From: Florian Westphal <fw@strlen.de> mainline inclusion from mainline-v5.16-rc1 commit 9dd43a5f4b11b161c9dfcce9391e843e65d6a4cc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18235 CVE: CVE-2026-74724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- ipvs has multiple one-line wrappers for hooks, compact them. To avoid a large patch make the two most common helpers use the same function signature as hooks. Next patches can then remove the oneline wrappers. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Conflicts: net/netfilter/ipvs/ip_vs_core.c [commit c341179244f9 ("netfilter: ipvs: Fix reuse connection if RS weight is 0") remove conn_reuse_mode] Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- net/netfilter/ipvs/ip_vs_core.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index 3a76da5..09d5f8b 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -1342,12 +1342,15 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, * Check if outgoing packet belongs to the established ip_vs_conn. */ static unsigned int -ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int af) +ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { + struct netns_ipvs *ipvs = net_ipvs(state->net); + unsigned int hooknum = state->hook; struct ip_vs_iphdr iph; struct ip_vs_protocol *pp; struct ip_vs_proto_data *pd; struct ip_vs_conn *cp; + int af = state->pf; struct sock *sk; EnterFunction(11); @@ -1489,7 +1492,7 @@ static unsigned int ip_vs_reply4(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(net_ipvs(state->net), state->hook, skb, AF_INET); + return ip_vs_out_hook(priv, skb, state); } /* @@ -1500,7 +1503,7 @@ static unsigned int ip_vs_local_reply4(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(net_ipvs(state->net), state->hook, skb, AF_INET); + return ip_vs_out_hook(priv, skb, state); } #ifdef CONFIG_IP_VS_IPV6 @@ -1514,7 +1517,7 @@ static unsigned int ip_vs_reply6(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(net_ipvs(state->net), state->hook, skb, AF_INET6); + return ip_vs_out_hook(priv, skb, state); } /* @@ -1525,7 +1528,7 @@ static unsigned int ip_vs_local_reply6(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_out(net_ipvs(state->net), state->hook, skb, AF_INET6); + return ip_vs_out_hook(priv, skb, state); } #endif @@ -1969,14 +1972,17 @@ static int ip_vs_in_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb, * and send it on its way... */ static unsigned int -ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int af) +ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { + struct netns_ipvs *ipvs = net_ipvs(state->net); + unsigned int hooknum = state->hook; struct ip_vs_iphdr iph; struct ip_vs_protocol *pp; struct ip_vs_proto_data *pd; struct ip_vs_conn *cp; int ret, pkts; struct sock *sk; + int af = state->pf; /* Already marked as IPVS request or reply? */ if (skb->ipvs_property) @@ -2157,7 +2163,7 @@ static unsigned int ip_vs_remote_request4(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(net_ipvs(state->net), state->hook, skb, AF_INET); + return ip_vs_in_hook(priv, skb, state); } /* @@ -2168,7 +2174,7 @@ static unsigned int ip_vs_local_request4(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(net_ipvs(state->net), state->hook, skb, AF_INET); + return ip_vs_in_hook(priv, skb, state); } #ifdef CONFIG_IP_VS_IPV6 @@ -2181,7 +2187,7 @@ static unsigned int ip_vs_remote_request6(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(net_ipvs(state->net), state->hook, skb, AF_INET6); + return ip_vs_in_hook(priv, skb, state); } /* @@ -2192,7 +2198,7 @@ static unsigned int ip_vs_local_request6(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - return ip_vs_in(net_ipvs(state->net), state->hook, skb, AF_INET6); + return ip_vs_in_hook(priv, skb, state); } #endif -- 2.9.5