From: Sasha Levin Date: Mon, 20 Apr 2026 13:40:02 +0000 (-0400) Subject: 6.18-stable: drop duplicate netfilter conntrack netlink policy patch X-Git-Tag: v6.12.83~25^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=19b028739cc746d62f21d6c09214aae8b35d9726;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable: drop duplicate netfilter conntrack netlink policy patch The same upstream commit f900e1d77ee0 ("netfilter: conntrack: add missing netlink policy validations") was queued twice under two filenames; the second copy failed to apply because the first had already landed. Signed-off-by: Sasha Levin --- diff --git a/queue-6.18/netfilter-conntrack-add-missing-netlink-policy-validations.patch b/queue-6.18/netfilter-conntrack-add-missing-netlink-policy-validations.patch deleted file mode 100644 index f6b5bb584a..0000000000 --- a/queue-6.18/netfilter-conntrack-add-missing-netlink-policy-validations.patch +++ /dev/null @@ -1,68 +0,0 @@ -From stable+bounces-237711-greg=kroah.com@vger.kernel.org Tue Apr 14 05:31:44 2026 -From: Li hongliang <1468888505@139.com> -Date: Tue, 14 Apr 2026 11:31:29 +0800 -Subject: netfilter: conntrack: add missing netlink policy validations -To: gregkh@linuxfoundation.org, stable@vger.kernel.org, fw@strlen.de -Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org, pablo@netfilter.org, kadlec@netfilter.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kaber@trash.net, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, imv4bel@gmail.com -Message-ID: <20260414033129.48460-1-1468888505@139.com> - -From: Florian Westphal - -[ Upstream commit f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05 ] - -Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. - -These attributes are used by the kernel without any validation. -Extend the netlink policies accordingly. - -Quoting the reporter: - nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE - value directly to ct->proto.sctp.state without checking that it is - within the valid range. [..] - - and: ... with exp->dir = 100, the access at - ct->master->tuplehash[100] reads 5600 bytes past the start of a - 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by - UBSAN. - -Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations") -Fixes: a258860e01b8 ("netfilter: ctnetlink: add full support for SCTP to ctnetlink") -Reported-by: Hyunwoo Kim -Signed-off-by: Florian Westphal -Signed-off-by: Li hongliang <1468888505@139.com> -Signed-off-by: Greg Kroah-Hartman ---- - net/netfilter/nf_conntrack_netlink.c | 2 +- - net/netfilter/nf_conntrack_proto_sctp.c | 3 ++- - 2 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 879413b9fa06..2bb9eb2d25fb 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -3465,7 +3465,7 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x, - - #if IS_ENABLED(CONFIG_NF_NAT) - static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = { -- [CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 }, -+ [CTA_EXPECT_NAT_DIR] = NLA_POLICY_MAX(NLA_BE32, IP_CT_DIR_REPLY), - [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED }, - }; - #endif -diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c -index 7c6f7c9f7332..645d2c43ebf7 100644 ---- a/net/netfilter/nf_conntrack_proto_sctp.c -+++ b/net/netfilter/nf_conntrack_proto_sctp.c -@@ -582,7 +582,8 @@ static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, - } - - static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = { -- [CTA_PROTOINFO_SCTP_STATE] = { .type = NLA_U8 }, -+ [CTA_PROTOINFO_SCTP_STATE] = NLA_POLICY_MAX(NLA_U8, -+ SCTP_CONNTRACK_HEARTBEAT_SENT), - [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 }, - [CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 }, - }; --- -2.34.1 - diff --git a/queue-6.18/series b/queue-6.18/series index 2d601a6586..3c24b5f5ee 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -175,4 +175,3 @@ kvm-x86-use-__declare_flex_array-for-uapi-structures-with-vlas.patch ocfs2-add-inline-inode-consistency-check-to-ocfs2_validate_inode_block.patch ocfs2-validate-inline-data-i_size-during-inode-read.patch ocfs2-fix-out-of-bounds-write-in-ocfs2_write_end_inline.patch -netfilter-conntrack-add-missing-netlink-policy-validations.patch