Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <1516473457.3417.18.camel@codethink.co.uk>
Subject: Re: [PATCH 4.4 28/78] netfilter: nfnl_cthelper: fix runtime
 expectation policy updates
From:   Ben Hutchings <ben.hutchings@codethink.co.uk>
To:     Pablo Neira Ayuso <pablo@netfilter.org>
Cc:     stable@vger.kernel.org, Liping Zhang <zlpnobody@gmail.com>,
        Sasha Levin <alexander.levin@verizon.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        LKML <linux-kernel@vger.kernel.org>
Date:   Sat, 20 Jan 2018 18:37:37 +0000
In-Reply-To: <20171222084600.065969708@linuxfoundation.org>
References: <20171222084556.909780563@linuxfoundation.org>
         <20171222084600.065969708@linuxfoundation.org>
Organization: Codethink Ltd.
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, 2017-12-22 at 09:46 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> 
> [ Upstream commit 2c422257550f123049552b39f7af6e3428a60f43 ]
> 
> We only allow runtime updates of expectation policies for timeout and
> maximum number of expectations, otherwise reject the update.
[...]
> +static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
> +					   struct nf_conntrack_helper *helper)
> +{
> +	struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1];
> +	struct nf_conntrack_expect_policy *policy;
> +	int i, err;
> +
> +	/* Check first that all policy attributes are well-formed, so we don't
> +	 * leave things in inconsistent state on errors.
> +	 */
> +	for (i = 0; i < helper->expect_class_max + 1; i++) {
> +
> +		if (!tb[NFCTH_POLICY_SET + i])
> +			return -EINVAL;
> +
> +		err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
> +						      &new_policy[i],
> +						      tb[NFCTH_POLICY_SET + i]);
> +		if (err < 0)
> +			return err;
> +	}
> +	/* Now we can safely update them. */
> +	for (i = 0; i < helper->expect_class_max + 1; i++) {
> +		policy = (struct nf_conntrack_expect_policy *)
> +				&helper->expect_policy[i];
> +		policy->max_expected = new_policy->max_expected;
> +		policy->timeout	= new_policy->timeout;
[...]

Shouldn't the RHS of these two assignments use new_policy[i]?

Ben.

-- 
Ben Hutchings
Software Developer, Codethink Ltd.