linux-kernel - Re: [PATCH 4.4 28/78] netfilter: nfnl_cthelper: fix runtime expectation policy updates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1516473457.3417.18.camel@codethink.co.uk>
Date:   Sat, 20 Jan 2018 18:37:37 +0000
From:   Ben Hutchings <ben.hutchings@...ethink.co.uk>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     stable@...r.kernel.org, Liping Zhang <zlpnobody@...il.com>,
        Sasha Levin <alexander.levin@...izon.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4.4 28/78] netfilter: nfnl_cthelper: fix runtime
 expectation policy updates

On Fri, 2017-12-22 at 09:46 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Pablo Neira Ayuso <pablo@...filter.org>
> 
> 
> [ Upstream commit 2c422257550f123049552b39f7af6e3428a60f43 ]
> 
> We only allow runtime updates of expectation policies for timeout and
> maximum number of expectations, otherwise reject the update.
[...]
> +static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
> +					   struct nf_conntrack_helper *helper)
> +{
> +	struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1];
> +	struct nf_conntrack_expect_policy *policy;
> +	int i, err;
> +
> +	/* Check first that all policy attributes are well-formed, so we don't
> +	 * leave things in inconsistent state on errors.
> +	 */
> +	for (i = 0; i < helper->expect_class_max + 1; i++) {
> +
> +		if (!tb[NFCTH_POLICY_SET + i])
> +			return -EINVAL;
> +
> +		err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
> +						      &new_policy[i],
> +						      tb[NFCTH_POLICY_SET + i]);
> +		if (err < 0)
> +			return err;
> +	}
> +	/* Now we can safely update them. */
> +	for (i = 0; i < helper->expect_class_max + 1; i++) {
> +		policy = (struct nf_conntrack_expect_policy *)
> +				&helper->expect_policy[i];
> +		policy->max_expected = new_policy->max_expected;
> +		policy->timeout	= new_policy->timeout;
[...]

Shouldn't the RHS of these two assignments use new_policy[i]?

Ben.

-- 
Ben Hutchings
Software Developer, Codethink Ltd.