Merge tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for net. Still
large batch for this late -rc cycle but at least half of these fixes
in this batch have been cooking for several weeks before:

1) Fix race between ipset list:set GC and swap, use write_lock instead
   of rcu read lock section when accessing the index to ensure
   interference with ip_set_swap(), from Xiang Mei.

2) Release template conntrack in bridge conntrack when packet is
   neither IPv4 nor IPv6 before setting skb as untracked.
   From Zhiling Zou.

3) A series of 3 patches for IPVS to address sashiko reports:
   Schedulers read destination overload state while connection
   accounting and destination configuration can update it concurrently.
   The first patch adds a single total connection counter. The second
   patch uses it to identify threshold crossings precisely, and updates
   OVERLOAD at the crossings and on a threshold edit under dst_lock.
   The third patch moves configuration-controlled AVAILABLE to a
   separate cflags word, so it cannot clobber OVERLOAD through an
   unrelated read-modify-write update.

4) Log invalid packets in TCP and SCTP connection tracking to address
   a deadlock when nfnetlink_log is used as logging backend and the
   nfnetlink_log conntrack glue support is used. From Zihan Xi.

5) Wait for rcu grace period before releasing pernet state in
   nfnetlink_log, otherwise packets can end up access already released
   memory, triggering UaF. From Florian Westphal.

6) IPVS needs to reset IP information in control buffer in skbuff when
   encapsulating IP packets in ICMP, from Kyle Zeng.

7) IPVS needs to validate ihl field of inner headers in when handling
   ICMP response, from Julian Anastasov.

8) Remove a WARN_ON_ONCE reachable from the nf_tables hardware offload
   when triggering ENOMEM on GFP_KERNEL allocation,
   from Alexey Velichayshiy.

9) Publish reply tuple into the flowtable hashtable first, otherwise
   GC might walk over a released tuple when insertion of the original
   tuple fail. From Jeremy Jean.

10) Elide counter increment when replacing an ipset element,
    from Florian Westphal.

11) Remove unneeded ipset accounting resets on destruction/flush,
    from Florian Westphal.

* tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: ipset: let destroy callbacks adjust ext mem size
  netfilter: ipset: fix list type element drift bug
  netfilter: flowtable: publish GC-visible tuple last
  netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
  ipvs: revalidate ihl to prevent out-of-bounds access
  ipvs: clear IPv4 options after rebasing tunnel ICMP errors
  netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
  netfilter: nf_conntrack: defer invalid log until after unlock
  ipvs: separate destination availability state
  ipvs: properly update the overload flag on dest edit
  ipvs: add totalconns for dest
  netfilter: bridge: release template ct on non-IP path
  netfilter: ipset: fix refcount race between list:set GC and swap
====================

Link: https://patch.msgid.link/20260810190621.894119-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2 files changed, 23 insertions, 12 deletions

diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index d2813eb795be..be3a6617adf4 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -36,6 +36,12 @@
 #define IP_VS_HDR_INVERSE	1
 #define IP_VS_HDR_ICMP		2
 
+/* Destination Server Flags */
+#define IP_VS_DEST_F_OVERLOAD	0x0002		/* server is overloaded */
+
+/* Destination Server Config Flags */
+#define IP_VS_DEST_CF_AVAILABLE	0x0001		/* server is available */
+
 /* conn_tab limits (as per Kconfig) */
 #define IP_VS_CONN_TAB_MIN_BITS	8
 #if BITS_PER_LONG > 32
@@ -976,6 +982,7 @@ struct ip_vs_dest {
 	volatile unsigned int	flags;		/* dest status flags */
 	atomic_t		conn_flags;	/* flags to copy to conn */
 	atomic_t		weight;		/* server weight */
+	unsigned long		cflags;		/* config flags */
 	atomic_t		last_weight;	/* server latest weight */
 	__u16			tun_type;	/* tunnel type */
 	__be16			tun_port;	/* tunnel port */
@@ -987,10 +994,11 @@ struct ip_vs_dest {
 
 	/* connection counters and thresholds */
 	atomic_t		activeconns;	/* active connections */
-	atomic_t		inactconns;	/* inactive connections */
+	atomic_t		totalconns;	/* total connections */
 	atomic_t		persistconns;	/* persistent connections */
 	__u32			u_threshold;	/* upper threshold */
 	__u32			l_threshold;	/* lower threshold */
+	__u32			l_threshold_val;/* used lower threshold */
 
 	/* for destination cache */
 	spinlock_t		dst_lock;	/* lock of dst_cache */
@@ -1907,6 +1915,8 @@ static inline void ip_vs_dest_put_and_free(struct ip_vs_dest *dest)
 		kfree(dest);
 }
 
+void ip_vs_dest_update_overload(struct ip_vs_dest *dest, int mode);
+
 /* IPVS sync daemon data and function prototypes
  * (from ip_vs_sync.c)
  */
@@ -2058,7 +2068,7 @@ static inline bool ip_vs_conn_use_hash2(struct ip_vs_conn *cp)
 	       !(cp->flags & IP_VS_CONN_F_TEMPLATE);
 }
 
-void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
+bool ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
 		    struct ip_vs_conn *cp, int dir, unsigned int toff,
 		    bool has_ports, struct ip_vs_iphdr *ciph);
 
@@ -2220,14 +2230,21 @@ void ip_vs_unregister_hooks(struct netns_ipvs *ipvs, unsigned int af);
 static inline int
 ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
 {
-	/* We think the overhead of processing active connections is 256
+	/* We think the overhead of processing active connections is 257
 	 * times higher than that of inactive connections in average. (This
-	 * 256 times might not be accurate, we will change it later) We
+	 * 257 times might not be accurate, we will change it later) We
 	 * use the following formula to estimate the overhead now:
-	 *		  dest->activeconns*256 + dest->inactconns
+	 *		  dest->activeconns*256 + dest->totalconns
 	 */
 	return (atomic_read(&dest->activeconns) << 8) +
-		atomic_read(&dest->inactconns);
+		atomic_read(&dest->totalconns);
+}
+
+static inline int
+ip_vs_dest_inactconns(const struct ip_vs_dest *dest)
+{
+	return max(atomic_read(&dest->totalconns) -
+		   atomic_read(&dest->activeconns), 0);
 }
 
 #ifdef CONFIG_IP_VS_PROTO_TCP
diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h
index 1ed234e7f251..2c37c6ac7525 100644
--- a/include/uapi/linux/ip_vs.h
+++ b/include/uapi/linux/ip_vs.h
@@ -29,12 +29,6 @@
 #define IP_VS_SVC_F_SCHED_SH_PORT	IP_VS_SVC_F_SCHED2 /* SH use port */
 
 /*
- *      Destination Server Flags
- */
-#define IP_VS_DEST_F_AVAILABLE	0x0001		/* server is available */
-#define IP_VS_DEST_F_OVERLOAD	0x0002		/* server is overloaded */
-
-/*
  *      IPVS sync daemon states
  */
 #define IP_VS_STATE_NONE	0x0000		/* daemon is stopped */