No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Nicolas Bouchinet 5972d854cd netfilter: conntrack: Bound nf_conntrack sysctl writes
[ Upstream commit 8b6861390ffee6b8ed78b9395e3776c16fec6579 ]

nf_conntrack_max and nf_conntrack_expect_max sysctls were authorized to
be written any negative value, which would then be stored in the
unsigned int variables nf_conntrack_max and nf_ct_expect_max variables.

While the do_proc_dointvec_conv function is supposed to limit writing
handled by proc_dointvec proc_handler to INT_MAX. Such a negative value
being written in an unsigned int leads to a very high value, exceeding
this limit.

Moreover, the nf_conntrack_expect_max sysctl documentation specifies the
minimum value is 1.

The proc_handlers have thus been updated to proc_dointvec_minmax in
order to specify the following write bounds :

* Bound nf_conntrack_max sysctl writings between SYSCTL_ZERO
  and SYSCTL_INT_MAX.

* Bound nf_conntrack_expect_max sysctl writings between SYSCTL_ONE
  and SYSCTL_INT_MAX as defined in the sysctl documentation.

With this patch applied, sysctl writes outside the defined in the bound
will thus lead to a write error :

```
sysctl -w net.netfilter.nf_conntrack_expect_max=-1
sysctl: setting key "net.netfilter.nf_conntrack_expect_max": Invalid argument
```

Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-06-04 14:32:31 +02:00
arch um: Update min_low_pfn to match changes in uml_reserved 2025-06-04 14:32:30 +02:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:29:37 +02:00
certs
crypto crypto: null - Use spin lock instead of mutex 2025-05-02 07:39:27 +02:00
Documentation sched/isolation: Prevent boot crash when the boot CPU is nohz_full 2025-04-10 14:29:35 +02:00
drivers xen: Add support for XenServer 6.1 platform device 2025-06-04 14:32:31 +02:00
fs ext4: reorder capability check last 2025-06-04 14:32:31 +02:00
include dma-mapping: avoid potential unused data compilation warning 2025-06-04 14:32:29 +02:00
init sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP 2025-05-02 07:39:28 +02:00
ipc
kernel posix-timers: Add cond_resched() to posix_timer_add() search loop 2025-06-04 14:32:31 +02:00
lib dql: Fix dql->limit value when reset. 2025-06-04 14:32:30 +02:00
LICENSES
mm mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock 2025-05-02 07:39:16 +02:00
net netfilter: conntrack: Bound nf_conntrack sysctl writes 2025-06-04 14:32:31 +02:00
samples samples/bpf: Fix a resource leak 2024-12-14 19:44:50 +01:00
scripts kbuild: fix argument parsing in scripts/config 2025-06-04 14:32:31 +02:00
security ima: Fix use-after-free on a dentry's dname.name 2025-03-13 12:43:19 +01:00
sound ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() 2025-06-04 14:32:29 +02:00
tools tools/build: Don't pass test log files to linker 2025-06-04 14:32:30 +02:00
usr
virt KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status 2024-12-19 18:05:04 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.293 2025-05-02 07:39:30 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.