netfilter: nfnl_cthelper: apply per-class values when updating policies

When a userspace conntrack helper with multiple expectation classes is
updated via nfnetlink, every class ends up with the first class's
max_expected and timeout values.

nfnl_cthelper_update_policy_all() validates each new policy into the
corresponding slot of the temporary new_policy array, but the second
loop that commits the values into the live helper dereferences
new_policy as a pointer instead of indexing it, so every iteration
reads new_policy[0] regardless of i.  An update that changes per-class
values is silently collapsed onto class 0's values with no error
returned to userspace.

Index the temporary array by i in the commit loop so each class gets
its own validated values.

Fixes: 2c422257550f ("netfilter: nfnl_cthelper: fix runtime expectation policy updates")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 0d16ad82d70c0157804dc27359ba38ddfa261e0c..34af6840803e2b830751f4f07ba4f36d0b4c4920 100644 (file)
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -346,8 +346,8 @@ static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
        for (i = 0; i < helper->expect_class_max + 1; i++) {
                policy = (struct nf_conntrack_expect_policy *)
                                &helper->expect_policy[i];
-               policy->max_expected = new_policy->max_expected;
-               policy->timeout = new_policy->timeout;
+               policy->max_expected = new_policy[i].max_expected;
+               policy->timeout = new_policy[i].timeout;
        }
 
 err: