6 netfilter: nf_nat_sip: fix incorrect handling
of EBUSY for RTCP expectation) to Patrick McHardy's IPv6 NAT changes.

8 files changed, 79 insertions, 28 deletions

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 3c601378d27e..767cc12da0fe 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1171,8 +1171,10 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
                 goto out_err;
         }
         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
-        if (!svc->stats.cpustats)
+        if (!svc->stats.cpustats) {
+                ret = -ENOMEM;
                 goto out_err;
+        }
 
         /* I'm the first user of the service */
         atomic_set(&svc->usecnt, 0);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c9bb994ae9ba..dcb27910ab3c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -255,12 +255,15 @@ static void death_by_event(unsigned long ul_conntrack)
 {
         struct nf_conn *ct = (void *)ul_conntrack;
         struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
+
+        BUG_ON(ecache == NULL);
 
         if (nf_conntrack_event(IPCT_DESTROY, ct) < 0) {
                 /* bad luck, let's retry again */
-                ct->timeout.expires = jiffies +
+                ecache->timeout.expires = jiffies +
                         (random32() % net->ct.sysctl_events_retry_timeout);
-                add_timer(&ct->timeout);
+                add_timer(&ecache->timeout);
                 return;
         }
         /* we've got the event delivered, now it's dying */
@@ -274,6 +277,9 @@ static void death_by_event(unsigned long ul_conntrack)
 void nf_ct_insert_dying_list(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
+
+        BUG_ON(ecache == NULL);
 
         /* add this conntrack to the dying list */
         spin_lock_bh(&nf_conntrack_lock);
@@ -281,10 +287,10 @@ void nf_ct_insert_dying_list(struct nf_conn *ct)
                              &net->ct.dying);
         spin_unlock_bh(&nf_conntrack_lock);
         /* set a new timer to retry event delivery */
-        setup_timer(&ct->timeout, death_by_event, (unsigned long)ct);
-        ct->timeout.expires = jiffies +
+        setup_timer(&ecache->timeout, death_by_event, (unsigned long)ct);
+        ecache->timeout.expires = jiffies +
                 (random32() % net->ct.sysctl_events_retry_timeout);
-        add_timer(&ct->timeout);
+        add_timer(&ecache->timeout);
 }
 EXPORT_SYMBOL_GPL(nf_ct_insert_dying_list);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 966f5133a384..a205bd6ce294 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2813,7 +2813,8 @@ static int __init ctnetlink_init(void)
                 goto err_unreg_subsys;
         }
 
-        if (register_pernet_subsys(&ctnetlink_net_ops)) {
+        ret = register_pernet_subsys(&ctnetlink_net_ops);
+        if (ret < 0) {
                 pr_err("ctnetlink_init: cannot register pernet operations\n");
                 goto err_unreg_exp_subsys;
         }
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index f4db3a7bd285..16303c752213 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -542,7 +542,10 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
                 ret = nf_ct_expect_related(rtcp_exp);
                 if (ret == 0)
                         break;
-                else if (ret != -EBUSY) {
+                else if (ret == -EBUSY) {
+                        nf_ct_unexpect_related(rtp_exp);
+                        continue;
+                } else if (ret < 0) {
                         nf_ct_unexpect_related(rtp_exp);
                         port = 0;
                         break;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 169ab59ed9d4..be194b144297 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -55,6 +55,7 @@ struct nfulnl_instance {
         unsigned int qlen;              /* number of nlmsgs in skb */
         struct sk_buff *skb;            /* pre-allocatd skb */
         struct timer_list timer;
+        struct user_namespace *peer_user_ns;    /* User namespace of the peer process */
         int peer_pid;                   /* PID of the peer process */
 
         /* configurable parameters */
@@ -132,7 +133,7 @@ instance_put(struct nfulnl_instance *inst)
 static void nfulnl_timer(unsigned long data);
 
 static struct nfulnl_instance *
-instance_create(u_int16_t group_num, int pid)
+instance_create(u_int16_t group_num, int pid, struct user_namespace *user_ns)
 {
         struct nfulnl_instance *inst;
         int err;
@@ -162,6 +163,7 @@ instance_create(u_int16_t group_num, int pid)
 
         setup_timer(&inst->timer, nfulnl_timer, (unsigned long)inst);
 
+        inst->peer_user_ns = user_ns;
         inst->peer_pid = pid;
         inst->group_num = group_num;
 
@@ -480,7 +482,7 @@ __build_packet_message(struct nfulnl_instance *inst,
         }
 
         if (indev && skb_mac_header_was_set(skb)) {
-                if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
+                if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
                     nla_put_be16(inst->skb, NFULA_HWLEN,
                                  htons(skb->dev->hard_header_len)) ||
                     nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
@@ -503,8 +505,11 @@ __build_packet_message(struct nfulnl_instance *inst,
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
                         struct file *file = skb->sk->sk_socket->file;
-                        __be32 uid = htonl(file->f_cred->fsuid);
-                        __be32 gid = htonl(file->f_cred->fsgid);
+                        __be32 uid = htonl(from_kuid_munged(inst->peer_user_ns,
+                                                            file->f_cred->fsuid));
+                        __be32 gid = htonl(from_kgid_munged(inst->peer_user_ns,
+                                                            file->f_cred->fsgid));
+                        /* need to unlock here since NLA_PUT may goto */
                         read_unlock_bh(&skb->sk->sk_callback_lock);
                         if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
                             nla_put_be32(inst->skb, NFULA_GID, gid))
@@ -783,7 +788,8 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
                         }
 
