Hi,
The following patchset contains Netfilter fixes for your net tree:
1) Add SECMARK revision 1 to fix incorrect layout that prevents
from remove rule with this target, from Phil Sutter.
2) Fix pernet exit path spat in arptables, from Florian Westphal.
3) Missing rcu_read_unlock() for unknown nfnetlink callbacks,
reported by syzbot, from Eric Dumazet.
4) Missing check for skb_header_pointer() NULL pointer in
nfnetlink_osf.
5) Remove BUG_ON() after skb_header_pointer() from packet path
in several conntrack helper and the TCP tracker.
6) Fix memleak in the new object error path of userdata.
7) Avoid overflows in nft_hash_buckets(), reported by syzbot,
also from Eric.
8) Avoid overflows in 32bit arches, from Eric.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit bd1af6b5fffd36c12997bd48d61d39dc5796fa7b:
Documentation: ABI: sysfs-class-net-qmi: document pass-through file (2021-05-03 13:40:17 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 6c8774a94e6ad26f29ef103c8671f55c255c6201:
netfilter: nftables: avoid potential overflows on 32bit arches (2021-05-07 10:01:39 +0200)
----------------------------------------------------------------
Eric Dumazet (3):
netfilter: nfnetlink: add a missing rcu_read_unlock()
netfilter: nftables: avoid overflows in nft_hash_buckets()
netfilter: nftables: avoid potential overflows on 32bit arches
Florian Westphal (1):
netfilter: arptables: use pernet ops struct during unregister
Pablo Neira Ayuso (4):
netfilter: xt_SECMARK: add new revision to fix structure layout
netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
netfilter: remove BUG_ON() after skb_header_pointer()
netfilter: nftables: Fix a memleak from userdata error path in new objects
include/linux/netfilter_arp/arp_tables.h | 3 +-
include/uapi/linux/netfilter/xt_SECMARK.h | 6 +++
net/ipv4/netfilter/arp_tables.c | 5 +-
net/ipv4/netfilter/arptable_filter.c | 2 +-
net/netfilter/nf_conntrack_ftp.c | 5 +-
net/netfilter/nf_conntrack_h323_main.c | 3 +-
net/netfilter/nf_conntrack_irc.c | 5 +-
net/netfilter/nf_conntrack_pptp.c | 4 +-
net/netfilter/nf_conntrack_proto_tcp.c | 6 ++-
net/netfilter/nf_conntrack_sane.c | 5 +-
net/netfilter/nf_tables_api.c | 11 ++--
net/netfilter/nfnetlink.c | 1 +
net/netfilter/nfnetlink_osf.c | 2 +
net/netfilter/nft_set_hash.c | 20 ++++---
net/netfilter/xt_SECMARK.c | 88 ++++++++++++++++++++++++-------
15 files changed, 124 insertions(+), 42 deletions(-)
