From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Florian Westphal <fw@strlen.de>,
Vasily Averin <vvs@virtuozzo.com>
Subject: [PATCH 4.9 23/24] netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
Date: Tue, 7 Jul 2020 17:13:55 +0200 [thread overview]
Message-ID: <20200707145750.096259233@linuxfoundation.org> (raw)
In-Reply-To: <20200707145748.952502272@linuxfoundation.org>
From: Vasily Averin <vvs@virtuozzo.com>
Could you please push this patch into stable@?
it fixes memory corruption in kernels v3.5 .. v4.10
Lost .data_len definition leads to write beyond end of
struct nf_ct_h323_master. Usually it corrupts following
struct nf_conn_nat, however if nat is not loaded it corrupts
following slab object.
In mainline this problem went away in v4.11,
after commit 9f0f3ebeda47 ("netfilter: helpers: remove data_len usage
for inkernel helpers") however many stable kernels are still affected.
Fixes: 1afc56794e03 ("netfilter: nf_ct_helper: implement variable length helper private data") # v3.5
cc: stable@vger.kernel.org
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_h323_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_con
{
.name = "Q.931",
.me = THIS_MODULE,
+ .data_len = sizeof(struct nf_ct_h323_master),
.tuple.src.l3num = AF_INET6,
.tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT),
.tuple.dst.protonum = IPPROTO_TCP,
next prev parent reply other threads:[~2020-07-07 15:14 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-07 15:13 [PATCH 4.9 00/24] 4.9.230-rc1 review Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 01/24] btrfs: fix a block group ref counter leak after failure to remove block group Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 02/24] btrfs: cow_file_range() num_bytes and disk_num_bytes are same Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 03/24] btrfs: fix data block group relocation failure due to concurrent scrub Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 04/24] mm: fix swap cache node allocation mask Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 05/24] EDAC/amd64: Read back the scrub rate PCI register on F15h Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 06/24] usbnet: smsc95xx: Fix use-after-free after removal Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 07/24] mm/slub.c: fix corrupted freechain in deactivate_slab() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 08/24] mm/slub: fix stack overruns with SLUB_STATS Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 09/24] usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 10/24] kgdb: Avoid suspicious RCU usage warning Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 11/24] crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 12/24] sched/rt: Show the sched_rr_timeslice SCHED_RR timeslice tuning knob in milliseconds Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 13/24] cxgb4: parse TC-U32 key values and masks natively Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 14/24] hwmon: (max6697) Make sure the OVERT mask is set correctly Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 15/24] hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 16/24] virtio-blk: free vblk-vqs in error path of virtblk_probe() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 17/24] i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 18/24] Revert "ALSA: usb-audio: Improve frames size computation" Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 19/24] SMB3: Honor seal flag for multiuser mounts Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 20/24] SMB3: Honor persistent/resilient handle flags " Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 21/24] cifs: Fix the target file was deleted when rename failed Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 22/24] MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Greg Kroah-Hartman
2020-07-07 15:13 ` Greg Kroah-Hartman [this message]
2020-07-07 15:13 ` [PATCH 4.9 24/24] efi: Make it possible to disable efivar_ssdt entirely Greg Kroah-Hartman
2020-07-08 6:38 ` [PATCH 4.9 00/24] 4.9.230-rc1 review Naresh Kamboju
2020-07-08 8:40 ` Jon Hunter
2020-07-08 15:13 ` Shuah Khan
2020-07-08 17:51 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200707145750.096259233@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vvs@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome