From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 28 Nov 2020 10:09:06 +0000 (+0100)
Subject: 4.19-stable patches
X-Git-Tag: v4.4.247~43
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7d5213d9e5e71562f7cf6bab883cfb358b650d9e;p=thirdparty%2Fkernel%2Fstable-queue.git

4.19-stable patches

added patches:
	netfilter-clear-skb-next-in-nf_hook_list.patch
---

diff --git a/queue-4.19/netfilter-clear-skb-next-in-nf_hook_list.patch b/queue-4.19/netfilter-clear-skb-next-in-nf_hook_list.patch
new file mode 100644
index 00000000000..a21b07c0251
--- /dev/null
+++ b/queue-4.19/netfilter-clear-skb-next-in-nf_hook_list.patch
@@ -0,0 +1,43 @@
+From xiyou.wangcong@gmail.com  Sat Nov 28 11:07:47 2020
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Fri, 20 Nov 2020 19:43:17 -0800
+Subject: netfilter: clear skb->next in NF_HOOK_LIST()
+To: netdev@vger.kernel.org
+Cc: Cong Wang <cong.wang@bytedance.com>, liuzx@knownsec.com, Florian Westphal <fw@strlen.de>, Edward Cree <ecree@solarflare.com>, stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Message-ID: <20201121034317.577081-1-xiyou.wangcong@gmail.com>
+
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+NF_HOOK_LIST() uses list_del() to remove skb from the linked list,
+however, it is not sufficient as skb->next still points to other
+skb. We should just call skb_list_del_init() to clear skb->next,
+like the rest places which using skb list.
+
+This has been fixed in upstream by commit ca58fbe06c54
+("netfilter: add and use nf_hook_slow_list()").
+
+Fixes: 9f17dbf04ddf ("netfilter: fix use-after-free in NF_HOOK_LIST")
+Reported-by: liuzx@knownsec.com
+Tested-by: liuzx@knownsec.com
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Edward Cree <ecree@solarflare.com>
+Cc: stable@vger.kernel.org # between 4.19 and 5.4
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/netfilter.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -300,7 +300,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int ho
+ 
+ 	INIT_LIST_HEAD(&sublist);
+ 	list_for_each_entry_safe(skb, next, head, list) {
+-		list_del(&skb->list);
++		skb_list_del_init(skb);
+ 		if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
+ 			list_add_tail(&skb->list, &sublist);
+ 	}
diff --git a/queue-4.19/series b/queue-4.19/series
index 3cad090402b..d5646d4eac1 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -1 +1,2 @@
 perf-event-check-ref_reloc_sym-before-using-it.patch
+netfilter-clear-skb-next-in-nf_hook_list.patch