4.14-stable patches

added patches:
	netfilter-nft_payload-fix-wrong-mac-header-matching.patch

diff --git a/queue-4.14/netfilter-nft_payload-fix-wrong-mac-header-matching.patch b/queue-4.14/netfilter-nft_payload-fix-wrong-mac-header-matching.patch
new file mode 100644 (file)
index 0000000..f952c4b
--- /dev/null
+++ b/queue-4.14/netfilter-nft_payload-fix-wrong-mac-header-matching.patch
@@ -0,0 +1,37 @@
+From d351c1ea2de3e36e608fc355d8ae7d0cc80e6cd6 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Sun, 8 Oct 2023 19:36:53 +0200
+Subject: netfilter: nft_payload: fix wrong mac header matching
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Westphal <fw@strlen.de>
+
+commit d351c1ea2de3e36e608fc355d8ae7d0cc80e6cd6 upstream.
+
+mcast packets get looped back to the local machine.
+Such packets have a 0-length mac header, we should treat
+this like "mac header not set" and abort rule evaluation.
+
+As-is, we just copy data from the network header instead.
+
+Fixes: 96518518cc41 ("netfilter: add nftables")
+Reported-by: Blažej Krajňák <krajnak@levonet.sk>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nft_payload.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -84,7 +84,7 @@ static void nft_payload_eval(const struc
+ 
+       switch (priv->base) {
+       case NFT_PAYLOAD_LL_HEADER:
+-              if (!skb_mac_header_was_set(skb))
++              if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) == 0)
+                       goto err;
+ 
+               if (skb_vlan_tag_present(skb)) {

diff --git a/queue-4.14/series b/queue-4.14/series
index 2c1adf61213329639583182215a1a262248b1d44..9de4cc891b52e53844260ff812df8dd779ec57e4 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -32,3 +32,4 @@ bluetooth-avoid-memcmp-out-of-bounds-warning.patch
 nfc-nci-fix-possible-null-pointer-dereference-in-send_acknowledge.patch
 regmap-fix-null-deref-on-lookup.patch
 kvm-x86-mask-lvtpc-when-handling-a-pmi.patch
+netfilter-nft_payload-fix-wrong-mac-header-matching.patch