qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Centos-kernel-stream-9/net/netfilter
History
Florian Westphal 10031021a9 netfilter: nft_exthdr: fix offset with ipv4_find_option() 
JIRA: https://issues.redhat.com/browse/RHEL-84577
Upstream Status: commit 6edd78af9506

commit 6edd78af9506bb182518da7f6feebd75655d9a0e
Author: Alexey Kashavkin <akashavkin@gmail.com>
Date:   Sun Mar 2 00:14:36 2025 +0300

    netfilter: nft_exthdr: fix offset with ipv4_find_option()

    There is an incorrect calculation in the offset variable which causes
    the nft_skb_copy_to_reg() function to always return -EFAULT. Adding the
    start variable is redundant. In the __ip_options_compile() function the
    correct offset is specified when finding the function. There is no need
    to add the size of the iphdr structure to the offset.

    Fixes: dbb5281a1f ("netfilter: nf_tables: add support for matching IPv4 options")
    Signed-off-by: Alexey Kashavkin <akashavkin@gmail.com>
    Reviewed-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>
 		2025-03-26 11:19:46 +01:00
..
ipset netfilter: ipset: add missing range check in bitmap_ip_uadt 2025-01-13 15:04:41 +00:00
ipvs ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() 2025-02-05 14:10:28 +00:00
Kconfig bpf: add bpf_link support for BPF_NETFILTER programs 2023-09-22 09:12:33 +02:00
Makefile netfilter: nft_inner: support for inner tunnel header matching 2023-12-10 03:06:59 +01:00
core.c netfilter: make nftables drops visible in net dropmonitor 2023-12-12 17:26:45 +01:00
nf_bpf_link.c netfilter: bpf: must hold reference on net namespace 2024-11-07 21:52:35 +01:00
nf_conncount.c netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() 2025-03-26 10:12:55 +01:00
nf_conntrack_acct.c
…
nf_conntrack_amanda.c
…
nf_conntrack_bpf.c bpf: treewide: Annotate BPF kfuncs in BTF 2024-10-15 10:49:07 +02:00
nf_conntrack_broadcast.c
…
nf_conntrack_core.c netfilter: conntrack: clamp maximum hashtable size to INT_MAX 2025-02-05 14:07:46 +00:00
nf_conntrack_ecache.c
…
nf_conntrack_expect.c netfilter: allow exp not to be removed in nf_ct_find_expectation 2023-10-13 09:03:13 +02:00
nf_conntrack_extend.c netfilter: conntrack: fix extension size table 2024-01-11 17:11:57 +01:00
nf_conntrack_ftp.c
…
nf_conntrack_h323_asn1.c netfilter: nf_conntrack_h323: Add protection for bmp length out of range 2024-04-22 11:26:34 +02:00
nf_conntrack_h323_main.c
…
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c
…
nf_conntrack_irc.c
…
nf_conntrack_labels.c netfilter: conntrack: switch connlabels to atomic_t 2024-07-02 14:30:44 -04:00
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c netfilter: ctnetlink: support CTA_FILTER for flush 2025-01-13 15:04:36 +00:00
nf_conntrack_ovs.c
…
nf_conntrack_pptp.c
…
nf_conntrack_proto.c
…
nf_conntrack_proto_dccp.c netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one 2023-07-11 11:42:11 +02:00
nf_conntrack_proto_generic.c
…
nf_conntrack_proto_gre.c netfilter: conntrack: gre: don't set assured flag for clash entries 2023-07-06 17:47:18 +02:00
nf_conntrack_proto_icmp.c
…
nf_conntrack_proto_icmpv6.c netfilter: conntrack: fix ct-state for ICMPv6 Multicast Router Discovery 2025-01-13 15:04:34 +00:00
nf_conntrack_proto_sctp.c netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new 2024-02-02 22:03:44 -05:00
nf_conntrack_proto_tcp.c netfilter: conntrack: correct window scaling with retransmitted SYN 2024-04-22 11:26:34 +02:00
nf_conntrack_proto_udp.c
…
nf_conntrack_sane.c
…
nf_conntrack_seqadj.c
…
nf_conntrack_sip.c netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. 2024-01-11 17:11:57 +01:00
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c Merge: netfilter: conntrack: fix possible bug_on with enable_hooks=1 2023-06-13 14:02:51 +02:00
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c
…
nf_conntrack_timestamp.c
…
nf_dup_netdev.c
…
nf_flow_table_core.c netfilter: nft_flow_offload: clear tcp MAXACK flag before moving to slowpath 2025-03-26 10:12:48 +01:00
nf_flow_table_inet.c netfilter: flowtable: validate vlan header 2024-09-27 13:11:16 +02:00
nf_flow_table_ip.c netfilter: flowtable: validate vlan header 2024-09-27 13:11:16 +02:00
nf_flow_table_offload.c netfilter: flowtable: initialise extack before use 2024-09-11 19:04:43 +00:00
nf_flow_table_procfs.c
…
nf_hooks_lwtunnel.c
…
nf_internals.h
…
