This is a note to let you know that I've just added the patch titled
netfilter: xt_bpf: add mising opaque struct sk_filter definition
to the 3.17-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-xt_bpf-add-mising-opaque-struct-sk_filter-definition.patch
and it can be found in the queue-3.17 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From e10038a8ec06ac819b7552bb67aaa6d2d6f850c1 Mon Sep 17 00:00:00 2001
From: Pablo Neira <pablo@xxxxxxxxxxxxx>
Date: Tue, 29 Jul 2014 18:12:15 +0200
Subject: netfilter: xt_bpf: add mising opaque struct sk_filter definition
From: Pablo Neira <pablo@xxxxxxxxxxxxx>
commit e10038a8ec06ac819b7552bb67aaa6d2d6f850c1 upstream.
This structure is not exposed to userspace, so fix this by defining
struct sk_filter; so we skip the casting in kernelspace. This is safe
since userspace has no way to lurk with that internal pointer.
Fixes: e6f30c7 ("netfilter: x_tables: add xt_bpf match")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Acked-by: Willem de Bruijn <willemb@xxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
include/uapi/linux/netfilter/xt_bpf.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/uapi/linux/netfilter/xt_bpf.h
+++ b/include/uapi/linux/netfilter/xt_bpf.h
@@ -8,6 +8,8 @@
struct bpf_prog;
+struct sk_filter;
+
struct xt_bpf_info {
__u16 bpf_program_num_elem;
struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-3.17/netfilter-ipset-off-by-one-in-ip_set_nfnl_get_byindex.patch
queue-3.17/netfilter-nft_compat-fix-wrong-target-lookup-in-nft_target_select_ops.patch
queue-3.17/netfilter-nf_log-account-for-size-of-nlmsg_done-attribute.patch
queue-3.17/netfilter-nf_log-release-skbuff-on-nlmsg-put-failure.patch
queue-3.17/netfilter-nf_tables-check-for-null-in-nf_tables_newchain-pcpu-stats-allocation.patch
queue-3.17/netfilter-xt_bpf-add-mising-opaque-struct-sk_filter-definition.patch
queue-3.17/netfilter-nfnetlink_log-fix-maximum-packet-length-logged-to-userspace.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html