Pablo Neira Ayuso efb27ad059 netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers ...

[ Upstream commit 7931d32955 ]

register store validation for NFT_DATA_VALUE is conditional, however,
the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This
only requires a new helper function to infer the register type from the
set datatype so this conditional check can be removed. Otherwise,
pointer to chain object can be leaked through the registers.

Fixes: 96518518cc ("netfilter: add nftables")
Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-07-05 09:31:47 +02:00

..

9p

…

bluetooth

Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ

2024-06-21 14:35:51 +02:00

caif

…

iucv

…

netfilter

netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

2024-07-05 09:31:47 +02:00

netns

xfrm: fix a data-race in xfrm_gen_index()

2023-10-25 12:03:06 +02:00

nfc

…

phonet

…

sctp

…

tc_act

…

6lowpan.h

…

act_api.h

…

addrconf.h

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

2024-04-17 11:18:24 +02:00

af_ieee802154.h

…

af_rxrpc.h

…

af_unix.h

af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().

2024-05-02 16:29:27 +02:00

af_vsock.h

…

ah.h

…

amt.h

…

arp.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

atmclip.h

…

ax25.h

ax25: Use kernel universal linked list to implement ax25_dev_list

2024-06-12 11:03:20 +02:00

ax88796.h

…

bareudp.h

…

bond_3ad.h

…

bond_alb.h

bonding (gcc13): synchronize bond_{a,t}lb_xmit() types

2023-05-11 23:03:41 +09:00

bond_options.h

…

bonding.h

bonding: fix macvlan over alb bond support

2023-08-30 16:11:04 +02:00

bpf_sk_storage.h

…

busy_poll.h

…

calipso.h

…

cfg80211-wext.h

…

cfg80211.h

wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()

2023-11-20 11:52:18 +01:00

cfg802154.h

mac802154: fix llsec key resources release in mac802154_llsec_key_del

2024-04-03 15:19:31 +02:00

checksum.h

…

cipso_ipv4.h

…

cls_cgroup.h

…

codel_impl.h

…

codel_qdisc.h

…

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

devlink.h

…

dropreason.h

…

dsa.h

net: dsa: introduce preferred_default_local_cpu_port and use on MT7530

2024-04-27 17:07:17 +02:00

dsfield.h

…

dst_cache.h

…

dst_metadata.h

…

dst_ops.h

net: fix __dst_negative_advice() race

2024-06-16 13:41:40 +02:00

dst.h

…

erspan.h

…

esp.h

…

espintcp.h

…

ethoc.h

…

failover.h

…

fib_notifier.h

…

fib_rules.h

…

firewire.h

…

flow_dissector.h

…

flow_offload.h

…

flow.h

inet: shrink struct flowi_common

2023-11-20 11:52:15 +01:00

fou.h

…

fq_impl.h

…

fq.h

…

garp.h

…

gen_stats.h

…

genetlink.h

drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group

2023-12-13 18:39:12 +01:00

geneve.h

…

gre.h

…

gro_cells.h

…

gro.h

…

gtp.h

…

gue.h

…

hwbm.h

…

icmp.h

…

ieee80211_radiotap.h

…

ieee802154_netdev.h

…

if_inet6.h

net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX

2023-12-20 17:00:15 +01:00

ife.h

…

ila.h

…

inet6_connection_sock.h

…

inet6_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_common.h

inet: factor out locked section of inet_accept() in a new helper

2024-06-12 11:03:53 +02:00

inet_connection_sock.h

Fix race for duplicate reqsk on identical SYN

2024-07-05 09:31:46 +02:00

inet_dscp.h

…

inet_ecn.h

…

inet_frag.h

…

inet_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_sock.h

udp: fix busy polling

2024-01-31 16:17:04 -08:00

inet_timewait_sock.h

…

inetpeer.h

…

ioam6.h

…

ip6_checksum.h

…

ip6_fib.h

ipv6: Remove in6addr_any alternatives.

2023-09-19 12:28:10 +02:00

ip6_route.h

…

ip6_tunnel.h

…

ip_fib.h

ipv4/fib: send notify when delete source address routes

2023-10-25 12:03:11 +02:00

ip_tunnels.h

geneve: Fix incorrect inner network header offset when innerprotoinherit is set

2024-06-21 14:35:51 +02:00

ip_vs.h

ipvs: Update width of source for ip_vs_sync_conn_options

2023-05-24 17:32:39 +01:00

ip.h

ipmr: fix kernel panic when forwarding mcast packets

2024-02-05 20:13:00 +00:00

ipcomp.h

…

ipconfig.h

…

ipv6_frag.h

…

ipv6_stubs.h

bpf: Derive source IP addr via bpf_*_fib_lookup()

2024-03-06 14:45:20 +00:00

ipv6.h

tcp: Fix bind() regression for v4-mapped-v6 wildcard address.

