59 lines
2.3 KiB
Diff
59 lines
2.3 KiB
Diff
From fc4bd898b84a9af433a40544389691829990d4b2 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:16:35 +0200
|
|
Subject: [PATCH] netfilter: ctnetlink: zero expect NAT fields when
|
|
CTA_EXPECT_NAT absent
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit 35177c687713
|
|
|
|
commit 35177c6877134a21315f37d57a5577846225623e
|
|
Author: Qi Tang <tpluszz77@gmail.com>
|
|
Date: Tue Mar 31 14:17:12 2026 +0800
|
|
|
|
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
|
|
|
|
ctnetlink_alloc_expect() allocates expectations from a non-zeroing
|
|
slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not
|
|
present in the netlink message, saved_addr and saved_proto are
|
|
never initialized. Stale data from a previous slab occupant can
|
|
then be dumped to userspace by ctnetlink_exp_dump_expect(), which
|
|
checks these fields to decide whether to emit CTA_EXPECT_NAT.
|
|
|
|
The safe sibling nf_ct_expect_init(), used by the packet path,
|
|
explicitly zeroes these fields.
|
|
|
|
Zero saved_addr, saved_proto and dir in the else branch, guarded
|
|
by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when
|
|
NAT is enabled.
|
|
|
|
Confirmed by priming the expect slab with NAT-bearing expectations,
|
|
freeing them, creating a new expectation without CTA_EXPECT_NAT,
|
|
and observing that the ctnetlink dump emits a spurious
|
|
CTA_EXPECT_NAT containing stale data from the prior allocation.
|
|
|
|
Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations")
|
|
Reported-by: kernel test robot <lkp@intel.com>
|
|
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
|
|
index edc6045..208e26a 100644
|
|
--- a/net/netfilter/nf_conntrack_netlink.c
|
|
+++ b/net/netfilter/nf_conntrack_netlink.c
|
|
@@ -3607,6 +3607,12 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
|
|
exp, nf_ct_l3num(ct));
|
|
if (err < 0)
|
|
goto err_out;
|
|
+#if IS_ENABLED(CONFIG_NF_NAT)
|
|
+ } else {
|
|
+ memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
|
|
+ memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
|
|
+ exp->dir = 0;
|
|
+#endif
|
|
}
|
|
return exp;
|
|
err_out:
|