                         inst = instance_create(group_num,
-                                               NETLINK_CB(skb).pid);
+                                               NETLINK_CB(skb).pid,
+                                               sk_user_ns(NETLINK_CB(skb).ssk));
                         if (IS_ERR(inst)) {
                                 ret = PTR_ERR(inst);
                                 goto out;
@@ -996,8 +1002,10 @@ static int __init nfnetlink_log_init(void)
 
 #ifdef CONFIG_PROC_FS
         if (!proc_create("nfnetlink_log", 0440,
-                         proc_net_netfilter, &nful_file_ops))
+                         proc_net_netfilter, &nful_file_ops)) {
+                status = -ENOMEM;
                 goto cleanup_logger;
+        }
 #endif
         return status;
 
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index ff5f75fddb15..02a2bf49dcbd 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -363,10 +363,12 @@ static void dump_ipv4_packet(struct sbuff *m,
         /* Max length: 15 "UID=4294967295 " */
         if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
+                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                        const struct cred *cred = skb->sk->sk_socket->file->f_cred;
                         sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
+                                from_kuid_munged(&init_user_ns, cred->fsuid),
+                                from_kgid_munged(&init_user_ns, cred->fsgid));
+                }
                 read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
@@ -719,10 +721,12 @@ static void dump_ipv6_packet(struct sbuff *m,
         /* Max length: 15 "UID=4294967295 " */
         if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
+                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                        const struct cred *cred = skb->sk->sk_socket->file->f_cred;
                         sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
+                                from_kuid_munged(&init_user_ns, cred->fsuid),
+                                from_kgid_munged(&init_user_ns, cred->fsgid));
+                }
                 read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 772d7389b337..ca2e577ed8ac 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -17,6 +17,17 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_owner.h>
 
+static int owner_check(const struct xt_mtchk_param *par)
+{
+        struct xt_owner_match_info *info = par->matchinfo;
+
+        /* For now only allow adding matches from the initial user namespace */
+        if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) &&
+            (current_user_ns() != &init_user_ns))
+                return -EINVAL;
+        return 0;
+}
+
 static bool
 owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
@@ -37,17 +48,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
                 return ((info->match ^ info->invert) &
                        (XT_OWNER_UID | XT_OWNER_GID)) == 0;
 
-        if (info->match & XT_OWNER_UID)
-                if ((filp->f_cred->fsuid >= info->uid_min &&
-                    filp->f_cred->fsuid <= info->uid_max) ^
+        if (info->match & XT_OWNER_UID) {
+                kuid_t uid_min = make_kuid(&init_user_ns, info->uid_min);
+                kuid_t uid_max = make_kuid(&init_user_ns, info->uid_max);
+                if ((uid_gte(filp->f_cred->fsuid, uid_min) &&
+                     uid_lte(filp->f_cred->fsuid, uid_max)) ^
                     !(info->invert & XT_OWNER_UID))
                         return false;
+        }
 
-        if (info->match & XT_OWNER_GID)
-                if ((filp->f_cred->fsgid >= info->gid_min &&
-                    filp->f_cred->fsgid <= info->gid_max) ^
+        if (info->match & XT_OWNER_GID) {
+                kgid_t gid_min = make_kgid(&init_user_ns, info->gid_min);
+                kgid_t gid_max = make_kgid(&init_user_ns, info->gid_max);
+                if ((gid_gte(filp->f_cred->fsgid, gid_min) &&
+                     gid_lte(filp->f_cred->fsgid, gid_max)) ^
                     !(info->invert & XT_OWNER_GID))
                         return false;
+        }
 
         return true;
 }
@@ -56,6 +73,7 @@ static struct xt_match owner_mt_reg __read_mostly = {
         .name       = "owner",
         .revision   = 1,
         .family     = NFPROTO_UNSPEC,
+        .checkentry = owner_check,
         .match      = owner_mt,
         .matchsize  = sizeof(struct xt_owner_match_info),
         .hooks      = (1 << NF_INET_LOCAL_OUT) |
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index ae2ad1eec8d0..4635c9b00459 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -317,6 +317,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         struct recent_table *t;
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *pde;
+        kuid_t uid;
+        kgid_t gid;
 #endif
         unsigned int i;
         int ret = -EINVAL;
@@ -372,6 +374,13 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         for (i = 0; i < ip_list_hash_size; i++)
                 INIT_LIST_HEAD(&t->iphash[i]);
 #ifdef CONFIG_PROC_FS
+        uid = make_kuid(&init_user_ns, ip_list_uid);
+        gid = make_kgid(&init_user_ns, ip_list_gid);
+        if (!uid_valid(uid) || !gid_valid(gid)) {
+                kfree(t);
+                ret = -EINVAL;
+                goto out;
+        }
         pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent,
                   &recent_mt_fops, t);
         if (pde == NULL) {
@@ -379,8 +388,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
                 ret = -ENOMEM;
                 goto out;
         }
-        pde->uid = ip_list_uid;
-        pde->gid = ip_list_gid;
+        pde->uid = uid;
+        pde->gid = gid;
 #endif
         spin_lock_bh(&recent_lock);
         list_add_tail(&t->list, &recent_net->tables);