Florian Westphal 1947e4c334 netfilter: nf_tables: prefer nft_chain_validate ... commit cff3bd012a upstream nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1 [..] with a suitable ruleset during validation of register stores. I can't see any actual reason to attempt to check for this from nft_validate_register_store(), at this point the transaction is still in progress, so we don't have a full picture of the rule graph. For nf-next it might make sense to either remove it or make this depend on table->validate_state in case we could catch an error earlier (for improved error reporting to userspace). Fixes: 20a69341f2 ("netfilter: nf_tables: add netlink set API") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-08-19 05:32:17 +02:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:50:41 +01:00
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-06-16 13:23:44 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2023-01-18 11:30:36 +01:00
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-02-23 08:12:41 +01:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 15:38:01 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 15:38:00 +01:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-04-27 13:39:46 +02:00
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:00:35 +02:00
bluetooth	Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()	2024-08-19 05:32:10 +02:00
bpf	bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()	2022-11-25 17:40:29 +01:00
bpfilter	signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig	2020-01-27 14:50:51 +01:00
bridge	net: bridge: fix corrupted ethernet header on multicast-to-unicast	2024-05-17 11:42:42 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:31:44 +01:00
can	can: bcm: Fix UAF in bcm_proc_show()	2023-08-11 11:45:24 +02:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 11:39:38 +02:00
core	net: linkwatch: use system_unbound_wq	2024-08-19 05:32:10 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:04:10 +01:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 10:29:21 +01:00
decnet	Remove DECnet support from kernel	2023-06-21 15:39:57 +02:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:30:24 +02:00
dsa	net: dsa: Add missing of_node_put() in dsa_port_parse_of	2022-03-23 09:10:44 +01:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-17 11:42:37 +02:00
hsr	hsr: Handle failures in module init	2024-03-26 18:22:42 -04:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-11-03 23:52:30 +09:00
ife	net: sched: ife: fix potential use-after-free	2024-01-08 11:27:34 +01:00
ipv4	ipv4: Fix incorrect source address in Record Route option	2024-08-19 05:32:07 +02:00
ipv6	ipv6: fix ndisc_is_useropt() handling for PIO	2024-08-19 05:32:09 +02:00
iucv	net/iucv: fix use after free in iucv_sock_close()	2024-08-19 05:32:09 +02:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:22:36 -04:00
key	net: af_key: fix sadb_x_filter validation	2023-08-30 16:31:48 +02:00
l2tp	net l2tp: drop flow hash on forward	2024-05-17 11:42:38 +02:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:21:06 +01:00
llc	llc: call sock_orphan() at release time	2024-02-23 08:12:52 +01:00
mac80211	wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()	2024-07-27 10:33:41 +02:00
mac802154	net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()	2024-07-27 10:33:42 +02:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:47:21 +01:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 14:33:33 -08:00
netfilter	netfilter: nf_tables: prefer nft_chain_validate	2024-08-19 05:32:17 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 14:33:32 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:35:22 +00:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-07-05 09:00:27 +02:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-06-16 13:23:36 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:42:38 +02:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-06-16 13:23:36 +02:00
packet	af_packet: Handle outgoing VLAN packets without hardware offloading	2024-08-19 05:32:02 +02:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:42:42 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 17:42:20 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 09:58:00 +02:00
rds	net/rds: fix possible cp null dereference	2024-04-13 12:50:12 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-08 11:27:36 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-08 11:27:34 +01:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-23 08:12:54 +01:00
sched	net/sched: act_skbmod: prevent kernel-infoleak	2024-04-13 12:50:12 +02:00
sctp	sctp: prefer struct_size over open coded arithmetic	2024-07-18 11:39:32 +02:00
smc	net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined	2024-08-19 05:31:57 +02:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	SUNRPC: Fix a race to wake a sync task	2024-08-19 05:32:12 +02:00
switchdev
tipc	tipc: Return non-zero value from tipc_udp_addr2str() on error	2024-08-19 05:32:07 +02:00
tls	net/tls: Fix race in TLS device down flow	2022-07-29 17:10:32 +02:00
unix	af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().	2024-07-05 09:00:21 +02:00
vmw_vsock	vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()	2023-12-20 15:38:01 +01:00
wimax
wireless	wifi: nl80211: don't give key data to userspace	2024-08-19 05:32:11 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:22:37 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-07-05 09:00:23 +02:00
xfrm	net: fix __dst_negative_advice() race	2024-06-16 13:23:45 +02:00
compat.c	net: Return the correct errno code	2021-06-30 08:48:13 -04:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:39:57 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:39:57 +02:00
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-15 18:23:42 +01:00
sysctl_net.c