kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/include/uapi
History
David Carlier 2ef71307c8 netfilter: ctnetlink: use netlink policy range checks 
[ Upstream commit 8f15b5071b ]

Replace manual range and mask validations with netlink policy
annotations in ctnetlink code paths, so that the netlink core rejects
invalid values early and can generate extack errors.

- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
  policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
  (14). The normal TCP option parsing path already clamps to this value,
  but the ctnetlink path accepted 0-255, causing undefined behavior when
  used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
  CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
  a new mask define grouping all valid expect flags.

Extracted from a broader nf-next patch by Florian Westphal, scoped to
ctnetlink for the fixes tree.

Fixes: c8e2078cfe ("[NETFILTER]: ctnetlink: add support for internal tcp connection tracking flags handling")
Signed-off-by: David Carlier <devnexen@gmail.com>
Co-developed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-04-18 10:33:25 +02:00
..
asm-generic syscalls: fix compat_sys_io_pgetevents_time64 usage 2024-07-05 09:14:50 +02:00
drm drm/fourcc: Add packed 10bit YUV 4:2:0 format 2022-12-31 13:14:10 +01:00
linux netfilter: ctnetlink: use netlink policy range checks 2026-04-18 10:33:25 +02:00
misc habanalabs: fix resetting args in wait for CS IOCTL 2021-09-29 12:18:48 +03:00
mtd mtd: add OTP (one-time-programmable) erase ioctl 2021-03-28 19:24:54 +02:00
rdma RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey 2022-10-26 12:35:03 +02:00
scsi scsi: fc: Add EDC ELS definition 2021-08-24 22:56:33 -04:00
sound ALSA: uapi: Fix typo in asound.h comment 2026-01-19 13:09:39 +01:00
video License cleanup: add SPDX license identifier to uapi header files with a license 2017-11-02 11:20:11 +01:00
xen xen/gntdev: gntdev.h: drop a duplicated word 2020-08-03 07:46:42 +02:00
Kbuild kbuild: re-implement Makefile.headersinst without recursion 2019-06-15 19:57:02 +09:00