linux-toradex.git/net/netfilter, branch v2.6.16.26

[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

2006-06-30T21:06:52+00:00

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash. Make sure at least a single chunk is present.

Problem noticed by George A. Theall 

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] xt_sctp: fix endless loop caused by 0 chunk length (CVE-2006-3085)

2006-06-20T08:54:53+00:00

Fix endless loop in the SCTP match similar to those already fixed in the
SCTP conntrack helper (was CVE-2006-1527).

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: SCTP conntrack: fix infinite loop (CVE-2006-1527)

2006-05-02T21:38:21+00:00

[NETFILTER]: SCTP conntrack: fix infinite loop

fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar 

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

[PATCH] {ip, nf}_conntrack_netlink: fix expectation notifier unregistration

2006-04-07T16:44:28+00:00

[NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration

This patch fixes expectation notifier unregistration on module unload to
use ip_conntrack_expect_unregister_notifier(). This bug causes a soft
lockup at the first expectation created after a rmmod ; insmod of this
module.

Should go into -stable as well.

Signed-off-by: Martin Josefsson 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[NETFILTER]: nfnetlink_queue: fix possible NULL-ptr dereference

2006-03-13T04:39:35+00:00

Fix NULL-ptr dereference when a config message for a non-existant
queue containing only an NFQA_CFG_PARAMS attribute is received.

Coverity #433

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: fix end-of-list check

2006-02-27T21:03:55+00:00

The comparison wants to find out if the last list iteration reached the
end of the list. It needs to compare the iterator with the list head to
do this, not the element it is looking for.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: remove unnecessary check for outfn

2006-02-27T21:03:39+00:00

The only point of registering a queue handler is to provide an outfn,
so there is no need to check for it.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: fix rerouting after packet mangling

2006-02-27T21:03:24+00:00

Packets should be rerouted when they come back from userspace, not before.
Also move the queue_rerouters to RCU to avoid taking the queue_handler_lock
for each reinjected packet.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: check if rerouter is present before using it

2006-02-27T21:03:10+00:00

Every rerouter needs to provide a save and a reroute function, we don't
need to check for them. But we do need to check if a rerouter is registered
at all for the current family, with bridging for example packets of
unregistered families can hit nf_queue.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_queue: don't copy registered rerouter data

2006-02-27T21:02:52+00:00

Use the registered data structure instead of copying it.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller