Skip to contentSkip to conversation

Patch "netfilter: ip6t_SYNPROXY: fix NULL pointer dereference" has been added to the 3.14-stable tree

PATCH [email protected] 1 participant 1 message Mar 1, 2016

Subsystems (3)
Networking Stable branch netfilter
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

netfilter: ip6t_SYNPROXY: fix NULL pointer dereference

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-ip6t_synproxy-fix-null-pointer-dereference.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 96fffb4f23f124f297d51dedc9cf51d19eb88ee1 Mon Sep 17 00:00:00 2001

From: Phil Sutter <[email protected]>
Date: Sun, 9 Aug 2015 13:14:15 +0200
Subject: netfilter: ip6t_SYNPROXY: fix NULL pointer dereference

From: Phil Sutter <[email protected]>

commit 96fffb4f23f124f297d51dedc9cf51d19eb88ee1 upstream.

This happens when networking namespaces are enabled.

Suggested-by Patrick McHardy <[email protected]>
Signed-off-by Phil Sutter <[email protected]>
Acked-by Patrick McHardy <[email protected]>
Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/ipv6/netfilter/ip6t_SYNPROXY.c |   18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)
net/ipv6/netfilter/ip6t_SYNPROXY.c +10 -8
@@ -37,12 +37,13 @@ synproxy_build_ip(struct sk_buff *skb, c
 }
 
 static void
-synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
+synproxy_send_tcp(const struct synproxy_net *snet,
+		  const struct sk_buff *skb, struct sk_buff *nskb,
 		  struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
 		  struct ipv6hdr *niph, struct tcphdr *nth,
 		  unsigned int tcp_hdr_size)
 {
-	struct net *net = nf_ct_net((struct nf_conn *)nfct);
+	struct net *net = nf_ct_net(snet->tmpl);
 	struct dst_entry *dst;
 	struct flowi6 fl6;
 

@@ -83,7 +84,8 @@ free_nskb:
 }
 
 static void
-synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
+synproxy_send_client_synack(const struct synproxy_net *snet,
+			    const struct sk_buff *skb, const struct tcphdr *th,
 			    const struct synproxy_options *opts)
 {
 	struct sk_buff *nskb;

@@ -119,7 +121,7 @@ synproxy_send_client_synack(const struct
 
 	synproxy_build_options(nth, opts);
 
-	synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+	synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
 			  niph, nth, tcp_hdr_size);
 }
 

@@ -163,7 +165,7 @@ synproxy_send_server_syn(const struct sy
 
 	synproxy_build_options(nth, opts);
 
-	synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+	synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
 			  niph, nth, tcp_hdr_size);
 }
 

@@ -203,7 +205,7 @@ synproxy_send_server_ack(const struct sy
 
 	synproxy_build_options(nth, opts);
 
-	synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+	synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
 }
 
 static void

@@ -241,7 +243,7 @@ synproxy_send_client_ack(const struct sy
 
 	synproxy_build_options(nth, opts);
 
-	synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+	synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
 }
 
 static bool

@@ -301,7 +303,7 @@ synproxy_tg6(struct sk_buff *skb, const
 					  XT_SYNPROXY_OPT_SACK_PERM |
 					  XT_SYNPROXY_OPT_ECN);
 
-		synproxy_send_client_synack(skb, th, &opts);
+		synproxy_send_client_synack(snet, skb, th, &opts);
 		return NF_DROP;
 
 	} else if (th->ack && !(th->fin || th->rst || th->syn)) {

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/netfilter-ip6t_synproxy-fix-null-pointer-dereference.patch