Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CAHk-=wgsMMuMP9_dWps7f25e6G628Hf7-B3hvSDvjhRXqVQvpg@mail.gmail.com>
 <8f331927-69d4-e4e7-22bc-c2a2a098dc1e@gmail.com> <CAHk-=wiAgNCLq2Lv4qu08P1SRv0D3mXLCqPq-XGJiTbGrP=omg@mail.gmail.com>
In-Reply-To: <CAHk-=wiAgNCLq2Lv4qu08P1SRv0D3mXLCqPq-XGJiTbGrP=omg@mail.gmail.com>
From:   Eric Dumazet <edumazet@google.com>
Date:   Mon, 21 Feb 2022 10:01:52 -0800
Message-ID: <CANn89iJkTmDYb5h+ZwSyYEhEfr=jWmbPaVoLAnKkqW5VE47DXA@mail.gmail.com>
Subject: Re: Linux 5.17-rc5
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     Woody Suwalski <wsuwalski@gmail.com>,
        Pablo Neira Ayuso <pablo@netfilter.org>,
        Florian Westphal <fw@strlen.de>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Netdev <netdev@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Feb 21, 2022 at 9:56 AM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Mon, Feb 21, 2022 at 6:23 AM Woody Suwalski <wsuwalski@gmail.com> wrote:
> >
> > Compile failed like reported by Robert Gadson in
> > https://lkml.org/lkml/2022/2/20/341
> >
> > As a workaround:
> > nf_defrag_ipv6.patch
> > --- a/net/netfilter/xt_socket.c    2022-02-21 07:29:21.938263397 -0500
> > +++ b/net/netfilter/xt_socket.c    2022-02-21 07:40:16.730022272 -0500
> > @@ -17,11 +17,11 @@
> >   #include <net/inet_sock.h>
> >   #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
> >
> > -#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
> > +//#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
> >   #include <linux/netfilter_ipv6/ip6_tables.h>
> ...
>
> Hmm. That may fix the compile failure, but it looks somewhat broken to me.
>
> Other cases of nf_defrag_ipv6_disable() end up being protected by
>
>    #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
>
> at the use-point, not by just assuming it always exists even when
> CONFIG_NF_TABLES_IPV6 is off.
>
> So I think the proper fix is something along the lines of
>
>   --- a/net/netfilter/xt_socket.c
>   +++ b/net/netfilter/xt_socket.c
>   @@ -220,8 +220,10 @@ static void socket_mt_destroy(const struct
> xt_mtdtor_param *par)
>    {
>         if (par->family == NFPROTO_IPV4)
>                 nf_defrag_ipv4_disable(par->net);
>   +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
>         else if (par->family == NFPROTO_IPV6)
>                 nf_defrag_ipv6_disable(par->net);
>   +#endif
>    }
>
> instead. Entirely untested, because that's how I roll, but I suspect
> the netfilter people will know what to do.
>
> Added guilty parties and mailing list to the participants.
>
>                 Linus

I am pretty sure Pablo fixed this one week ago.

https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git/commit/?id=2874b7911132f6975e668f6849c8ac93bc4e1f35