Patch "netfilter: synproxy: fix conntrackd interaction" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

netfilter: synproxy: fix conntrackd interaction

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-synproxy-fix-conntrackd-interaction.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Leblond <[email protected]>
Date: Thu, 11 May 2017 18:56:38 +0200
Subject: netfilter: synproxy: fix conntrackd interaction

From: Eric Leblond <[email protected]>

commit 87e94dbc210a720a34be5c1174faee5c84be963e upstream.

This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension.

This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node.

---
 net/netfilter/nf_conntrack_netlink.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>

@@ -1800,6 +1802,8 @@ ctnetlink_create_conntrack(struct net *n
 	nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
 	nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
 	nf_ct_labels_ext_add(ct);
+	nfct_seqadj_ext_add(ct);
+	nfct_synproxy_ext_add(ct);
 
 	/* we must add conntrack extensions before confirmation. */
 	ct->status |= IPS_CONFIRMED;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/netfilter-synproxy-fix-conntrackd-interaction.patch