[PATCH nf-next v5 3/4] netfilter: nf_conntrack_amanda: use nf_ct_helper_parse_port()

[Rahul Chandelkar <rc@rexion.ai>]

amanda_help() passes the result of simple_strtoul() straight through
htons() into a __be16, so values 65536-99999 are truncated (e.g. 65537
becomes 1).  In addition, the port field is copied into a buffer that
only holds five digits, so a longer field such as 123456 is cut down to
12345 and accepted as a different port, and on the NAT path only its
first five bytes are mangled.  Either way a conntrack expectation is
created for a port that never appeared in the reply.

Make pbuf one byte larger so that a sixth digit is copied, and use
nf_ct_helper_parse_port(), which rejects port 0, values above 65535 and
digit runs longer than five characters.  The trailing len is still
derived from the parser's end pointer for the NAT mangle path.

Build-tested with allmodconfig and allyesconfig (W=1) and sparse, and
cross-built for i386 and big-endian powerpc.  The parser
was also checked in a userspace harness; the change has not been
run-time tested with Amanda traffic.

Fixes: 16958900578b ("[NETFILTER]: nf_conntrack/nf_nat: add amanda helper port")
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/all/179053062399.2160803.9591526412956900613@kernel.org/
Assisted-by: Claude-Code:claude-opus-5-5 sparse
Signed-off-by: Rahul Chandelkar <rc@rexion.ai>
---
 net/netfilter/nf_conntrack_amanda.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 14ae660491f3..a9c1ef1ee415 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -88,7 +88,8 @@ static int amanda_help(struct sk_buff *skb,
 	struct nf_conntrack_expect *exp;
 	struct nf_conntrack_tuple *tuple;
 	unsigned int dataoff, start, stop, off, i;
-	char pbuf[sizeof("65535")], *tmp;
+	char pbuf[sizeof("65535") + 1], *tmp;
+	u16 parsed_port;
 	u16 len;
 	__be16 port;
 	int ret = NF_ACCEPT;
@@ -127,15 +128,19 @@ static int amanda_help(struct sk_buff *skb,
 			continue;
 		off += start + search[i].len;
 
+		/*
+		 * pbuf holds one byte more than the longest port so that
+		 * an over-long digit run is seen and rejected.
+		 */
 		len = min_t(unsigned int, sizeof(pbuf) - 1, stop - off);
 		if (skb_copy_bits(skb, off, pbuf, len))
 			break;
 		pbuf[len] = '\0';
 
-		port = htons(simple_strtoul(pbuf, &tmp, 10));
-		len = tmp - pbuf;
-		if (port == 0 || len > 5)
+		if (nf_ct_helper_parse_port(pbuf, len, &parsed_port, &tmp))
 			break;
+		port = htons(parsed_port);
+		len = tmp - pbuf;
 
 		exp = nf_ct_expect_alloc(ct);
 		if (exp == NULL) {
-- 
2.43.0