nf_log.c netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger 2024-04-22 11:26:34 +02:00
nf_log_syslog.c netfilter: propagate net to nf_bridge_get_physindev 2024-06-24 11:47:15 +02:00
nf_nat_amanda.c
…
nf_nat_bpf.c bpf: treewide: Annotate BPF kfuncs in BTF 2024-10-15 10:49:07 +02:00
nf_nat_core.c minmax: add in_range() macro 2024-10-01 11:20:16 -04:00
nf_nat_ftp.c
…
nf_nat_helper.c
…
nf_nat_irc.c
…
nf_nat_masquerade.c
…
nf_nat_ovs.c netfilter: nf_nat: fix action not being set for all ct states 2024-01-11 17:11:58 +01:00
nf_nat_proto.c netfilter: nf_nat: undo erroneous tcp edemux lookup after port clash 2024-08-10 04:44:06 +02:00
nf_nat_redirect.c netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses 2024-01-11 17:12:22 +01:00
nf_nat_sip.c
…
nf_nat_tftp.c
…
nf_queue.c netfilter: nfnetlink_queue: drop bogus WARN_ON 2025-02-19 13:19:20 +01:00
nf_sockopt.c
…
nf_synproxy_core.c ipv6: annotate data-races around cnf.hop_limit 2024-11-14 10:16:48 +01:00
nf_tables_api.c netfilter: nf_tables: make destruction work queue pernet 2025-03-26 10:12:49 +01:00
nf_tables_core.c x86/bugs: Rename CONFIG_RETPOLINE => CONFIG_MITIGATION_RETPOLINE 2024-07-26 14:33:35 -04:00
nf_tables_offload.c net: flow_dissector: Use 64bits for used_keys 2024-03-25 14:11:42 +01:00
nf_tables_trace.c net: add and use skb_get_hash_net 2024-08-29 08:59:41 +08:00
nfnetlink.c netfilter: nfnetlink: convert kfree_skb to consume_skb 2025-01-13 15:04:35 +00:00
nfnetlink_acct.c
…
nfnetlink_cthelper.c
…
nfnetlink_cttimeout.c
…
nfnetlink_hook.c
…
nfnetlink_log.c netfilter: nfnetlink_log: use proper helper for fetching physinif 2024-06-24 11:47:12 +02:00
nfnetlink_osf.c netfilter: nfnetlink_osf: avoid OOB read 2023-09-11 11:55:51 -03:00
nfnetlink_queue.c netfilter: nf_queue: drop packets with cloned unconfirmed conntracks 2024-09-27 13:10:59 +02:00
nft_bitwise.c netfilter: nf_tables: upfront validation of data via nft_data_init() 2023-12-05 11:02:21 +01:00
nft_byteorder.c netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() 2024-01-19 13:25:08 +01:00
nft_chain_filter.c netfilter: nf_tables: honor table dormant flag from netdev release event path 2024-05-15 11:54:52 +02:00
nft_chain_nat.c
…
nft_chain_route.c
…
nft_cmp.c net: flow_dissector: Use 64bits for used_keys 2024-03-25 14:11:42 +01:00
nft_compat.c netfilter: nf_tables: make destruction work queue pernet 2025-03-26 10:12:49 +01:00
nft_connlimit.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_counter.c netfilter: nft_counter: Synchronize nft_counter_reset() against reader. 2024-09-27 13:11:16 +02:00
nft_ct.c netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template. 2025-03-26 10:12:48 +01:00
nft_dup_netdev.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_dynset.c netfilter: nf_tables: annotate data-races around element expiration 2024-09-27 13:22:57 +02:00
nft_exthdr.c netfilter: nft_exthdr: fix offset with ipv4_find_option() 2025-03-26 11:19:46 +01:00
nft_fib.c netfilter: nft_fib: allow from forward/input without iif selector 2024-06-27 16:52:21 +02:00
nft_fib_inet.c
…
nft_fib_netdev.c
…
nft_flow_offload.c netfilter: nft_flow_offload: update tcp state flags under lock 2025-03-26 10:12:48 +01:00
nft_fwd_netdev.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_hash.c net: add and use __skb_get_hash_symmetric_net 2024-08-29 08:59:51 +08:00
nft_immediate.c netfilter: nft_immediate: drop chain reference counter on error 2024-01-19 13:25:08 +01:00
nft_inner.c netfilter: nft_inner: incorrect percpu area handling under softirq 2025-01-13 15:04:43 +00:00
nft_last.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_limit.c netfilter: nft_limit: reject configurations that cause integer overflow 2024-05-15 11:54:50 +02:00
nft_log.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_lookup.c netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers 2024-08-07 17:03:20 +02:00
nft_masq.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_meta.c netfilter: nft_inner: validate mandatory meta and payload 2024-08-07 16:56:21 +02:00
nft_nat.c netfilter: nf_tables: validate NFPROTO_* family 2024-05-15 11:54:50 +02:00
nft_numgen.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_objref.c netfilter: nf_tables: report use refcount overflow 2023-12-05 11:03:19 +01:00
