netdev - [PATCH net 0/8] Netfilterf fixes for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230222092137.88637-1-pablo@netfilter.org>
Date:   Wed, 22 Feb 2023 10:21:29 +0100
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     netfilter-devel@...r.kernel.org
Cc:     davem@...emloft.net, netdev@...r.kernel.org, kuba@...nel.org,
        pabeni@...hat.com, edumazet@...gle.com
Subject: [PATCH net 0/8] Netfilterf fixes for net

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix broken listing of set elements when table has an owner.

2) Fix conntrack refcount leak in ctnetlink with related conntrack
   entries, from Hangyu Hua.

3) Fix use-after-free/double-free in ctnetlink conntrack insert path,
   from Florian Westphal.

4) Fix ip6t_rpfilter with VRF, from Phil Sutter.

5) Fix use-after-free in ebtables reported by syzbot, also from Florian.

6) Use skb->len in xt_length to deal with IPv6 jumbo packets,
   from Xin Long.

7) Fix NETLINK_LISTEN_ALL_NSID with ctnetlink, from Florian Westphal.

8) Fix memleak in {ip_,ip6_,arp_}tables in ENOMEM error case,
   from Pavel Tikhomirov.

The fixes address broken stuff for several releases.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit bbb253b206b9c417928a6c827d038e457f3012e9:

  selftests: ocelot: tc_flower_chains: make test_vlan_ingress_modify() more comprehensive (2023-02-07 12:20:21 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD

for you to fetch changes up to 0af8c09c896810879387decfba8c942994bb61f5:

  netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (2023-02-22 10:11:27 +0100)

----------------------------------------------------------------
Florian Westphal (3):
      netfilter: conntrack: fix rmmod double-free race
      netfilter: ebtables: fix table blob use-after-free
      netfilter: ctnetlink: make event listener tracking global

Hangyu Hua (1):
      netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()

Pablo Neira Ayuso (1):
      netfilter: nf_tables: allow to fetch set elements when table has an owner

Pavel Tikhomirov (1):
      netfilter: x_tables: fix percpu counter block leak on error path when creating new netns

Phil Sutter (1):
      netfilter: ip6t_rpfilter: Fix regression with VRF interfaces

Xin Long (1):
      netfilter: xt_length: use skb len to match in length_mt6

 include/linux/netfilter.h                  |  5 +++++
 include/net/netns/conntrack.h              |  1 -
 net/bridge/netfilter/ebtables.c            |  2 +-
 net/ipv4/netfilter/arp_tables.c            |  4 ++++
 net/ipv4/netfilter/ip_tables.c             |  7 +++++--
 net/ipv6/netfilter/ip6_tables.c            |  7 +++++--
 net/ipv6/netfilter/ip6t_rpfilter.c         |  4 +++-
 net/netfilter/core.c                       |  3 +++
 net/netfilter/nf_conntrack_bpf.c           |  1 -
 net/netfilter/nf_conntrack_core.c          | 25 +++++++++++++----------
 net/netfilter/nf_conntrack_ecache.c        |  2 +-
 net/netfilter/nf_conntrack_netlink.c       |  8 ++++----
 net/netfilter/nf_tables_api.c              |  2 +-
 net/netfilter/nfnetlink.c                  |  9 +++++----
 net/netfilter/xt_length.c                  |  3 +--
 tools/testing/selftests/netfilter/rpath.sh | 32 ++++++++++++++++++++++++------
 16 files changed, 79 insertions(+), 36 deletions(-)