tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Insufficient validation of element datatype and length in
nft_setelem_parse_data(). At least commit 7d7402642eaf updates
maximum element data area up to 64 bytes when only 16 bytes
where supported at the time. Support for larger element size
came later in fdb9c405e35b though. Picking this older commit
as Fixes: tag to be safe than sorry.

2) Memleak in pipapo destroy path, reproducible when transaction
in aborted. This is already triggering in the existing netfilter
test infrastructure since more recent new tests are covering this
path.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

David S. Miller 280e3a85 3d5a2a39

+41 -16
+8 -1
net/netfilter/nf_tables_api.c
··· 5213 5213 struct nft_data *data, 5214 5214 struct nlattr *attr) 5215 5215 { 5216 + u32 dtype; 5216 5217 int err; 5217 5218 5218 5219 err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr); 5219 5220 if (err < 0) 5220 5221 return err; 5221 5222 5222 - if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) { 5223 + if (set->dtype == NFT_DATA_VERDICT) 5224 + dtype = NFT_DATA_VERDICT; 5225 + else 5226 + dtype = NFT_DATA_VALUE; 5227 + 5228 + if (dtype != desc->type || 5229 + set->dlen != desc->len) { 5223 5230 nft_data_release(data, desc->type); 5224 5231 return -EINVAL; 5225 5232 }
+33 -15
net/netfilter/nft_set_pipapo.c
··· 2125 2125 } 2126 2126 2127 2127 /** 2128 + * nft_set_pipapo_match_destroy() - Destroy elements from key mapping array 2129 + * @set: nftables API set representation 2130 + * @m: matching data pointing to key mapping array 2131 + */ 2132 + static void nft_set_pipapo_match_destroy(const struct nft_set *set, 2133 + struct nft_pipapo_match *m) 2134 + { 2135 + struct nft_pipapo_field *f; 2136 + int i, r; 2137 + 2138 + for (i = 0, f = m->f; i < m->field_count - 1; i++, f++) 2139 + ; 2140 + 2141 + for (r = 0; r < f->rules; r++) { 2142 + struct nft_pipapo_elem *e; 2143 + 2144 + if (r < f->rules - 1 && f->mt[r + 1].e == f->mt[r].e) 2145 + continue; 2146 + 2147 + e = f->mt[r].e; 2148 + 2149 + nft_set_elem_destroy(set, e, true); 2150 + } 2151 + } 2152 + 2153 + /** 2128 2154 * nft_pipapo_destroy() - Free private data for set and all committed elements 2129 2155 * @set: nftables API set representation 2130 2156 */ ··· 2158 2132 { 2159 2133 struct nft_pipapo *priv = nft_set_priv(set); 2160 2134 struct nft_pipapo_match *m; 2161 - struct nft_pipapo_field *f; 2162 - int i, r, cpu; 2135 + int cpu; 2163 2136 2164 2137 m = rcu_dereference_protected(priv->match, true); 2165 2138 if (m) { 2166 2139 rcu_barrier(); 2167 2140 2168 - for (i = 0, f = m->f; i < m->field_count - 1; i++, f++) 2169 - ; 2170 - 2171 - for (r = 0; r < f->rules; r++) { 2172 - struct nft_pipapo_elem *e; 2173 - 2174 - if (r < f->rules - 1 && f->mt[r + 1].e == f->mt[r].e) 2175 - continue; 2176 - 2177 - e = f->mt[r].e; 2178 - 2179 - nft_set_elem_destroy(set, e, true); 2180 - } 2141 + nft_set_pipapo_match_destroy(set, m); 2181 2142 2182 2143 #ifdef NFT_PIPAPO_ALIGN 2183 2144 free_percpu(m->scratch_aligned); ··· 2178 2165 } 2179 2166 2180 2167 if (priv->clone) { 2168 + m = priv->clone; 2169 + 2170 + if (priv->dirty) 2171 + nft_set_pipapo_match_destroy(set, m); 2172 + 2181 2173 #ifdef NFT_PIPAPO_ALIGN 2182 2174 free_percpu(priv->clone->scratch_aligned); 2183 2175 #endif