No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal 210b889fd8 netfilter: nf_tables: fix destination register zeroing
[ Upstream commit 1e105e6afa6c3d32bfb52c00ffa393894a525c27 ]

Following bug was reported via irc:
nft list ruleset
   set knock_candidates_ipv4 {
      type ipv4_addr . inet_service
      size 65535
      elements = { 127.0.0.1 . 123,
                   127.0.0.1 . 123 }
      }
 ..
   udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 }
   udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport }

It should not have been possible to add a duplicate set entry.

After some debugging it turned out that the problem is the immediate
value (123) in the second-to-last rule.

Concatenations use 32bit registers, i.e. the elements are 8 bytes each,
not 6 and it turns out the kernel inserted

inet firewall @knock_candidates_ipv4
        element 0100007f ffff7b00  : 0 [end]
        element 0100007f 00007b00  : 0 [end]

Note the non-zero upper bits of the first element.  It turns out that
nft_immediate doesn't zero the destination register, but this is needed
when the length isn't a multiple of 4.

Furthermore, the zeroing in nft_payload is broken.  We can't use
[len / 4] = 0 -- if len is a multiple of 4, index is off by one.

Skip zeroing in this case and use a conditional instead of (len -1) / 4.

Fixes: 49499c3e6e ("netfilter: nf_tables: switch registers to 32 bit addressing")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-09 19:12:24 +02:00
arch MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores 2020-09-09 19:12:24 +02:00
block blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART 2020-09-03 11:27:01 +02:00
certs
crypto crypto: af_alg - Work around empty control messages without MSG_MORE 2020-09-03 11:27:05 +02:00
Documentation dt-bindings: mmc: tegra: Add tmclk for Tegra210 and later 2020-09-05 11:22:50 +02:00
drivers mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040 2020-09-09 19:12:24 +02:00
fs rxrpc: Make rxrpc_kernel_get_srtt() indicate validity 2020-09-09 19:12:23 +02:00
include netfilter: nf_tables: fix destination register zeroing 2020-09-09 19:12:24 +02:00
init x86: Fix early boot crash on gcc-10, third try 2020-05-20 08:20:34 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel kbuild: add variables for compression tools 2020-09-03 11:27:10 +02:00
lib test_kmod: avoid potential double free in trigger_config_run_type() 2020-08-21 13:05:37 +02:00
LICENSES
mm mm/vunmap: add cond_resched() in vunmap_pmd_range 2020-09-03 11:26:52 +02:00
net netfilter: nf_tables: fix destination register zeroing 2020-09-09 19:12:24 +02:00
samples bpf: Fix fds_example SIGSEGV error 2020-08-19 08:16:03 +02:00
scripts kbuild: fix broken builds because of GZIP,BZIP2,LZOP variables 2020-09-03 11:27:10 +02:00
security Smack: prevent underflow in smk_set_cipso() 2020-08-19 08:16:16 +02:00
sound ALSA: usb-audio: Update documentation comment for MS2109 quirk 2020-09-03 11:27:11 +02:00
tools perf record/stat: Explicitly call out event modifiers in the documentation 2020-09-05 11:22:49 +02:00
usr
virt KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set 2020-08-26 10:41:08 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2020-08-26 10:40:46 +02:00
Makefile Linux 5.4.63 2020-09-05 11:22:51 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.