Patch "netfilter: ctnetlink: use helper function to calculate expect ID" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: ctnetlink: use helper function to calculate expect ID

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-ctnetlink-use-helper-function-to-calculate.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e78403238b9e487ec245733fe1fdbe930c9e5762
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date:   Sat Jul 13 16:47:38 2024 +0200

    netfilter: ctnetlink: use helper function to calculate expect ID
    
    [ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ]
    
    Delete expectation path is missing a call to the nf_expect_get_id()
    helper function to calculate the expectation ID, otherwise LSB of the
    expectation object address is leaked to userspace.
    
    Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id")
    Reported-by: zdi-disclosures@xxxxxxxxxxxxxx
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1466015bc56dc..b429ffde25b1a 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3426,7 +3426,8 @@ static int ctnetlink_del_expect(struct sk_buff *skb,
 
 		if (cda[CTA_EXPECT_ID]) {
 			__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
-			if (ntohl(id) != (u32)(unsigned long)exp) {
+
+			if (id != nf_expect_get_id(exp)) {
 				nf_ct_expect_put(exp);
 				return -ENOENT;
 			}