Hi,
The following patchset contains Netfilter fixes for net:
1) Insufficient validation of element datatype and length in
nft_setelem_parse_data(). At least commit 7d7402642eaf updates
maximum element data area up to 64 bytes when only 16 bytes
where supported at the time. Support for larger element size
came later in fdb9c405e35b though. Picking this older commit
as Fixes: tag to be safe than sorry.
2) Memleak in pipapo destroy path, reproducible when transaction
in aborted. This is already triggering in the existing netfilter
test infrastructure since more recent new tests are covering this
path.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f8ebb3ac881b17712e1d5967c97ab1806b16d3d6:
net: usb: ax88179_178a: Fix packet receiving (2022-06-30 10:41:57 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e:
netfilter: nft_set_pipapo: release elements in clone from abort path (2022-07-02 21:04:19 +0200)
----------------------------------------------------------------
Pablo Neira Ayuso (2):
netfilter: nf_tables: stricter validation of element data
netfilter: nft_set_pipapo: release elements in clone from abort path
net/netfilter/nf_tables_api.c | 9 +++++++-
net/netfilter/nft_set_pipapo.c | 48 +++++++++++++++++++++++++++++-------------
2 files changed, 41 insertions(+), 16 deletions(-)
