From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 27 Jan 2015 23:44:00 +0000 (-0800)
Subject: 3.14-stable patches
X-Git-Tag: v3.10.67~22
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=da51de553fb390e0e797d5439f6e64a48ac7b8e6;p=thirdparty%2Fkernel%2Fstable-queue.git

3.14-stable patches

added patches:
	ipvs-uninitialized-data-with-ip_vs_ipv6.patch
	netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
---

diff --git a/queue-3.14/ipvs-uninitialized-data-with-ip_vs_ipv6.patch b/queue-3.14/ipvs-uninitialized-data-with-ip_vs_ipv6.patch
new file mode 100644
index 00000000000..782c31620b0
--- /dev/null
+++ b/queue-3.14/ipvs-uninitialized-data-with-ip_vs_ipv6.patch
@@ -0,0 +1,64 @@
+From 3b05ac3824ed9648c0d9c02d51d9b54e4e7e874f Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 6 Dec 2014 16:49:24 +0300
+Subject: ipvs: uninitialized data with IP_VS_IPV6
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3b05ac3824ed9648c0d9c02d51d9b54e4e7e874f upstream.
+
+The app_tcp_pkt_out() function expects "*diff" to be set and ends up
+using uninitialized data if CONFIG_IP_VS_IPV6 is turned on.
+
+The same issue is there in app_tcp_pkt_in().  Thanks to Julian Anastasov
+for noticing that.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/ipvs/ip_vs_ftp.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_ap
+ 	struct nf_conn *ct;
+ 	struct net *net;
+ 
++	*diff = 0;
++
+ #ifdef CONFIG_IP_VS_IPV6
+ 	/* This application helper doesn't work with IPv6 yet,
+ 	 * so turn this into a no-op for IPv6 packets
+@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_ap
+ 		return 1;
+ #endif
+ 
+-	*diff = 0;
+-
+ 	/* Only useful for established sessions */
+ 	if (cp->state != IP_VS_TCP_S_ESTABLISHED)
+ 		return 1;
+@@ -321,6 +321,9 @@ static int ip_vs_ftp_in(struct ip_vs_app
+ 	struct ip_vs_conn *n_cp;
+ 	struct net *net;
+ 
++	/* no diff required for incoming packets */
++	*diff = 0;
++
+ #ifdef CONFIG_IP_VS_IPV6
+ 	/* This application helper doesn't work with IPv6 yet,
+ 	 * so turn this into a no-op for IPv6 packets
+@@ -329,9 +332,6 @@ static int ip_vs_ftp_in(struct ip_vs_app
+ 		return 1;
+ #endif
+ 
+-	/* no diff required for incoming packets */
+-	*diff = 0;
+-
+ 	/* Only useful for established sessions */
+ 	if (cp->state != IP_VS_TCP_S_ESTABLISHED)
+ 		return 1;
diff --git a/queue-3.14/netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch b/queue-3.14/netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
new file mode 100644
index 00000000000..2778f41c6a4
--- /dev/null
+++ b/queue-3.14/netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
@@ -0,0 +1,32 @@
+From 9ea2aa8b7dba9e99544c4187cc298face254569f Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sun, 4 Jan 2015 15:20:29 +0100
+Subject: netfilter: nfnetlink: validate nfnetlink header from batch
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 9ea2aa8b7dba9e99544c4187cc298face254569f upstream.
+
+Make sure there is enough room for the nfnetlink header in the
+netlink messages that are part of the batch. There is a similar
+check in netlink_rcv_skb().
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/nfnetlink.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -265,7 +265,8 @@ replay:
+ 		nlh = nlmsg_hdr(skb);
+ 		err = 0;
+ 
+-		if (nlh->nlmsg_len < NLMSG_HDRLEN) {
++		if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
++		    skb->len < nlh->nlmsg_len) {
+ 			err = -EINVAL;
+ 			goto ack;
+ 		}
diff --git a/queue-3.14/series b/queue-3.14/series
index 19312e5bd85..af5d219f58b 100644
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -30,3 +30,5 @@ x86-apic-re-enable-pci_msi-support-for-non-smp-x86_32.patch
 x86-asm-traps-disable-tracing-and-kprobes-in-fixup_bad_iret-and-sync_regs.patch
 sata_dwc_460ex-fix-resource-leak-on-error-path.patch
 keys-close-race-between-key-lookup-and-freeing.patch
+netfilter-nfnetlink-validate-nfnetlink-header-from-batch.patch
+ipvs-uninitialized-data-with-ip_vs_ipv6.patch