linux/include/net
Florian Westphal 14fb07130c netfilter: nf_tables: allow loads only when register is initialized
Reject rules where a load occurs from a register that has not seen a store
early in the same rule.

commit 4c905f6740 ("netfilter: nf_tables: initialize registers in
nft_do_chain()")
had to add a unconditional memset to the nftables register space to avoid
leaking stack information to userspace.

This memset shows up in benchmarks.  After this change, this commit can
be reverted again.

Note that this breaks userspace compatibility, because theoretically
you can do

  rule 1: reg2 := meta load iif, reg2  == 1 jump ...
  rule 2: reg2 == 2 jump ...   // read access with no store in this rule

... after this change this is rejected.

Neither nftables nor iptables-nft generate such rules, each rule is
always standalone.

This resuts in a small increase of nft_ctx structure by sizeof(long).

To cope with hypothetical rulesets like the example above one could emit
on-demand "reg[x] = 0" store when generating the datapath blob in
nf_tables_commit_chain_prepare().

A patch that does this is linked to below.

For now, lets disable this.  In nf_tables, a rule is the smallest
unit that can be replaced from userspace, i.e. a hypothetical ruleset
that relies on earlier initialisations of registers can't be changed
at will as register usage would need to be coordinated.

Link: https://lore.kernel.org/netfilter-devel/20240627135330.17039-4-fw@strlen.de/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2024-08-20 12:37:24 +02:00
..
9p netfs, 9p: Implement helpers for new write code 2024-05-01 18:07:37 +01:00
bluetooth Bluetooth: Remove hci_request.{c,h} 2024-07-15 10:11:35 -04:00
caif net: caif: remove unused structs 2024-06-05 10:18:06 +01:00
iucv s390/iucv: Unexport iucv_root 2024-05-14 20:21:04 +02:00
libeth libeth: support different types of buffers for Rx 2024-07-10 10:46:32 -07:00
mana net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings 2024-08-13 13:09:54 +02:00
netfilter netfilter: nf_tables: allow loads only when register is initialized 2024-08-20 12:37:24 +02:00
netns ipsec-next-2024-07-13 2024-07-14 07:56:32 -07:00
nfc nfc: core: make nfc_class constant 2024-03-05 11:21:18 -08:00
page_pool page_pool: use __cacheline_group_{begin, end}_aligned() 2024-07-10 10:28:23 -07:00
phonet net: ioctl: Use kernel memory on protocol ioctl callbacks 2023-06-15 22:33:26 -07:00
sctp sctp: Fix typos and improve comments 2024-07-09 11:31:32 +02:00
tc_act net/sched: Retire ipt action 2024-01-02 12:41:16 +00:00
6lowpan.h
act_api.h net/sched: Add helper macros with module names 2024-02-02 10:57:55 -08:00
addrconf.h ip: Move INFINITY_LIFE_TIME to addrconf.h. 2024-08-15 18:56:14 -07:00
af_ieee802154.h
af_rxrpc.h rxrpc, afs: Allow afs to pin rxrpc_peer objects 2023-12-24 15:22:50 +00:00
af_unix.h af_unix: Remove U_LOCK_GC_LISTENER. 2024-06-25 11:10:18 +02:00
af_vsock.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-08-15 17:18:52 -07:00
ah.h
amt.h
arp.h neighbour: switch to standard rcu, instead of rcu_bh 2023-03-21 21:32:18 -07:00
atmclip.h
ax25.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-05-14 10:53:19 -07:00
ax88796.h
bareudp.h
bond_3ad.h bonding: Add independent control state machine 2024-02-06 13:17:54 +01:00
bond_alb.h
bond_options.h bonding: Add independent control state machine 2024-02-06 13:17:54 +01:00
bonding.h bonding: Add independent control state machine 2024-02-06 13:17:54 +01:00
bpf_sk_storage.h
busy_poll.h net: add napi_busy_loop_rcu() 2024-02-09 10:01:09 -08:00
calipso.h
cfg80211-wext.h wifi: cfg80211: Avoid clashing function prototypes 2022-11-16 11:31:47 +02:00
cfg80211.h wifi: cfg80211: add helper for checking if a chandef is valid on a radio 2024-07-09 11:36:00 +02:00
cfg802154.h mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-03-06 21:01:26 +01:00
