tree 9bf17ded649c3bd85691215732447f55d36a3aba
parent 6bf70569554adf26177188779f9c1e0074b5e862
parent f5fc1643a8415b46cd47e1b34de54712ee2885bc
author Oleksandr Tymoshenko <ovt@google.com> 1697071509 +0000
committer Oleksandr Tymoshenko <ovt@google.com> 1697071643 +0000

merge-f5fc1643a841 from branch/tag: cve/CVE-2023-4244-R105 into branch: release-R105-cos-5.15

Changelog:
-------------------------------------------------------------

Florian Westphal (4):
      netfilter: nf_tables: don't skip expired elements during walk
      netfilter: nf_tables: don't fail inserts if duplicate has expired
      netfilter: nf_tables: defer gc run if previous batch is still pending
      netfilter: nf_tables: fix memleak when more than 255 elements expired

Pablo Neira Ayuso (13):
      netfilter: nf_tables: GC transaction API to avoid race with control plane
      netfilter: nf_tables: adapt set backend to use GC transaction API
      netfilter: nft_set_hash: mark set element as dead when deleting from packet path
      netfilter: nf_tables: remove busy mark and gc batch API
      netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
      netfilter: nf_tables: GC transaction race with netns dismantle
      netfilter: nf_tables: GC transaction race with abort path
      netfilter: nf_tables: use correct lock to protect gc_list
      netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
      netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
      netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
      netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
      netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration

BUG=b/300063331
TEST=tryjob, validation and K8s e2e
RELEASE_NOTE=Fixed CVE-2023-4244 in the Linux kernel.

Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Change-Id: I98019b51976d9bd4b5af79c5b1c8a56381181193