Commit 2409fa66 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'nf-25-03-13' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for net:

1) Missing initialization of cpu and jiffies32 fields in conncount,
   from Kohei Enju.

2) Skip several tests in case kernel is tainted, otherwise tests bogusly
   report failure too as they also check for tainted kernel,
   from Florian Westphal.

3) Fix a hyphothetical integer overflow in do_ip_vs_get_ctl() leading
   to bogus error logs, from Dan Carpenter.

4) Fix incorrect offset in ipv4 option match in nft_exthdr, from
   Alexey Kashavkin.

netfilter pull request 25-03-13

* tag 'nf-25-03-13' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nft_exthdr: fix offset with ipv4_find_option()
  ipvs: prevent integer overflow in do_ip_vs_get_ctl()
  selftests: netfilter: skip br_netfilter queue tests if kernel is tainted
  netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
====================

Link: https://patch.msgid.link/20250313095636.2186-1-pablo@netfilter.org


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 3e64bb2a 6edd78af

net/netfilter/ipvs/ip_vs_ctl.c

+4 −4
Original line number Diff line number Diff line
@@ -3091,12 +3091,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
	case IP_VS_SO_GET_SERVICES:

	{

		struct ip_vs_get_services *get;

		int size;

		size_t size;



		get = (struct ip_vs_get_services *)arg;

		size = struct_size(get, entrytable, get->num_services);

		if (*len != size) {

			pr_err("length: %u != %u\n", *len, size);

			pr_err("length: %u != %zu\n", *len, size);

			ret = -EINVAL;

			goto out;

		}
@@ -3132,12 +3132,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
	case IP_VS_SO_GET_DESTS:

	{

		struct ip_vs_get_dests *get;

		int size;

		size_t size;



		get = (struct ip_vs_get_dests *)arg;

		size = struct_size(get, entrytable, get->num_dests);

		if (*len != size) {

			pr_err("length: %u != %u\n", *len, size);

			pr_err("length: %u != %zu\n", *len, size);

			ret = -EINVAL;

			goto out;

		}

net/netfilter/nf_conncount.c

+2 −0
Original line number Diff line number Diff line
@@ -377,6 +377,8 @@ insert_tree(struct net *net, 


	conn->tuple = *tuple;

	conn->zone = *zone;

	conn->cpu = raw_smp_processor_id();

	conn->jiffies32 = (u32)jiffies;

	memcpy(rbconn->key, key, sizeof(u32) * data->keylen);



	nf_conncount_list_init(&rbconn->list);

net/netfilter/nft_exthdr.c

+4 −6
Original line number Diff line number Diff line
@@ -85,7 +85,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, 
	unsigned char optbuf[sizeof(struct ip_options) + 40];

	struct ip_options *opt = (struct ip_options *)optbuf;

	struct iphdr *iph, _iph;

	unsigned int start;

	bool found = false;

	__be32 info;

	int optlen;
@@ -93,7 +92,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, 
	iph = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);

	if (!iph)

		return -EBADMSG;

	start = sizeof(struct iphdr);



	optlen = iph->ihl * 4 - (int)sizeof(struct iphdr);

	if (optlen <= 0)
@@ -103,7 +101,7 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, 
	/* Copy the options since __ip_options_compile() modifies

	 * the options.

	 */

	if (skb_copy_bits(skb, start, opt->__data, optlen))

	if (skb_copy_bits(skb, sizeof(struct iphdr), opt->__data, optlen))

		return -EBADMSG;

	opt->optlen = optlen;
@@ -118,18 +116,18 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, 
		found = target == IPOPT_SSRR ? opt->is_strictroute :

					       !opt->is_strictroute;

		if (found)

			*offset = opt->srr + start;

			*offset = opt->srr;

		break;

	case IPOPT_RR:

		if (!opt->rr)

			break;

		*offset = opt->rr + start;

		*offset = opt->rr;

		found = true;

		break;

	case IPOPT_RA:

		if (!opt->router_alert)

			break;

		*offset = opt->router_alert + start;

		*offset = opt->router_alert;

		found = true;

		break;

	default:

tools/testing/selftests/net/netfilter/br_netfilter.sh

+7 −0
Original line number Diff line number Diff line
@@ -13,6 +13,12 @@ source lib.sh 


checktool "nft --version" "run test without nft tool"



read t < /proc/sys/kernel/tainted

if [ "$t" -ne 0 ];then

	echo SKIP: kernel is tainted

	exit $ksft_skip

fi



cleanup() {

	cleanup_all_ns

}
@@ -165,6 +171,7 @@ if [ "$t" -eq 0 ];then 
	echo PASS: kernel not tainted

else

	echo ERROR: kernel is tainted

	dmesg

	ret=1

fi

tools/testing/selftests/net/netfilter/br_netfilter_queue.sh

+7 −0
Original line number Diff line number Diff line
@@ -4,6 +4,12 @@ source lib.sh 


checktool "nft --version" "run test without nft tool"



read t < /proc/sys/kernel/tainted

if [ "$t" -ne 0 ];then

	echo SKIP: kernel is tainted

	exit $ksft_skip

fi



cleanup() {

	cleanup_all_ns

}
@@ -72,6 +78,7 @@ if [ "$t" -eq 0 ];then 
	echo PASS: kernel not tainted

else

	echo ERROR: kernel is tainted

	dmesg

	exit 1

fi