checksum.h net: checksum: drop the linux/uaccess.h include 2023-01-27 11:19:46 +00:00
cipso_ipv4.h netlabel: fix RCU annotation for IPv4 options on socket creation 2024-05-13 14:58:12 -07:00
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h codel: fix kernel-doc notation warnings 2023-07-14 20:39:29 -07:00
compat.h
datalink.h net: datalink: Remove unused declarations 2023-07-27 17:17:32 -07:00
dcbevent.h
dcbnl.h net: dcb: add helper functions to retrieve PCP and DSCP rewrite maps 2023-01-20 09:33:22 +00:00
devlink.h devlink: Constify the 'table_ops' parameter of devl_dpipe_table_register() 2024-06-05 10:24:57 +01:00
dropreason-core.h tcp: introduce dropreasons in receive path 2024-02-28 10:39:21 +00:00
dropreason.h net: openvswitch: add last-action drop reason 2023-08-14 08:01:06 +01:00
dsa_stubs.h net: dsa: Use conduit and user terms 2023-10-24 13:08:14 -07:00
dsa.h Merge branch 'net-make-timestamping-selectable' 2024-07-15 08:02:30 -07:00
dscp.h net: add IEEE 802.1q specific helpers 2024-05-08 10:35:09 +01:00
dsfield.h
dst_cache.h net: dst_cache: annotate data-races around dst_cache->reset_ts 2024-05-08 18:49:51 -07:00
dst_metadata.h ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
dst_ops.h net: fix __dst_negative_advice() race 2024-05-29 17:34:49 -07:00
dst.h net: dst: Make dst_destroy() static and return void. 2024-02-06 11:45:53 +01:00
eee.h net: add helpers for EEE configuration 2024-03-05 19:21:17 -08:00
erspan.h
esp.h
espintcp.h inet: preserve const qualifier in inet_csk() 2024-04-01 21:27:08 -07:00
ethoc.h
failover.h
fib_notifier.h
fib_rules.h fib: remove unnecessary input parameters in fib_default_rule_add 2024-01-03 16:42:48 -08:00
firewire.h
flow_dissector.h flow_dissector: cleanup FLOW_DISSECTOR_KEY_ENC_FLAGS 2024-07-15 09:14:39 -07:00
flow_offload.h flow_offload: add encapsulation control flag helpers 2024-06-12 17:56:00 -07:00
flow.h inet: shrink struct flowi_common 2023-11-02 09:31:02 +01:00
fou.h bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs 2023-04-12 16:40:39 -07:00
fq_impl.h wifi: mac80211: add support for restricting netdev features per vif 2022-12-01 15:09:10 +01:00
fq.h net: fq: Remove unused typedef fq_flow_get_default_t 2023-08-08 15:58:23 -07:00
garp.h
gen_stats.h
genetlink.h genetlink: remove linux/genetlink.h 2024-04-01 21:44:34 -07:00
geneve.h
gre.h ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
gro_cells.h
gro.h net: gro: fix napi_gro_cb zeroed alignment 2024-05-14 10:49:50 -07:00
gso.h net: move gso declarations and functions to their own files 2023-06-10 00:11:41 -07:00
gtp.h gtp: properly parse extension headers 2024-05-07 01:35:55 +02:00
gue.h
handshake.h net/handshake: Add helpers for parsing incoming TLS Alerts 2023-07-28 14:07:59 -07:00
hotdata.h net: move sysctl_mem_pcpu_rsv to net_hotdata 2024-04-30 18:46:52 -07:00
hwbm.h
icmp.h
ieee8021q.h net: add IEEE 802.1q specific helpers 2024-05-08 10:35:09 +01:00
ieee80211_radiotap.h wifi: radiotap: document ieee80211_get_radiotap_len() return value 2024-05-23 10:19:39 +02:00
ieee802154_netdev.h mac802154: Handle association requests from peers 2023-11-20 11:43:03 +01:00
if_inet6.h ipv6: anycast: complete RCU handling of struct ifacaddr6 2024-02-26 18:40:34 -08:00
ife.h
inet_common.h net: change proto and proto_ops accept type 2024-05-13 18:19:09 -06:00
inet_connection_sock.h Fix race for duplicate reqsk on identical SYN 2024-06-25 11:37:45 +02:00
inet_dscp.h
inet_ecn.h
inet_frag.h net: Rename mono_delivery_time to tstamp_type for scalabilty 2024-05-23 14:14:23 -07:00
inet_hashtables.h inet: constify 'struct net' parameter of various lookup helpers 2024-08-05 16:22:45 -07:00
inet_sock.h inet: constify inet_sk_bound_dev_eq() net parameter 2024-08-05 16:22:45 -07:00
inet_timewait_sock.h tcp: move inet_twsk_schedule helper out of header 2024-06-10 11:54:18 +01:00
inet6_connection_sock.h
inet6_hashtables.h inet6: constify 'struct net' parameter of various lookup helpers 2024-08-05 16:27:26 -07:00
