From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Florian Westphal <fw@strlen.de>,
Vasily Averin <vvs@virtuozzo.com>
Subject: [PATCH 4.4 19/19] netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
Date: Tue, 7 Jul 2020 17:10:22 +0200 [thread overview]
Message-ID: <20200707145748.453060963@linuxfoundation.org> (raw)
In-Reply-To: <20200707145747.493710555@linuxfoundation.org>
From: Vasily Averin <vvs@virtuozzo.com>
Could you please push this patch into stable@?
it fixes memory corruption in kernels v3.5 .. v4.10
Lost .data_len definition leads to write beyond end of
struct nf_ct_h323_master. Usually it corrupts following
struct nf_conn_nat, however if nat is not loaded it corrupts
following slab object.
In mainline this problem went away in v4.11,
after commit 9f0f3ebeda47 ("netfilter: helpers: remove data_len usage
for inkernel helpers") however many stable kernels are still affected.
Fixes: 1afc56794e03 ("netfilter: nf_ct_helper: implement variable length helper private data") # v3.5
cc: stable@vger.kernel.org
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_h323_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_con
{
.name = "Q.931",
.me = THIS_MODULE,
+ .data_len = sizeof(struct nf_ct_h323_master),
.tuple.src.l3num = AF_INET6,
.tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT),
.tuple.dst.protonum = IPPROTO_TCP,
next prev parent reply other threads:[~2020-07-07 15:10 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-07 15:10 [PATCH 4.4 00/19] 4.4.230-rc1 review Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 01/19] btrfs: cow_file_range() num_bytes and disk_num_bytes are same Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 02/19] btrfs: fix data block group relocation failure due to concurrent scrub Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 03/19] mm: fix swap cache node allocation mask Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 04/19] EDAC/amd64: Read back the scrub rate PCI register on F15h Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 05/19] mm/slub: fix stack overruns with SLUB_STATS Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 06/19] usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 07/19] kgdb: Avoid suspicious RCU usage warning Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 08/19] crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 09/19] sched/rt: Show the sched_rr_timeslice SCHED_RR timeslice tuning knob in milliseconds Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 10/19] hwmon: (max6697) Make sure the OVERT mask is set correctly Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 11/19] hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 12/19] virtio-blk: free vblk-vqs in error path of virtblk_probe() Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 13/19] i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 14/19] Revert "ALSA: usb-audio: Improve frames size computation" Greg Kroah-Hartman
2020-07-07 15:13 ` Takashi Iwai
2020-07-07 15:17 ` Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 15/19] SMB3: Honor seal flag for multiuser mounts Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 16/19] SMB3: Honor persistent/resilient handle flags " Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 17/19] cifs: Fix the target file was deleted when rename failed Greg Kroah-Hartman
2020-07-07 15:10 ` [PATCH 4.4 18/19] MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Greg Kroah-Hartman
2020-07-07 15:10 ` Greg Kroah-Hartman [this message]
2020-07-08 7:00 ` [PATCH 4.4 00/19] 4.4.230-rc1 review Naresh Kamboju
2020-07-08 8:39 ` Jon Hunter
2020-07-08 10:40 ` Chris Paterson
2020-07-08 15:18 ` Shuah Khan
2020-07-08 17:51 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200707145748.453060963@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vvs@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome