From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-2049231-1516473464-2-16157710551667375037 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no ("Email failed DMARC policy for domain") X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, ME_NOAUTH 0.01, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='uk', MailFrom='org' X-Spam-charsets: plain='UTF-8' X-IgnoreVacation: yes ("Email failed DMARC policy for domain") X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1516473463; b=TA/N7ys3H0waQmk9us9jVricbFgPo8DwWAv8tgyEqNAvZOw KoiwoWrd/DuaDbROzTUQCfgtK9M3R0y+NwqwoKC3E2zTGURIt77gF6LOf0fpPNp+ tdFSQ+K7lw1RqHHdw+bkLRVtXN7whaO4uK2D1Ahn08QAqR0e85XX0TIogprny5g9 ZusB540BiUFdDw/cwUSGYtZs0i4aOtsI8XjLoROALNjXTYHNfPp6zG2RSuBIPjQm DMQR5O8vCONFEvA5F6FOCpnH1Th3Pl420pJSsBGnnzD0aj+m4ORj9A6NR/B4WODK 5b0WWmaY9wYh+g2RYr5FprjPTPnEsCAyWAEVdRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=message-id:subject:from:to:cc:date :in-reply-to:references:content-type:mime-version :content-transfer-encoding:sender:list-id; s=arctest; t= 1516473463; bh=MDc2aLC5jV5MJ9ZGWOkfadR/MuiFrdi4u0sq8TKSKTk=; b=S yThqjPU+EHrVFh6cEwa6S1mTPCWGRP+n95hwCbQQFiPw7atJMQE9mz8A9N1knAvp daLOmgX1G4BFrEHLeatmQEK/gj52oBAWfyojavuMUMEBo8/o+ctpHwXfCxzkdlWi gRv8S2nlafhtbEQZ3h4AXjwjmR7eqa1oKdkEiMa73CqBY+g4ZFdG0uHFsl02/f2l KGcU7uayPYoL+PytUhKBaw5qekfOXf+ExNefH/xB92KlagV+DYYbWz4nEi8uwCyF uoC3u57ePNof/c9vd+kxejWM9XcTw3bK6nAKavWQ8CY8BWGPKH2lXhaTWuD35c3F sJX60LT8CEouyuzAvNaWA== ARC-Authentication-Results: i=1; mx6.messagingengine.com; arc=none (no signatures found); dkim=none (no signatures found); dmarc=fail (p=none,has-list-id=yes,d=none) header.from=codethink.co.uk; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=codethink.co.uk header.result=pass header_is_org_domain=yes Authentication-Results: mx6.messagingengine.com; arc=none (no signatures found); dkim=none (no signatures found); dmarc=fail (p=none,has-list-id=yes,d=none) header.from=codethink.co.uk; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=codethink.co.uk header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756447AbeATShl (ORCPT ); Sat, 20 Jan 2018 13:37:41 -0500 Received: from imap1.codethink.co.uk ([176.9.8.82]:38655 "EHLO imap1.codethink.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756385AbeATShk (ORCPT ); Sat, 20 Jan 2018 13:37:40 -0500 Message-ID: <1516473457.3417.18.camel@codethink.co.uk> Subject: Re: [PATCH 4.4 28/78] netfilter: nfnl_cthelper: fix runtime expectation policy updates From: Ben Hutchings To: Pablo Neira Ayuso Cc: stable@vger.kernel.org, Liping Zhang , Sasha Levin , Greg Kroah-Hartman , LKML Date: Sat, 20 Jan 2018 18:37:37 +0000 In-Reply-To: <20171222084600.065969708@linuxfoundation.org> References: <20171222084556.909780563@linuxfoundation.org> <20171222084600.065969708@linuxfoundation.org> Organization: Codethink Ltd. Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.22.6-1+deb9u1 Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Fri, 2017-12-22 at 09:46 +0100, Greg Kroah-Hartman wrote: > 4.4-stable review patch.  If anyone has any objections, please let me know. > > ------------------ > > From: Pablo Neira Ayuso > > > [ Upstream commit 2c422257550f123049552b39f7af6e3428a60f43 ] > > We only allow runtime updates of expectation policies for timeout and > maximum number of expectations, otherwise reject the update. [...] > +static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], > +    struct nf_conntrack_helper *helper) > +{ > + struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1]; > + struct nf_conntrack_expect_policy *policy; > + int i, err; > + > + /* Check first that all policy attributes are well-formed, so we don't > +  * leave things in inconsistent state on errors. > +  */ > + for (i = 0; i < helper->expect_class_max + 1; i++) { > + > + if (!tb[NFCTH_POLICY_SET + i]) > + return -EINVAL; > + > + err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i], > +       &new_policy[i], > +       tb[NFCTH_POLICY_SET + i]); > + if (err < 0) > + return err; > + } > + /* Now we can safely update them. */ > + for (i = 0; i < helper->expect_class_max + 1; i++) { > + policy = (struct nf_conntrack_expect_policy *) > + &helper->expect_policy[i]; > + policy->max_expected = new_policy->max_expected; > + policy->timeout = new_policy->timeout; [...] Shouldn't the RHS of these two assignments use new_policy[i]? Ben. -- Ben Hutchings Software Developer, Codethink Ltd.