inetpeer.h
ioam6.h net: ioam6: multicast event 2024-02-28 11:19:41 +00:00
ip_fib.h ipv4: Fix incorrect TOS in route get reply 2024-07-18 11:11:02 +02:00
ip_tunnels.h flow_dissector: cleanup FLOW_DISSECTOR_KEY_ENC_FLAGS 2024-07-15 09:14:39 -07:00
ip_vs.h ipvs: Correct spelling in comments 2023-04-22 01:39:41 +02:00
ip.h net: remove NULL-pointer net parameter in ip_metrics_convert 2024-06-05 10:06:00 +01:00
ip6_checksum.h
ip6_fib.h ipv6: introduce dst_rt6_info() helper 2024-04-29 13:32:01 +01:00
ip6_route.h ipv6: fix source address selection with route leak 2024-07-14 07:34:16 -07:00
ip6_tunnel.h ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
ipcomp.h
ipconfig.h
ipv6_frag.h
ipv6_stubs.h ipv6: udp: constify 'struct net' parameter of socket lookups 2024-08-05 16:27:26 -07:00
ipv6.h ipv6: Add ipv6_addr_{cpu_to_be32,be32_to_cpu} helpers 2024-08-16 10:27:48 -07:00
iw_handler.h wifi: wext: Remove unused declaration dev_get_wireless_info() 2023-08-22 21:40:40 +02:00
kcm.h kcm: Send multiple frags in one sendmsg() 2023-06-12 21:13:23 -07:00
l3mdev.h
lag.h
lapb.h
lib80211.h
llc_c_ac.h net: llc: Remove unused function declarations 2023-08-04 15:33:17 -07:00
llc_c_ev.h net: llc: Remove unused function declarations 2023-08-04 15:33:17 -07:00
llc_c_st.h llc: Constify struct llc_conn_state_trans 2024-07-15 08:51:01 -07:00
llc_conn.h llc: Check netns in llc_estab_match() and llc_listener_match(). 2023-07-20 10:46:28 +02:00
llc_if.h
llc_pdu.h llc: Drop support for ETH_P_TR_802_2. 2024-01-19 21:30:09 -08:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h llc: Constify struct llc_sap_state_trans 2024-07-15 08:51:19 -07:00
llc_sap.h
llc.h
lwtunnel.h lwt: Check LWTUNNEL_XMIT_CONTINUE strictly 2023-08-18 16:05:26 +02:00
mac80211.h wireless-next patches for v6.11 2024-07-11 17:22:04 -07:00
mac802154.h
macsec.h macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads 2024-04-25 08:20:54 -07:00
mctp.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-02-29 14:24:56 -08:00
mctpdevice.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mptcp.h mptcp: add net.mptcp.available_schedulers 2024-05-13 18:29:23 -07:00
mrp.h mrp: introduce active flags to prevent UAF when applicant uninit 2022-11-18 12:14:55 +00:00
ncsi.h
ndisc.h ipv6: eliminate ndisc_ops_is_useropt() 2024-08-12 17:23:57 -07:00
neighbour.h sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
net_debug.h
net_failover.h
net_namespace.h net: Don't register pernet_operations if only one of id or size is specified. 2024-08-03 22:38:44 +01:00
net_ratelimit.h
net_trackers.h
netdev_queues.h net: qstat: extend kdoc about get_base_stats 2024-06-01 15:11:52 -07:00
netdev_rx_queue.h net: Add queue and napi association 2023-12-04 18:04:05 -08:00
netevent.h
netkit.h bpf, netkit: Add indirect call wrapper for fetching peer dev 2023-11-20 10:15:16 -08:00
netlabel.h The usual shower of singleton fixes and minor series all over MM, 2024-05-19 09:21:03 -07:00
netlink.h The usual shower of singleton fixes and minor series all over MM, 2024-05-19 09:21:03 -07:00
netmem.h page_pool: convert to use netmem 2024-07-02 18:59:33 -07:00
netprio_cgroup.h
netrom.h
nexthop.h net: nexthop: Increase weight to u16 2024-08-12 17:50:34 -07:00
nl802154.h ieee802154: Give the user the association list 2023-11-20 11:43:45 +01:00
nsh.h net: NSH: fix kernel-doc notation warning 2023-07-14 20:39:29 -07:00
p8022.h net: 802: Remove unused function declarations 2023-08-04 15:33:50 -07:00
pfcp.h pfcp: always set pfcp metadata 2024-04-01 10:49:28 +01:00
pie.h pie: fix kernel-doc notation warning 2023-07-14 20:39:30 -07:00
ping.h net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294 2023-06-02 09:55:22 +01:00
pkt_cls.h net: sched: make skip_sw actually skip software 2024-03-29 09:46:39 +00:00
pkt_sched.h net/sched: Add helper macros with module names 2024-02-02 10:57:55 -08:00
pptp.h
