UPSTREAM: netfilter: Fix build errors with xt_socket.c

commit 212dfcc85be8ec98f83a1577143b101d071b7e6b
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Jul 31 20:38:46 2014 +0200

    netfilter: don't use mutex_lock_interruptible()

    Eric Dumazet reports that getsockopt() or setsockopt() sometimes
    returns -EINTR instead of -ENOPROTOOPT, causing headaches to
    application developers.

    This patch replaces all the mutex_lock_interruptible() by mutex_lock()
    in the netfilter tree, as there is no reason we should sleep for a
    long time there.

    Reported-by: Eric Dumazet <edumazet@google.com>
    Suggested-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Acked-by: Julian Anastasov <ja@ssi.bg>
    Signed-off-by: mydongistiny <jaysonedson@gmail.com>

commit aa6a7fefaa8f2c656179493a284b171e1b15e89e
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Fri Jun 19 14:03:39 2015 -0500

    netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook

    Add code to nf_unregister_hook to flush the nf_queue when a hook is
    unregistered.  This guarantees that the pointer that the nf_queue code
    retains into the nf_hook list will remain valid while a packet is
    queued.

    I tested what would happen if we do not flush queued packets and was
    trivially able to obtain the oops below.  All that was required was
    to stop the nf_queue listening process, to delete all of the nf_tables,
    and to awaken the nf_queue listening process.

    > BUG: unable to handle kernel paging request at 0000000100000001
    > IP: [<0000000100000001>] 0x100000001
    > PGD b9c35067 PUD 0
    > Oops: 0010 [#1] SMP
    > Modules linked in:
    > CPU: 0 PID: 519 Comm: lt-nfqnl_test Not tainted
    > task: ffff8800b9c8c050 ti: ffff8800ba9d8000 task.ti: ffff8800ba9d8000
    > RIP: 0010:[<0000000100000001>]  [<0000000100000001>] 0x100000001
    > RSP: 0018:ffff8800ba9dba40  EFLAGS: 00010a16
    > RAX: ffff8800bab48a00 RBX: ffff8800ba9dba90 RCX: ffff8800ba9dba90
    > RDX: ffff8800b9c10128 RSI: ffff8800ba940900 RDI: ffff8800bab48a00
    > RBP: ffff8800b9c10128 R08: ffffffff82976660 R09: ffff8800ba9dbb28
    > R10: dead000000100100 R11: dead000000200200 R12: ffff8800ba940900
    > R13: ffffffff8313fd50 R14: ffff8800b9c95200 R15: 0000000000000000
    > FS:  00007fb91fc34700(0000) GS:ffff8800bfa00000(0000) knlGS:0000000000000000
    > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    > CR2: 0000000100000001 CR3: 00000000babfb000 CR4: 00000000000007f0
    > Stack:
    >  ffffffff8206ab0f ffffffff82982240 ffff8800bab48a00 ffff8800b9c100a8
    >  ffff8800b9c10100 0000000000000001 ffff8800ba940900 ffff8800b9c10128
    >  ffffffff8206bd65 ffff8800bfb0d5e0 ffff8800bab48a00 0000000000014dc0
    > Call Trace:
    >  [<ffffffff8206ab0f>] ? nf_iterate+0x4f/0xa0
    >  [<ffffffff8206bd65>] ? nf_reinject+0x125/0x190
    >  [<ffffffff8206dee5>] ? nfqnl_recv_verdict+0x255/0x360
    >  [<ffffffff81386290>] ? nla_parse+0x80/0xf0
    >  [<ffffffff8206c42c>] ? nfnetlink_rcv_msg+0x13c/0x240
    >  [<ffffffff811b2fec>] ? __memcg_kmem_get_cache+0x4c/0x150
    >  [<ffffffff8206c2f0>] ? nfnl_lock+0x20/0x20
    >  [<ffffffff82068159>] ? netlink_rcv_skb+0xa9/0xc0
    >  [<ffffffff820677bf>] ? netlink_unicast+0x12f/0x1c0
    >  [<ffffffff82067ade>] ? netlink_sendmsg+0x28e/0x650
    >  [<ffffffff81fdd814>] ? sock_sendmsg+0x44/0x50
    >  [<ffffffff81fde07b>] ? ___sys_sendmsg+0x2ab/0x2c0
    >  [<ffffffff810e8f73>] ? __wake_up+0x43/0x70
    >  [<ffffffff8141a134>] ? tty_write+0x1c4/0x2a0
    >  [<ffffffff81fde9f4>] ? __sys_sendmsg+0x44/0x80
    >  [<ffffffff823ff8d7>] ? system_call_fastpath+0x12/0x6a
    > Code:  Bad RIP value.
    > RIP  [<0000000100000001>] 0x100000001
    >  RSP <ffff8800ba9dba40>
    > CR2: 0000000100000001
    > ---[ end trace 08eb65d42362793f ]---

