Hello,
Here is a list of netfilter bug fixes that I'd like to
see in 4.16 and 4.14.
I've cherry-picked these and with one exception (noted
below) all pick cleanly. Patches are listed in top-down order.
For v4.16.y and v4.14.y:
b8e9dc1c75714ceb53615743e1036f76e00f5a17
("netfilter: nf_tables: nft_compat: fix refcount leak on xt module")
8bdf164744b2c7f63561846c01cff3db597f282d
("netfilter: nft_compat: prepare for indirect info storage")
Necessary to make the fix (next patch below) apply.
732a8049f365f514d0607e03938491bf6cb0d620
("netfilter: nft_compat: fix handling of large matchinfo size")
Without it, some iptables -A will fail when using iptables via
nfnetlink (notably the cgroup match).
009240940e84c1c089af88b454f7e804a4c5bd1b
("netfilter: nf_tables: don't assume chain stats are set when jumplabel is set")
Fixes null-ptr deref.
bb7b40aecbf778c0c83a5bd62b0f03ca9f49a618
("netfilter: nf_tables: bogus EBUSY in chain deletions")
Fixes erroneous reject of some valid rulesets.
97a0549b15a0b466c47f6a0143a490a082c64b4e
("netfilter: nft_meta: fix wrong value dereference in nft_meta_set_eval")
This fixes a bug where 'nft ... meta nftrace set 0' may set a nonzero
value instead.
ad9d9e85072b668731f356be0a3750a3ba22a607
("netfilter: nf_tables: disable preemption in nft_update_chain_stats()")
360cc79d9d299ce297b205508276285ceffc5fa8
("netfilter: nf_tables: fix NULL-ptr in nf_tables_dump_obj()"), bug added in v4.14-rc1
Applies cleanly to 4.16 but in 4.14 tjis fails as the 2nd location that
is patched (nf_tables_dump_flowtable) doesn't exist. So in 4.14 this is
a one-line change:
- if (filter && filter->table[0] &&
+ if (filter && filter->table &&
bbb8c61f97e3a2dd91b30d3e57b7964a67569d11
("netfilter: nf_tables: increase nft_counters_enabled in nft_chain_stats_replace()"
This fixes underflow of the static_key used for the base chain counters.
f0dfd7a2b35b02030949100247d851b793cb275f
("netfilter: nf_tables: fix memory leak on error exit return"), since 4.12
additional change for v4.14.y (its already in 4.16):
467697d289e7e6e1b15910d99096c0da08c56d5b
("netfilter: nf_tables: add missing netlink attrs to policies")
If you'd like me to handle such larger requests differently please
let me know your preferenced way to handle this.
Thanks,
Florian
