| commit | c6675233f9015d3c0460c8aab53ed9b99d915c64 | |
| author | Florian Westphal <fw@strlen.de> | |
| Tue, 30 Aug 2011 13:01:20 +0000 (30 15:01 +0200) | ||
| committer | Patrick McHardy <kaber@trash.net> | |
| Tue, 30 Aug 2011 13:01:20 +0000 (30 15:01 +0200) | ||
| tree | 3d1b9b71059be24fe3a35411eecc62000bba5abc | treesnapshot (tar.gz zip) |
| parent | 9823d9ff483af4ce8804a9eb69600ca739cd1f58 | commitdiff |
netfilter: nf_queue: reject NF_STOLEN verdicts from userspace
A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.
This problem was previously fixed via
64507fdbc29c3a622180378210ecea8659b14e40 (netfilter:
nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
NF_STOLEN can also be returned by a netfilter hook when iterating the
rules in nf_reinject.
Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.
This is complementary to commit fad54440438a7c231a6ae347738423cbabc936d9
(netfilter: avoid double free in nf_reinject).
Cc: Julian Anastasov <ja@ssi.bg>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.
This problem was previously fixed via
64507fdbc29c3a622180378210ecea8659b14e40 (netfilter:
nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
NF_STOLEN can also be returned by a netfilter hook when iterating the
rules in nf_reinject.
Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.
This is complementary to commit fad54440438a7c231a6ae347738423cbabc936d9
(netfilter: avoid double free in nf_reinject).
Cc: Julian Anastasov <ja@ssi.bg>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
| net/ipv4/netfilter/ip_queue.c | diffblobblamehistory | |
| net/ipv6/netfilter/ip6_queue.c | diffblobblamehistory | |
| net/netfilter/nfnetlink_queue.c | diffblobblamehistory |