    Cc: stable@vger.kernel.org
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: mydongistiny <jaysonedson@gmail.com>

commit 0106240e1fca27dfc1dd21bc614c522917d832bd
Author: Florian Westphal <fw@strlen.de>
Date:   Thu Mar 10 01:56:23 2016 +0100

    netfilter: x_tables: check for size overflow

    Ben Hawkes says:
     integer overflow in xt_alloc_table_info, which on 32-bit systems can
     lead to small structure allocation and a copy_from_user based heap
     corruption.

    Change-Id: I13c554c630651a37e3f6a195e9a5f40cddcb29a1
    Reported-by: Ben Hawkes <hawkes@google.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: mydongistiny <jaysonedson@gmail.com>

commit 1345d54bb84d8745098660c40d4af8aab449b144
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Fri Jun 12 13:58:52 2015 +0200

    BACKPORT: netfilter: Kconfig: get rid of parens around depends on

    (cherry pick from commit f09becc79f899f92557ce6d5562a8b80d6addb34)

    According to the reporter, they are not needed.

    Reported-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Change-Id: I5f28a81e1361c23cedd57338f30c81730dc8aa3b
    Signed-off-by: mydongistiny <jaysonedson@gmail.com>

commit 59ac6d00f64eef2666cc761432705cc8c63ebc57
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Sep 5 14:38:03 2013 -0400

    UPSTREAM: netfilter: Fix build errors with xt_socket.c

    (cherry pick from commit 1a5bbfc3d6b700178b75743a2ba1fd2e58a8f36f)

    As reported by Randy Dunlap:

    ====================
    when CONFIG_IPV6=m
    and CONFIG_NETFILTER_XT_MATCH_SOCKET=y:

    net/built-in.o: In function `socket_mt6_v1_v2':
    xt_socket.c:(.text+0x51b55): undefined reference to `udp6_lib_lookup'
    net/built-in.o: In function `socket_mt_init':
    xt_socket.c:(.init.text+0x1ef8): undefined reference to `nf_defrag_ipv6_enable'
    ====================

    Like several other modules under net/netfilter/ we have to
    have a dependency "IPV6 disabled or set compatibly with this
    module" clause.

    Reported-by: Randy Dunlap <rdunlap@infradead.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

    Fix symbol export errors for when CONFIG_MODULES is set.
    Signed-off-by: Dmitriy Filchenko <dmitriyf@google.com>
    Change-Id: I9f5a1824a87388da1727f330f97e4982ad7069cd
    Signed-off-by: mydongistiny <jaysonedson@gmail.com>

    Signed-off-by: mydongistiny <jaysonedson@gmail.com>

Signed-off-by: mydongistiny <jaysonedson@gmail.com>

1 files changed, 2 insertions, 8 deletions

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 6651a7797..4257f4b4e 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -327,10 +327,7 @@ find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 		char name[EBT_FUNCTION_MAXNAMELEN];
 	} *e;
 
-	*error = mutex_lock_interruptible(mutex);
-	if (*error != 0)
-		return NULL;
-
+	mutex_lock(mutex);
 	list_for_each_entry(e, head, list) {
 		if (strcmp(e->name, name) == 0)
 			return e;
@@ -1203,10 +1200,7 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
 
 	table->private = newinfo;
 	rwlock_init(&table->lock);
-	ret = mutex_lock_interruptible(&ebt_mutex);
-	if (ret != 0)
-		goto free_chainstack;
-
+	mutex_lock(&ebt_mutex);
 	list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
 		if (strcmp(t->name, table->name) == 0) {
 			ret = -EEXIST;