This is a note to let you know that I've just added the patch titled
netfilter: nfnetlink: relax strict multicast group check from netlink_bind
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nfnetlink-relax-strict-multicast-group-check-from-netlink_bind.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 62924af247e95de7041a6d6f2d06cdd05152e2dc Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Sun, 4 Jan 2015 15:20:41 +0100
Subject: netfilter: nfnetlink: relax strict multicast group check from netlink_bind
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 62924af247e95de7041a6d6f2d06cdd05152e2dc upstream.
Relax the checking that was introduced in 97840cb ("netfilter:
nfnetlink: fix insufficient validation in nfnetlink_bind") when the
subscription bitmask is used. Existing userspace code code may request
to listen to all of the existing netlink groups by setting an all to one
subscription group bitmask. Netlink already validates subscription via
setsockopt() for us.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nfnetlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -470,7 +470,7 @@ static int nfnetlink_bind(int group)
int type;
if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
- return -EINVAL;
+ return 0;
type = nfnl_group2type[group];
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-3.18/netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
queue-3.18/netfilter-nf_tables-fix-flush-ruleset-chain-dependencies.patch
queue-3.18/netfilter-nfnetlink-relax-strict-multicast-group-check-from-netlink_bind.patch
queue-3.18/netfilter-conntrack-fix-race-between-confirmation-and-flush.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html