netdev - [PATCH net 0/3] netfilter updates for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230920084156.4192-1-fw@strlen.de>
Date: Wed, 20 Sep 2023 10:41:48 +0200
From: Florian Westphal <fw@...len.de>
To: <netdev@...r.kernel.org>
Cc: Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	<netfilter-devel@...r.kernel.org>
Subject: [PATCH net 0/3] netfilter updates for net

Hello,

The following three patches fix regressions in the netfilter subsystem:

1. Reject attempts to repeatedly toggle the 'dormant' flag in a single
   transaction.  Doing so makes nf_tables lose track of the real state
   vs. the desired state.  This ends with an attempt to unregister hooks
   that were never registered in the first place, which yields a splat.

2. Fix element counting in the new nftables garbage collection infra
   that came with 6.5:  More than 255 expired elements wraps a counter
   which results in memory leak.

3. Since 6.4 ipset can BUG when a set is renamed while a CREATE command
   is in progress, fix from Jozsef Kadlecsik.

The following changes since commit 4e4b1798cc90e376b8b61d0098b4093898a32227:

  vxlan: Add missing entries to vxlan_get_size() (2023-09-20 09:00:54 +0100)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-09-20

for you to fetch changes up to 7433b6d2afd512d04398c73aa984d1e285be125b:

  netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP (2023-09-20 10:35:24 +0200)

Florian Westphal (2):
      netfilter: nf_tables: disable toggling dormant table state more than once
      netfilter: nf_tables: fix memleak when more than 255 elements expired

Jozsef Kadlecsik (1):
      netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP

 include/net/netfilter/nf_tables.h |  2 +-
 net/netfilter/ipset/ip_set_core.c | 12 ++++++++++--
 net/netfilter/nf_tables_api.c     | 14 ++++++++++++--
 3 files changed, 23 insertions(+), 5 deletions(-)
-- 
2.41.0