From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [PATCH 5.15 01/84] netfilter: nf_tables: disallow timeout for anonymous sets
Date: Mon, 4 Mar 2024 21:23:34 +0000 [thread overview]
Message-ID: <20240304211542.384534173@linuxfoundation.org> (raw)
In-Reply-To: <20240304211542.332206551@linuxfoundation.org>
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit e26d3009efda338f19016df4175f354a9bd0a4ab upstream.
Never used from userspace, disallow these parameters.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4682,6 +4682,9 @@ static int nf_tables_newset(struct sk_bu
if (!(flags & NFT_SET_TIMEOUT))
return -EINVAL;
+ if (flags & NFT_SET_ANONYMOUS)
+ return -EOPNOTSUPP;
+
err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout);
if (err)
return err;
@@ -4690,6 +4693,10 @@ static int nf_tables_newset(struct sk_bu
if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
if (!(flags & NFT_SET_TIMEOUT))
return -EINVAL;
+
+ if (flags & NFT_SET_ANONYMOUS)
+ return -EOPNOTSUPP;
+
desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
}
next prev parent reply other threads:[~2024-03-04 21:52 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-04 21:23 [PATCH 5.15 00/84] 5.15.151-rc1 review Greg Kroah-Hartman
2024-03-04 21:23 ` Greg Kroah-Hartman [this message]
2024-03-04 21:23 ` [PATCH 5.15 02/84] mtd: spinand: gigadevice: Fix the get ecc status issue Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 03/84] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 04/84] net: ip_tunnel: prevent perpetual headroom growth Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 05/84] tun: Fix xdp_rxq_infos queue_index when detaching Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 06/84] cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 07/84] net: veth: clear GRO when clearing XDP even when down Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 08/84] ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 09/84] lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 10/84] net: enable memcg accounting for veth queues Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 11/84] veth: try harder when allocating queue memory Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 12/84] net: usb: dm9601: fix wrong return value in dm9601_mdio_read Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 13/84] uapi: in6: replace temporary label with rfc9486 Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 14/84] stmmac: Clear variable when destroying workqueue Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 15/84] Bluetooth: Avoid potential use-after-free in hci_error_reset Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 16/84] Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 17/84] Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 18/84] Bluetooth: Enforce validation on max value of connection interval Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 19/84] netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 20/84] netfilter: nfnetlink_queue: silence bogus compiler warning Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 21/84] netfilter: core: move ip_ct_attach indirection to struct nf_ct_hook Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 22/84] netfilter: make function op structures const Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 23/84] netfilter: let reset rules clean out conntrack entries Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 24/84] netfilter: bridge: confirm multicast packets before passing them up the stack Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 25/84] rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back Greg Kroah-Hartman
2024-03-04 21:23 ` [PATCH 5.15 26/84] igb: extend PTP timestamp adjustments to i211 Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 27/84] tls: rx: dont store the record type in socket context Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 28/84] tls: rx: dont store the decryption status " Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 29/84] tls: rx: dont issue wake ups when data is decrypted Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 30/84] tls: rx: refactor decrypt_skb_update() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 31/84] tls: hw: rx: use return value of tls_device_decrypted() to carry status Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 32/84] tls: rx: drop unnecessary arguments from tls_setup_from_iter() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 33/84] tls: rx: dont report text length from the bowels of decrypt Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 34/84] tls: rx: wrap decryption arguments in a structure Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 35/84] tls: rx: factor out writing ContentType to cmsg Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 36/84] tls: rx: dont track the async count Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 37/84] tls: rx: move counting TlsDecryptErrors for sync Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 38/84] tls: rx: assume crypto always calls our callback Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 39/84] tls: rx: use async as an in-out argument Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 40/84] tls: decrement decrypt_pending if no async completion will be called Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 41/84] efi/capsule-loader: fix incorrect allocation size Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 42/84] power: supply: bq27xxx-i2c: Do not free non existing IRQ Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 43/84] ALSA: Drop leftover snd-rtctimer stuff from Makefile Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 44/84] fbcon: always restore the old font data in fbcon_do_set_font() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 45/84] afs: Fix endless loop in directory parsing Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 46/84] riscv: Sparse-Memory/vmemmap out-of-bounds fix Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 47/84] tomoyo: fix UAF write bug in tomoyo_write_control() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 48/84] ALSA: firewire-lib: fix to check cycle continuity Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 49/84] gtp: fix use-after-free and null-ptr-deref in gtp_newlink() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 50/84] wifi: nl80211: reject iftype change with mesh ID change Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 51/84] btrfs: dev-replace: properly validate device names Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 52/84] dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 53/84] dmaengine: ptdma: use consistent DMA masks Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 54/84] dmaengine: fsl-qdma: init irq after reg initialization Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 55/84] mmc: core: Fix eMMC initialization with 1-bit bus connection Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 56/84] mmc: sdhci-xenon: add timeout for PHY init complete Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 57/84] mmc: sdhci-xenon: fix PHY init clock stability Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 58/84] riscv: add CALLER_ADDRx support Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 59/84] pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 60/84] x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 61/84] mptcp: move __mptcp_error_report in protocol.c Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 62/84] mptcp: process pending subflow error on close Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 63/84] mptcp: rename timer related helper to less confusing names Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 64/84] selftests: mptcp: add missing kconfig for NF Filter Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 65/84] selftests: mptcp: add missing kconfig for NF Filter in v6 Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 66/84] mptcp: clean up harmless false expressions Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 67/84] mptcp: add needs_id for netlink appending addr Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 68/84] mptcp: push at DSS boundaries Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 69/84] mptcp: fix possible deadlock in subflow diag Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 70/84] cachefiles: fix memory leak in cachefiles_add_cache() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 71/84] fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 72/84] Revert "drm/bridge: lt8912b: Register and attach our DSI device at probe" Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 73/84] af_unix: Drop oob_skb ref before purging queue in GC Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 74/84] gpio: 74x164: Enable output pins after registers are reset Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 75/84] gpiolib: Fix the error path order in gpiochip_add_data_with_key() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 76/84] gpio: fix resource unwinding order in error path Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 77/84] Revert "interconnect: Fix locking for runpm vs reclaim" Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 78/84] Revert "interconnect: Teach lockdep about icc_bw_lock order" Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 79/84] bpf: Add BPF_FIB_LOOKUP_SKIP_NEIGH for bpf_fib_lookup Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 80/84] bpf: Add table ID to bpf_fib_lookup BPF helper Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 81/84] bpf: Derive source IP addr via bpf_*_fib_lookup() Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 82/84] net: tls: fix async vs NIC crypto offload Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 83/84] Revert "tls: rx: move counting TlsDecryptErrors for sync" Greg Kroah-Hartman
2024-03-04 21:24 ` [PATCH 5.15 84/84] mptcp: fix double-free on socket dismantle Greg Kroah-Hartman
2024-03-04 22:50 ` [PATCH 5.15 00/84] 5.15.151-rc1 review SeongJae Park
2024-03-05 4:52 ` Ron Economos
2024-03-05 10:08 ` Naresh Kamboju
2024-03-05 11:30 ` Greg Kroah-Hartman
2024-03-05 10:58 ` Jon Hunter
2024-03-05 11:43 ` Harshit Mogalapalli
2024-03-05 19:05 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240304211542.384534173@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=pablo@netfilter.org \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).