This is a note to let you know that I've just added the patch titled
netfilter: nftables: add helper function to set the base sequence number
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nftables-add-helper-function-to-set-the-base-sequence-number.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From pablo@xxxxxxxxxxxxx Wed Jul 5 18:55:23 2023
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Wed, 5 Jul 2023 18:55:09 +0200
Subject: netfilter: nftables: add helper function to set the base sequence number
To: netfilter-devel@xxxxxxxxxxxxxxx
Cc: sashal@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx
Message-ID: <20230705165516.50145-4-pablo@xxxxxxxxxxxxx>
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
[ 802b805162a1b7d8391c40ac8a878e9e63287aff ]
This patch adds a helper function to calculate the base sequence number
field that is stored in the nfnetlink header. Use the helper function
whenever possible.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -561,6 +561,11 @@ nf_tables_chain_type_lookup(struct net *
return ERR_PTR(-ENOENT);
}
+static __be16 nft_base_seq(const struct net *net)
+{
+ return htons(net->nft.base_seq & 0xffff);
+}
+
static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
[NFTA_TABLE_NAME] = { .type = NLA_STRING,
.len = NFT_TABLE_MAXNAMELEN - 1 },
@@ -583,7 +588,7 @@ static int nf_tables_fill_table_info(str
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
@@ -1218,7 +1223,7 @@ static int nf_tables_fill_chain_info(str
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
goto nla_put_failure;
@@ -2265,7 +2270,7 @@ static int nf_tables_fill_rule_info(stru
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
goto nla_put_failure;
@@ -3176,7 +3181,7 @@ static int nf_tables_fill_set(struct sk_
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = ctx->family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(ctx->net);
if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
goto nla_put_failure;
@@ -4032,7 +4037,7 @@ static int nf_tables_dump_set(struct sk_
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = table->family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
goto nla_put_failure;
@@ -4104,7 +4109,7 @@ static int nf_tables_fill_setelem_info(s
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = ctx->family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(ctx->net);
if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
goto nla_put_failure;
@@ -5152,7 +5157,7 @@ static int nf_tables_fill_obj_info(struc
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
@@ -5813,7 +5818,7 @@ static int nf_tables_fill_flowtable_info
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = family;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
@@ -6051,7 +6056,7 @@ static int nf_tables_fill_gen_info(struc
nfmsg = nlmsg_data(nlh);
nfmsg->nfgen_family = AF_UNSPEC;
nfmsg->version = NFNETLINK_V0;
- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+ nfmsg->res_id = nft_base_seq(net);
if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-4.19/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
queue-4.19/netfilter-nf_tables-reject-unbound-anonymous-set-before-commit-phase.patch
queue-4.19/netfilter-nf_tables-use-net_generic-infra-for-transaction-data.patch
queue-4.19/netfilter-nf_tables-fix-nat-hook-table-deletion.patch
queue-4.19/netfilter-nf_tables-incorrect-error-path-handling-with-nft_msg_newrule.patch
queue-4.19/gtp-fix-use-after-free-in-__gtp_encap_destroy.patch
queue-4.19/netfilter-nftables-add-helper-function-to-set-the-base-sequence-number.patch
queue-4.19/netfilter-nf_tables-add-rescheduling-points-during-loop-detection-walks.patch
queue-4.19/lib-ts_bm-reset-initial-match-offset-for-every-block.patch
queue-4.19/netfilter-nf_tables-add-nft_trans_prepare_error-to-deal-with-bound-set-chain.patch
queue-4.19/netfilter-nf_conntrack_sip-fix-the-ct_sip_parse_nume.patch
queue-4.19/netfilter-add-helper-function-to-set-up-the-nfnetlink-header-and-use-it.patch
queue-4.19/netfilter-nf_tables-unbind-non-anonymous-set-if-rule-construction-fails.patch
