Patch "netfilter: nfnetlink: work around wrong endianess in res_id field" has been added to the 4.1-stable tree

Patch "netfilter: nfnetlink: work around wrong endianess in res_id field" has been added to the 4.1-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    netfilter: nfnetlink: work around wrong endianess in res_id field

to the 4.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nfnetlink-work-around-wrong-endianess-in-res_id-field.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From a9de9777d613500b089a7416f936bf3ae5f070d2 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 28 Aug 2015 21:01:43 +0200
Subject: netfilter: nfnetlink: work around wrong endianess in res_id field

From: Pablo Neira Ayuso <pablo@netfilter.org>

commit a9de9777d613500b089a7416f936bf3ae5f070d2 upstream.

The convention in nfnetlink is to use network byte order in every header field
as well as in the attribute payload. The initial version of the batching
infrastructure assumes that res_id comes in host byte order though.

The only client of the batching infrastructure is nf_tables, so let's add a
workaround to address this inconsistency. We currently have 11 nfnetlink
subsystems according to NFNL_SUBSYS_COUNT, so we can assume that the subsystem
2560, ie. htons(10), will not be allocated anytime soon, so it can be an alias
of nf_tables from the nfnetlink batching path when interpreting the res_id
field.

Based on original patch from Florian Westphal.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/netfilter/nfnetlink.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -432,6 +432,7 @@ done:
 static void nfnetlink_rcv(struct sk_buff *skb)
 {
 	struct nlmsghdr *nlh = nlmsg_hdr(skb);
+	u_int16_t res_id;
 	int msglen;
 
 	if (nlh->nlmsg_len < NLMSG_HDRLEN ||
@@ -456,7 +457,12 @@ static void nfnetlink_rcv(struct sk_buff
 
 		nfgenmsg = nlmsg_data(nlh);
 		skb_pull(skb, msglen);
-		nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id);
+		/* Work around old nft using host byte order */
+		if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES)
+			res_id = NFNL_SUBSYS_NFTABLES;
+		else
+			res_id = ntohs(nfgenmsg->res_id);
+		nfnetlink_rcv_batch(skb, nlh, res_id);
 	} else {
 		netlink_rcv_skb(skb, &nfnetlink_rcv_msg);
 	}


Patches currently in stable-queue which might be from pablo@netfilter.org are

queue-4.1/netfilter-nft_compat-skip-family-comparison-in-case-of-nfproto_unspec.patch
queue-4.1/netfilter-nf_conntrack-support-expectations-in-different-zones.patch
queue-4.1/netfilter-nf_log-wait-for-rcu-grace-after-logger-unregistration.patch
queue-4.1/netfilter-nftables-do-not-run-chains-in-the-wrong-network-namespace.patch
queue-4.1/netfilter-ctnetlink-put-back-references-to-master-ct-and-expect-objects.patch
queue-4.1/netfilter-nfnetlink-work-around-wrong-endianess-in-res_id-field.patch
queue-4.1/netfilter-nf_log-don-t-zap-all-loggers-on-unregister.patch
queue-4.1/netfilter-nf_tables-use-32-bit-addressing-register-from-nft_type_to_reg.patch