netdev - [PATCH net,v20/4] Netfilter/IPVS fixes for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250313095636.2186-1-pablo@netfilter.org>
Date: Thu, 13 Mar 2025 10:56:32 +0100
From: Pablo Neira Ayuso <pablo@...filter.org>
To: netfilter-devel@...r.kernel.org
Cc: davem@...emloft.net,
	netdev@...r.kernel.org,
	kuba@...nel.org,
	pabeni@...hat.com,
	edumazet@...gle.com,
	fw@...len.de,
	horms@...nel.org
Subject: [PATCH net,v20/4] Netfilter/IPVS fixes for net

This is v2 including one more fix for ipv4 option match in nft_exthdr.

-o-

Hi,

The following patchset contains Netfilter/IPVS fixes for net:

1) Missing initialization of cpu and jiffies32 fields in conncount,
   from Kohei Enju.

2) Skip several tests in case kernel is tainted, otherwise tests bogusly
   report failure too as they also check for tainted kernel,
   from Florian Westphal.

3) Fix a hyphothetical integer overflow in do_ip_vs_get_ctl() leading
   to bogus error logs, from Dan Carpenter.

4) Fix incorrect offset in ipv4 option match in nft_exthdr, from
   Alexey Kashavkin.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-03-13

Thanks.

----------------------------------------------------------------

The following changes since commit 77b2ab31fc65c595ca0a339f6c5b8ef3adfae5c6:

  MAINTAINERS: sfc: remove Martin Habets (2025-03-10 13:34:15 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-03-13

for you to fetch changes up to 6edd78af9506bb182518da7f6feebd75655d9a0e:

  netfilter: nft_exthdr: fix offset with ipv4_find_option() (2025-03-13 10:02:39 +0100)

----------------------------------------------------------------
netfilter pull request 25-03-13

----------------------------------------------------------------
Alexey Kashavkin (1):
      netfilter: nft_exthdr: fix offset with ipv4_find_option()

Dan Carpenter (1):
      ipvs: prevent integer overflow in do_ip_vs_get_ctl()

Florian Westphal (1):
      selftests: netfilter: skip br_netfilter queue tests if kernel is tainted

Kohei Enju (1):
      netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()

 net/netfilter/ipvs/ip_vs_ctl.c                              |  8 ++++----
 net/netfilter/nf_conncount.c                                |  2 ++
 net/netfilter/nft_exthdr.c                                  | 10 ++++------
 tools/testing/selftests/net/netfilter/br_netfilter.sh       |  7 +++++++
 tools/testing/selftests/net/netfilter/br_netfilter_queue.sh |  7 +++++++
 tools/testing/selftests/net/netfilter/nft_queue.sh          |  1 +
 6 files changed, 25 insertions(+), 10 deletions(-)