Commit a4255b2e authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'nf-23-12-20' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 



Pablu Neira Syuso says:

====================
netfilter pull request 23-12-20

The following patchset contains Netfilter fixes for net:

1) Skip set commit for deleted/destroyed sets, this might trigger
   double deactivation of expired elements.

2) Fix packet mangling from egress, set transport offset from
   mac header for netdev/egress.

Both fixes address bugs already present in several releases.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 49fcf34a 7315dc1e

include/net/netfilter/nf_tables_ipv4.h

+1 −1
Original line number Diff line number Diff line
@@ -30,7 +30,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) 
		return -1;



	len = iph_totlen(pkt->skb, iph);

	thoff = iph->ihl * 4;

	thoff = skb_network_offset(pkt->skb) + (iph->ihl * 4);

	if (pkt->skb->len < len)

		return -1;

	else if (len < thoff)

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -9887,7 +9887,7 @@ static void nft_set_commit_update(struct list_head *set_update_list) 
	list_for_each_entry_safe(set, next, set_update_list, pending_update) {

		list_del_init(&set->pending_update);



		if (!set->ops->commit)

		if (!set->ops->commit || set->dead)

			continue;



		set->ops->commit(set);

net/netfilter/nf_tables_core.c

+1 −1
Original line number Diff line number Diff line
@@ -158,7 +158,7 @@ static bool nft_payload_fast_eval(const struct nft_expr *expr, 
	else {

		if (!(pkt->flags & NFT_PKTINFO_L4PROTO))

			return false;

		ptr = skb_network_header(skb) + nft_thoff(pkt);

		ptr = skb->data + nft_thoff(pkt);

	}



	ptr += priv->offset;