* [PATCH v4.19-v5.10] netfilter: nf_tables: disallow timeout for anonymous sets
@ 2024-04-03 16:08 Keerthana K
2024-04-05 6:28 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Keerthana K @ 2024-04-03 16:08 UTC (permalink / raw)
To: stable, gregkh
Cc: pablo, kadlec, fw, davem, kuba, ajay.kaher, alexey.makhalov,
vasavi.sirnapalli, Keerthana K
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit e26d3009efda338f19016df4175f354a9bd0a4ab upstream.
Never used from userspace, disallow these parameters.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[Keerthana: code surrounding the patch is different
because nft_set_desc is not present in v4.19-v5.10]
Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
---
net/netfilter/nf_tables_api.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 44cfc8c3f..d98ea5cb7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3604,6 +3604,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
if (!(flags & NFT_SET_TIMEOUT))
return -EINVAL;
+ if (flags & NFT_SET_ANONYMOUS)
+ return -EOPNOTSUPP;
+
err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
if (err)
return err;
@@ -3612,6 +3615,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
if (!(flags & NFT_SET_TIMEOUT))
return -EINVAL;
+
+ if (flags & NFT_SET_ANONYMOUS)
+ return -EOPNOTSUPP;
+
gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
}
--
2.19.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH v4.19-v5.10] netfilter: nf_tables: disallow timeout for anonymous sets
2024-04-03 16:08 [PATCH v4.19-v5.10] netfilter: nf_tables: disallow timeout for anonymous sets Keerthana K
@ 2024-04-05 6:28 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2024-04-05 6:28 UTC (permalink / raw)
To: Keerthana K
Cc: stable, pablo, kadlec, fw, davem, kuba, ajay.kaher,
alexey.makhalov, vasavi.sirnapalli
On Wed, Apr 03, 2024 at 09:38:13PM +0530, Keerthana K wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> commit e26d3009efda338f19016df4175f354a9bd0a4ab upstream.
>
> Never used from userspace, disallow these parameters.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> [Keerthana: code surrounding the patch is different
> because nft_set_desc is not present in v4.19-v5.10]
> Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
> ---
> net/netfilter/nf_tables_api.c | 7 +++++++
> 1 file changed, 7 insertions(+)
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-04-05 6:28 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-03 16:08 [PATCH v4.19-v5.10] netfilter: nf_tables: disallow timeout for anonymous sets Keerthana K
2024-04-05 6:28 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox