From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Florian Westphal <fw@strlen.de>,
Vasily Averin <vvs@virtuozzo.com>
Subject: [PATCH 4.9 23/24] netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
Date: Tue, 7 Jul 2020 17:13:55 +0200 [thread overview]
Message-ID: <20200707145750.096259233@linuxfoundation.org> (raw)
In-Reply-To: <20200707145748.952502272@linuxfoundation.org>
From: Vasily Averin <vvs@virtuozzo.com>
Could you please push this patch into stable@?
it fixes memory corruption in kernels v3.5 .. v4.10
Lost .data_len definition leads to write beyond end of
struct nf_ct_h323_master. Usually it corrupts following
struct nf_conn_nat, however if nat is not loaded it corrupts
following slab object.
In mainline this problem went away in v4.11,
after commit 9f0f3ebeda47 ("netfilter: helpers: remove data_len usage
for inkernel helpers") however many stable kernels are still affected.
Fixes: 1afc56794e03 ("netfilter: nf_ct_helper: implement variable length helper private data") # v3.5
cc: stable@vger.kernel.org
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_h323_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_con
{
.name = "Q.931",
.me = THIS_MODULE,
+ .data_len = sizeof(struct nf_ct_h323_master),
.tuple.src.l3num = AF_INET6,
.tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT),
.tuple.dst.protonum = IPPROTO_TCP,
next prev parent reply other threads:[~2020-07-07 15:14 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-07 15:13 [PATCH 4.9 00/24] 4.9.230-rc1 review Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 01/24] btrfs: fix a block group ref counter leak after failure to remove block group Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 02/24] btrfs: cow_file_range() num_bytes and disk_num_bytes are same Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 03/24] btrfs: fix data block group relocation failure due to concurrent scrub Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 04/24] mm: fix swap cache node allocation mask Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 05/24] EDAC/amd64: Read back the scrub rate PCI register on F15h Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 06/24] usbnet: smsc95xx: Fix use-after-free after removal Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 07/24] mm/slub.c: fix corrupted freechain in deactivate_slab() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 08/24] mm/slub: fix stack overruns with SLUB_STATS Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 09/24] usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 10/24] kgdb: Avoid suspicious RCU usage warning Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 11/24] crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 12/24] sched/rt: Show the sched_rr_timeslice SCHED_RR timeslice tuning knob in milliseconds Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 13/24] cxgb4: parse TC-U32 key values and masks natively Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 14/24] hwmon: (max6697) Make sure the OVERT mask is set correctly Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 15/24] hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 16/24] virtio-blk: free vblk-vqs in error path of virtblk_probe() Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 17/24] i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 18/24] Revert "ALSA: usb-audio: Improve frames size computation" Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 19/24] SMB3: Honor seal flag for multiuser mounts Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 20/24] SMB3: Honor persistent/resilient handle flags " Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 21/24] cifs: Fix the target file was deleted when rename failed Greg Kroah-Hartman
2020-07-07 15:13 ` [PATCH 4.9 22/24] MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Greg Kroah-Hartman
2020-07-07 15:13 ` Greg Kroah-Hartman [this message]
2020-07-07 15:13 ` [PATCH 4.9 24/24] efi: Make it possible to disable efivar_ssdt entirely Greg Kroah-Hartman
2020-07-08 6:38 ` [PATCH 4.9 00/24] 4.9.230-rc1 review Naresh Kamboju
2020-07-08 8:40 ` Jon Hunter
2020-07-08 8:40 ` Jon Hunter
2020-07-08 15:13 ` Shuah Khan
2020-07-08 17:51 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200707145750.096259233@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vvs@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.