proto_memory.h net: move sysctl_mem_pcpu_rsv to net_hotdata 2024-04-30 18:46:52 -07:00
protocol.h ipv6: move tcp_ipv6_hash_secret and udp_ipv6_hash_secret to net_hotdata 2024-03-07 21:12:43 -08:00
psample.h net: psample: fix flag being set in wrong skb 2024-07-11 18:11:31 -07:00
psnap.h
raw.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-04-06 12:01:20 -07:00
rawv6.h ipv6: raw: constify raw_v6_match() socket argument 2023-03-17 08:56:37 +00:00
red.h net_sched: sch_choke: implement lockless choke_dump() 2024-04-19 11:34:07 +01:00
regulatory.h wifi: regulatory: remove extra documentation 2024-05-23 10:19:34 +02:00
request_sock.h tcp: move reqsk_alloc() to inet_connection_sock.c 2024-06-06 15:18:04 +02:00
rose.h
route.h inet: introduce dst_rtable() helper 2024-04-30 18:32:38 -07:00
rpl.h ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv(). 2023-06-19 11:32:58 -07:00
rps.h net: rps: add rps_input_queue_head_add() helper 2024-04-01 11:28:32 +01:00
rsi_91x.h rsi: remove kernel-doc comment marker 2023-07-14 20:39:30 -07:00
rstreason.h tcp: rstreason: introduce SK_RST_REASON_TCP_DISCONNECT_WITH_DATA for active reset 2024-08-07 10:24:46 +01:00
rtnetlink.h rtnetlink: make the "split" NLM_DONE handling generic 2024-06-05 12:34:54 +01:00
rtnh.h
sch_generic.h net/sched: fix false lockdep warning on qdisc root lock 2024-04-26 10:46:41 +02:00
scm.h af_unix: Add dead flag to struct scm_fp_list. 2024-05-10 18:52:45 -07:00
secure_seq.h
seg6_hmac.h ipv6: sr: restruct ifdefines 2024-05-30 18:29:38 -07:00
seg6_local.h seg6: Use nested-BH locking for seg6_bpf_srh_states. 2024-06-24 16:41:23 -07:00
seg6.h ipv6: sr: restruct ifdefines 2024-05-30 18:29:38 -07:00
selftests.h
slhc_vj.h
smc.h net/smc: add operations to merge sndbuf with peer DMB 2024-04-30 13:24:48 +02:00
snmp.h
sock_reuseport.h net: core: annotate socks of struct sock_reuseport with __counted_by 2024-08-02 17:16:59 -07:00
sock.h net/ipv4: Use nested-BH locking for ipv4_tcp_sk. 2024-06-24 16:41:22 -07:00
Space.h net: appletalk: remove cops support 2023-10-04 11:49:20 -07:00
stp.h
strparser.h
switchdev.h net: bridge: switchdev: Skip MDB replays of deferred events on offload 2024-02-16 09:36:37 +00:00
tc_wrapper.h Merge branch 'x86/bugs' into x86/core, to pick up pending changes before dependent patches 2024-02-14 10:49:37 +01:00
tcp_ao.h net/tcp: Remove tcp_hash_fail() 2024-06-12 06:39:04 +01:00
tcp_states.h tcp: Dump bound-only sockets in inet_diag. 2023-12-04 14:45:26 -08:00
tcp.h net/tcp: Move tcp_inbound_hash() from headers 2024-06-12 06:39:04 +01:00
tcx.h bpf: Fix too early release of tcx_entry 2024-07-08 14:07:31 -07:00
timewait_sock.h tcp: get rid of twsk_unique() 2024-05-09 20:25:55 -07:00
tipc.h
tls_prot.h net/tls: Add TLS Alert definitions 2023-07-28 14:07:59 -07:00
tls_toe.h
tls.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-04-25 12:41:37 -07:00
transp_v6.h inet6: Remove unused function declaration udpv6_connect() 2023-08-01 15:06:27 -07:00
tso.h net: tso: inline tso_count_descs() 2022-12-12 15:04:39 -08:00
tun_proto.h
udp_tunnel.h ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
udp.h ipv6: udp: constify 'struct net' parameter of socket lookups 2024-08-05 16:27:26 -07:00
udplite.h udplite: fix various data-races 2023-09-14 16:16:36 +02:00
vsock_addr.h
vxlan.h vxlan: add support for flowlabel inherit 2023-11-16 22:33:31 +00:00
wext.h
x25.h x25: preserve const qualifier in [a]x25_sk() 2023-03-18 12:23:34 +00:00
x25device.h
xdp_priv.h
xdp_sock_drv.h xsk: use generic DMA sync shortcut instead of a custom one 2024-05-08 08:51:20 +02:00
xdp_sock.h net: Optimize xdp_do_flush() with bpf_net_context infos. 2024-07-02 15:26:57 +02:00
xdp.h net, xdp: Correct grammar 2023-12-14 16:38:59 +01:00
xfrm.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-07-15 13:19:17 -07:00
xsk_buff_pool.h xsk: use generic DMA sync shortcut instead of a custom one 2024-05-08 08:51:20 +02:00