Commit c00e858d authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Use kvfree() to release vmalloc()'ed areas in ipset, from Eric Dumazet.

2) UAF in nfnetlink_queue from the nf_conntrack_update() path.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4d572545 d005fbb8

net/netfilter/ipset/ip_set_bitmap_ip.c

+1 −1
Original line number Diff line number Diff line
@@ -326,7 +326,7 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
	set->variant = &bitmap_ip;

	if (!init_map_ip(set, map, first_ip, last_ip,

			 elements, hosts, netmask)) {

		kfree(map);

		ip_set_free(map);

		return -ENOMEM;

	}

	if (tb[IPSET_ATTR_TIMEOUT]) {

net/netfilter/ipset/ip_set_bitmap_ipmac.c

+1 −1
Original line number Diff line number Diff line
@@ -363,7 +363,7 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);

	set->variant = &bitmap_ipmac;

	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {

		kfree(map);

		ip_set_free(map);

		return -ENOMEM;

	}

	if (tb[IPSET_ATTR_TIMEOUT]) {

net/netfilter/ipset/ip_set_bitmap_port.c

+1 −1
Original line number Diff line number Diff line
@@ -274,7 +274,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);

	set->variant = &bitmap_port;

	if (!init_map_port(set, map, first_port, last_port)) {

		kfree(map);

		ip_set_free(map);

		return -ENOMEM;

	}

	if (tb[IPSET_ATTR_TIMEOUT]) {

net/netfilter/ipset/ip_set_hash_gen.h

+2 −2
Original line number Diff line number Diff line
@@ -682,7 +682,7 @@ retry: 
	}

	t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));

	if (!t->hregion) {

		kfree(t);

		ip_set_free(t);

		ret = -ENOMEM;

		goto out;

	}
@@ -1533,7 +1533,7 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, 
	}

	t->hregion = ip_set_alloc(ahash_sizeof_regions(hbits));

	if (!t->hregion) {

		kfree(t);

		ip_set_free(t);

		kfree(h);

		return -ENOMEM;

	}

net/netfilter/nf_conntrack_core.c

+2 −0
Original line number Diff line number Diff line
@@ -2158,6 +2158,8 @@ static int nf_conntrack_update(struct net *net, struct sk_buff *skb) 
		err = __nf_conntrack_update(net, skb, ct, ctinfo);

		if (err < 0)

			return err;



		ct = nf_ct_get(skb, &ctinfo);

	}



	return nf_confirm_cthelper(skb, ct, ctinfo);

CRA Git | Maintained and supported by SUSTech CRA and CCSE