2023-09-19 12:28:10 +02:00

iw_handler.h

…

kcm.h

…

l3mdev.h

…

lag.h

…

lapb.h

…

lib80211.h

…

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

llc: Drop support for ETH_P_TR_802_2.

2024-01-31 16:17:04 -08:00

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

…

lwtunnel.h

lwt: Check LWTUNNEL_XMIT_CONTINUE strictly

2023-09-13 09:42:33 +02:00

mac80211.h

wifi: mac80211: don't use rate mask for scanning

2024-06-12 11:02:58 +02:00

mac802154.h

…

macsec.h

macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads

2024-05-02 16:29:32 +02:00

mctp.h

net: mctp: take ownership of skb in mctp_local_output

2024-03-06 14:45:06 +00:00

mctpdevice.h

…

mip6.h

…

mld.h

…

mpls_iptunnel.h

…

mpls.h

…

mptcp.h

…

mrp.h

…

ncsi.h

…

ndisc.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

neighbour.h

neighbour: fix data-races around n->output

2023-10-10 22:00:42 +02:00

net_debug.h

…

net_failover.h

…

net_namespace.h

…

net_ratelimit.h

…

net_trackers.h

…

netevent.h

…

netlabel.h

…

netlink.h

netlink: split up copies in the ack construction

2023-10-10 22:00:44 +02:00

netprio_cgroup.h

…

netrom.h

…

nexthop.h

ipv6: remove nexthop_fib6_nh_bh()

2023-10-10 22:00:46 +02:00

nl802154.h

…

nsh.h

…

p8022.h

…

page_pool.h

page_pool: fix inconsistency for page_pool_ring_[un]lock()

2023-06-05 09:26:20 +02:00

pie.h

…

ping.h

net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294

2023-06-14 11:15:16 +02:00

pkt_cls.h

…

pkt_sched.h

net/sched: make psched_mtu() RTNL-less safe

2023-07-23 13:49:27 +02:00

pptp.h

…

protocol.h

…

psample.h

…

psnap.h

…

raw.h

…

rawv6.h

…

red.h

…

regulatory.h

wifi: cfg80211: fix regulatory disconnect with OCB/NAN

2023-07-19 16:21:10 +02:00

request_sock.h

…

rose.h

…

route.h

net: annotate data-races around sk->sk_mark

2023-08-11 12:08:14 +02:00

rpl.h

ipv6: rpl: Fix Route of Death.

2023-06-14 11:15:20 +02:00

rsi_91x.h

…

rtnetlink.h

net: validate veth and vxcan peer ifindexes

2023-08-30 16:11:02 +02:00

rtnh.h

…

sch_generic.h

net/sched: fix false lockdep warning on qdisc root lock

2024-06-27 13:46:15 +02:00

scm.h

…

secure_seq.h

…

seg6_hmac.h

…

seg6_local.h

…

seg6.h

…

selftests.h

…

slhc_vj.h

…

smc.h

…

snmp.h

…

sock_reuseport.h

…

sock.h

net: fix __dst_negative_advice() race

2024-06-16 13:41:40 +02:00

Space.h

…

stp.h

…

strparser.h

…

switchdev.h

net: bridge: switchdev: Skip MDB replays of deferred events on offload

2024-03-01 13:26:35 +01:00

tcp_states.h

…

tcp.h

mptcp: fix lockless access in subflow ULP diag

2024-03-01 13:26:34 +01:00

timewait_sock.h

…

tipc.h

…

tls_toe.h

…

tls.h

tls: fix race between async notify and socket close

2024-02-23 09:12:31 +01:00

transp_v6.h

…

tso.h

…

tun_proto.h

…

udp_tunnel.h

udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO

2024-01-10 17:10:28 +01:00

udp.h

ipv4, ipv6: Use splice_eof() to flush

2024-01-10 17:10:27 +01:00

udplite.h

…

vsock_addr.h

…

vxlan.h

vxlan: Fix nexthop hash size

2023-08-11 12:08:17 +02:00

wext.h

…

x25.h

…

x25device.h

…

xdp_priv.h

…

xdp_sock_drv.h

…

xdp_sock.h

…

xdp.h

…

xfrm.h

xfrm: Preserve vlan tags for transport mode software GRO

2024-05-17 11:56:10 +02:00

xsk_buff_pool.h

…