6.18-stable: drop duplicate netfilter conntrack netlink policy patch

The same upstream commit f900e1d77ee0 ("netfilter: conntrack: add missing
netlink policy validations") was queued twice under two filenames; the
second copy failed to apply because the first had already landed.

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-6.18/netfilter-conntrack-add-missing-netlink-policy-validations.patch b/queue-6.18/netfilter-conntrack-add-missing-netlink-policy-validations.patch
deleted file mode 100644 (file)
index f6b5bb5..0000000
--- a/queue-6.18/netfilter-conntrack-add-missing-netlink-policy-validations.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From stable+bounces-237711-greg=kroah.com@vger.kernel.org Tue Apr 14 05:31:44 2026
-From: Li hongliang <1468888505@139.com>
-Date: Tue, 14 Apr 2026 11:31:29 +0800
-Subject: netfilter: conntrack: add missing netlink policy validations
-To: gregkh@linuxfoundation.org, stable@vger.kernel.org, fw@strlen.de
-Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org, pablo@netfilter.org, kadlec@netfilter.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kaber@trash.net, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, imv4bel@gmail.com
-Message-ID: <20260414033129.48460-1-1468888505@139.com>
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05 ]
-
-Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.
-
-These attributes are used by the kernel without any validation.
-Extend the netlink policies accordingly.
-
-Quoting the reporter:
-  nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE
-  value directly to ct->proto.sctp.state without checking that it is
-  within the valid range. [..]
-
-  and: ... with exp->dir = 100, the access at
-  ct->master->tuplehash[100] reads 5600 bytes past the start of a
-  320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by
-  UBSAN.
-
-Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations")
-Fixes: a258860e01b8 ("netfilter: ctnetlink: add full support for SCTP to ctnetlink")
-Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Li hongliang <1468888505@139.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/netfilter/nf_conntrack_netlink.c    | 2 +-
- net/netfilter/nf_conntrack_proto_sctp.c | 3 ++-
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
-index 879413b9fa06..2bb9eb2d25fb 100644
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -3465,7 +3465,7 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x,
- 
- #if IS_ENABLED(CONFIG_NF_NAT)
- static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
--      [CTA_EXPECT_NAT_DIR]    = { .type = NLA_U32 },
-+      [CTA_EXPECT_NAT_DIR]    = NLA_POLICY_MAX(NLA_BE32, IP_CT_DIR_REPLY),
-       [CTA_EXPECT_NAT_TUPLE]  = { .type = NLA_NESTED },
- };
- #endif
-diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
-index 7c6f7c9f7332..645d2c43ebf7 100644
---- a/net/netfilter/nf_conntrack_proto_sctp.c
-+++ b/net/netfilter/nf_conntrack_proto_sctp.c
-@@ -582,7 +582,8 @@ static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
- }
- 
- static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
--      [CTA_PROTOINFO_SCTP_STATE]          = { .type = NLA_U8 },
-+      [CTA_PROTOINFO_SCTP_STATE]          = NLA_POLICY_MAX(NLA_U8,
-+                                                       SCTP_CONNTRACK_HEARTBEAT_SENT),
-       [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]  = { .type = NLA_U32 },
-       [CTA_PROTOINFO_SCTP_VTAG_REPLY]     = { .type = NLA_U32 },
- };
--- 
-2.34.1
-

diff --git a/queue-6.18/series b/queue-6.18/series
index 2d601a65869664297601c5258a8bc63bc18b9a47..3c24b5f5ee5b5f54d981bc1d8c08ec25655ef8a2 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -175,4 +175,3 @@ kvm-x86-use-__declare_flex_array-for-uapi-structures-with-vlas.patch
 ocfs2-add-inline-inode-consistency-check-to-ocfs2_validate_inode_block.patch
 ocfs2-validate-inline-data-i_size-during-inode-read.patch
 ocfs2-fix-out-of-bounds-write-in-ocfs2_write_end_inline.patch
-netfilter-conntrack-add-missing-netlink-policy-validations.patch