nft_osf.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_payload.c netfilter: nft_payload: sanitize offset and length before calling skb_checksum() 2024-11-11 06:17:54 +00:00
nft_queue.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_quota.c netfilter: nf_tables: Introduce NFT_MSG_GETRULE_RESET 2023-07-28 18:18:30 +02:00
nft_range.c netfilter: nf_tables: upfront validation of data via nft_data_init() 2023-12-05 11:02:21 +01:00
nft_redir.c netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs 2024-01-11 17:12:01 +01:00
nft_reject.c netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2023-07-28 18:18:30 +02:00
nft_reject_inet.c
…
nft_reject_netdev.c
…
nft_rt.c netfilter: nf_tables: validate NFPROTO_* family 2024-05-15 11:54:50 +02:00
nft_set_bitmap.c netfilter: nf_tables: restore set elements when delete set fails 2024-05-15 11:54:52 +02:00
nft_set_hash.c netfilter: nft_set_hash: skip duplicated elements pending gc run 2025-01-13 15:04:44 +00:00
nft_set_pipapo.c netfilter: nf_set_pipapo: fix initial map fill 2024-09-27 13:10:55 +02:00
nft_set_pipapo.h netfilter: nf_set_pipapo: fix initial map fill 2024-09-27 13:10:55 +02:00
nft_set_pipapo_avx2.c netfilter: nft_set_pipapo_avx2: disable softinterrupts 2024-09-27 13:10:55 +02:00
nft_set_pipapo_avx2.h
…
nft_set_rbtree.c netfilter: nf_tables: restore set elements when delete set fails 2024-05-15 11:54:52 +02:00
nft_socket.c netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level 2025-01-13 14:42:49 +00:00
nft_synproxy.c netfilter: nf_tables: validate NFPROTO_* family 2024-05-15 11:54:50 +02:00
nft_tproxy.c netfilter: nf_tables: add and use BE register load-store helpers 2024-09-27 13:10:34 +02:00
nft_tunnel.c Merge: [RHEL9.5 P1] netfilter: nf_tables: backports from upstream 2024-07-08 12:48:18 +00:00
nft_xfrm.c netfilter: nf_tables: validate NFPROTO_* family 2024-05-15 11:54:50 +02:00
utils.c
…
x_tables.c
…
xt_AUDIT.c
…
xt_CHECKSUM.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_CLASSIFY.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_CONNSECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_CT.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_DSCP.c
…
xt_HL.c
…
xt_HMARK.c
…
xt_IDLETIMER.c netfilter: IDLETIMER: Fix for possible ABBA deadlock 2024-12-12 15:46:12 +01:00
xt_LED.c netfilter: x_tables: fix LED ID check in led_tg_check() 2025-01-13 15:04:42 +00:00
xt_LOG.c
…
xt_MASQUERADE.c
…
xt_NETMAP.c
…
xt_NFLOG.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-23 16:19:47 +02:00
xt_NFQUEUE.c
…
xt_RATEEST.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_REDIRECT.c netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs 2024-01-11 17:12:01 +01:00
xt_SECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_TCPMSS.c
…
xt_TCPOPTSTRIP.c
…
xt_TEE.c
…
xt_TPROXY.c
…
xt_TRACE.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-23 16:19:47 +02:00
xt_addrtype.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_bpf.c
…
xt_cgroup.c
…
xt_cluster.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_comment.c
…
xt_connbytes.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_connlabel.c
…
xt_connlimit.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_connmark.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-23 16:19:47 +02:00
xt_conntrack.c
…
xt_cpu.c
…
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c
…
xt_helper.c
…
xt_hl.c
…
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c
…
xt_l2tp.c
…
xt_length.c
…
xt_limit.c
…
xt_mac.c
…
xt_mark.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-23 16:19:47 +02:00
xt_multiport.c
…
xt_nat.c
…
xt_nfacct.c
…
xt_osf.c netfilter: nfnetlink_osf: fix module autoload 2023-07-11 11:42:11 +02:00
xt_owner.c netfilter: xt_owner: Fix for unsafe access of sk->sk_socket 2024-01-10 10:30:18 +01:00
xt_physdev.c netfilter: propagate net to nf_bridge_get_physindev 2024-06-24 11:47:15 +02:00
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_realm.c
…
xt_recent.c netfilter: xt_recent: fix (increase) ipv6 literal buffer length 2024-01-10 10:30:18 +01:00
xt_repldata.h
…
xt_sctp.c netfilter: xt_sctp: validate the flag_info count 2023-09-11 11:49:41 -03:00
xt_set.c
…
xt_socket.c
…
xt_state.c
…
xt_statistic.c treewide: use get_random_u32() when possible 2023-10-20 06:15:03 -04:00
xt_string.c
…
xt_tcpmss.c
…
xt_tcpudp.c
…
xt_time.c
…
xt_u32.c netfilter: xt_u32: validate user space input 2024-01-10 10:30:18 +01:00