Florian Westphal 3bd229976f netfilter: arptables: use percpu jumpstack ...

commit 482cfc3185 ("netfilter: xtables: avoid percpu ruleset duplication")

Unlike ip and ip6tables, arp tables were never converted to use the percpu
jump stack.

It still uses the rule blob to store return address, which isn't safe
anymore since we now share this blob among all processors.

Because there is no TEE support for arptables, we don't need to cope
with reentrancy, so we can use loocal variable to hold stack offset.

Fixes: 482cfc3185 ("netfilter: xtables: avoid percpu ruleset duplication")
Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

2015-07-02 17:58:59 +02:00

..

arp_tables.c

netfilter: arptables: use percpu jumpstack

2015-07-02 17:58:59 +02:00

arpt_mangle.c

…

arptable_filter.c

netfilter: Pass nf_hook_state through arpt_do_table().

2015-04-04 13:26:52 -04:00

ip_tables.c

netfilter: x_tables: remove XT_TABLE_INFO_SZ and a dereference.

2015-06-15 20:19:20 +02:00

ipt_ah.c

…

ipt_CLUSTERIP.c

netfilter: x_tables: add context to know if extension runs from nft_compat

2015-05-15 20:14:07 +02:00

ipt_ECN.c

…

ipt_MASQUERADE.c

…

ipt_REJECT.c

…

ipt_rpfilter.c

net: ipv4 sysctl option to ignore routes when nexthop link is down

2015-06-24 02:15:54 -07:00

ipt_SYNPROXY.c

netfilter: synproxy: fix sparse errors

2015-05-17 13:08:29 -04:00

iptable_filter.c

netfilter: Pass nf_hook_state through ipt_do_table().

2015-04-04 12:47:04 -04:00

iptable_mangle.c

netfilter: Pass nf_hook_state through ipt_do_table().

2015-04-04 12:47:04 -04:00

iptable_nat.c

netfilter: Pass nf_hook_state through ipt_do_table().

2015-04-04 12:47:04 -04:00

iptable_raw.c

netfilter: Pass nf_hook_state through ipt_do_table().

2015-04-04 12:47:04 -04:00

iptable_security.c

netfilter: Pass nf_hook_state through ipt_do_table().

2015-04-04 12:47:04 -04:00

Kconfig

netfilter: Kconfig: get rid of parens around depends on

2015-06-15 17:26:37 +02:00

Makefile

…

nf_conntrack_l3proto_ipv4_compat.c

…

nf_conntrack_l3proto_ipv4.c

netfilter: Make nf_hookfn use nf_hook_state.

2015-04-04 12:31:38 -04:00

nf_conntrack_proto_icmp.c

…

nf_defrag_ipv4.c

netfilter: Make nf_hookfn use nf_hook_state.

2015-04-04 12:31:38 -04:00

nf_log_arp.c

netfilter: Use LOGLEVEL_<FOO> defines

2015-03-25 12:09:39 +01:00

nf_log_ipv4.c

netfilter: Use LOGLEVEL_<FOO> defines

2015-03-25 12:09:39 +01:00

nf_nat_h323.c

…

nf_nat_l3proto_ipv4.c

netfilter: Pass nf_hook_state through nf_nat_ipv4_{in,out,fn,local_fn}().

2015-04-04 12:45:19 -04:00

nf_nat_masquerade_ipv4.c

…

nf_nat_pptp.c

…

nf_nat_proto_gre.c

…

nf_nat_proto_icmp.c

…

nf_nat_snmp_basic.c

…

nf_reject_ipv4.c

netfilter: bridge: add helpers for fetching physin/outdev

2015-04-08 16:49:08 +02:00

nf_tables_arp.c

netfilter: Pass nf_hook_state through nft_set_pktinfo*().

2015-04-04 12:54:27 -04:00

nf_tables_ipv4.c

netfilter: Pass nf_hook_state through nft_set_pktinfo*().

2015-04-04 12:54:27 -04:00

nft_chain_nat_ipv4.c

netfilter: Pass nf_hook_state through nft_set_pktinfo*().

2015-04-04 12:54:27 -04:00

nft_chain_route_ipv4.c

netfilter: Pass nf_hook_state through nft_set_pktinfo*().

2015-04-04 12:54:27 -04:00

nft_masq_ipv4.c

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage

2015-04-13 17:17:07 +02:00

nft_redir_ipv4.c

netfilter: nf_tables: switch registers to 32 bit addressing

2015-04-13 17:17:29 +02:00

nft_reject_ipv4.c

netfilter: nf_tables: get rid of NFT_REG_VERDICT usage

2015-04-13 17:17:07 +02:00