Commit 7e09dccd authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains two bugfixes for your net tree, they are:

1) Validate netlink group from nfnetlink to avoid an out of bound array
   access. This should only happen with superuser priviledges though.
   Discovered by Andrey Ryabinin using trinity.

2) Don't push ethernet header before calling the netfilter output hook
   for multicast traffic, this breaks ebtables since it expects to see
   skb->data pointing to the network header, patch from Linus Luessing.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents c8577819 f0b4eece

net/bridge/br_multicast.c

+1 −2
Original line number Original line Diff line number Diff line
@@ -813,10 +813,9 @@ static void __br_multicast_send_query(struct net_bridge *br, 
		return;

		return;





	if (port) {

	if (port) {

		__skb_push(skb, sizeof(struct ethhdr));

		skb->dev = port->dev;

		skb->dev = port->dev;

		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,

		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,

			dev_queue_xmit);

			br_dev_queue_push_xmit);

	} else {

	} else {

		br_multicast_select_own_querier(br, ip, skb);

		br_multicast_select_own_querier(br, ip, skb);

		netif_rx(skb);

		netif_rx(skb);

net/netfilter/nfnetlink.c

+11 −1
Original line number Original line Diff line number Diff line
@@ -47,6 +47,8 @@ static const int nfnl_group2type[NFNLGRP_MAX+1] = { 
	[NFNLGRP_CONNTRACK_EXP_NEW]	= NFNL_SUBSYS_CTNETLINK_EXP,

	[NFNLGRP_CONNTRACK_EXP_NEW]	= NFNL_SUBSYS_CTNETLINK_EXP,

	[NFNLGRP_CONNTRACK_EXP_UPDATE]	= NFNL_SUBSYS_CTNETLINK_EXP,

	[NFNLGRP_CONNTRACK_EXP_UPDATE]	= NFNL_SUBSYS_CTNETLINK_EXP,

	[NFNLGRP_CONNTRACK_EXP_DESTROY] = NFNL_SUBSYS_CTNETLINK_EXP,

	[NFNLGRP_CONNTRACK_EXP_DESTROY] = NFNL_SUBSYS_CTNETLINK_EXP,

	[NFNLGRP_NFTABLES]		= NFNL_SUBSYS_NFTABLES,

	[NFNLGRP_ACCT_QUOTA]		= NFNL_SUBSYS_ACCT,

};

};





void nfnl_lock(__u8 subsys_id)

void nfnl_lock(__u8 subsys_id)
@@ -464,7 +466,12 @@ static void nfnetlink_rcv(struct sk_buff *skb) 
static int nfnetlink_bind(int group)

static int nfnetlink_bind(int group)

{

{

	const struct nfnetlink_subsystem *ss;

	const struct nfnetlink_subsystem *ss;

	int type = nfnl_group2type[group];

	int type;



	if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)

		return -EINVAL;



	type = nfnl_group2type[group];





	rcu_read_lock();

	rcu_read_lock();

	ss = nfnetlink_get_subsys(type);

	ss = nfnetlink_get_subsys(type);
@@ -514,6 +521,9 @@ static int __init nfnetlink_init(void) 
{

{

	int i;

	int i;





	for (i = NFNLGRP_NONE + 1; i <= NFNLGRP_MAX; i++)

		BUG_ON(nfnl_group2type[i] == NFNL_SUBSYS_NONE);



	for (i=0; i<NFNL_SUBSYS_COUNT; i++)

	for (i=0; i<NFNL_SUBSYS_COUNT; i++)

		mutex_init(&table[i].mutex);

		mutex_init(&table[i].mutex);

CRA Git | Maintained and supported by SUSTech CRA and CCSE