mbox series

[SRU,F:linux-bluefield,0/3] Fix nft_do_chain crash when doing DDOS attack

Message ID 1675725865-3724-1-git-send-email-bodong@nvidia.com
Headers show
Series Fix nft_do_chain crash when doing DDOS attack | expand

Message

Bodong Wang Feb. 6, 2023, 11:24 p.m. UTC 
When doing DDOS attack on port 22, there is deference of an uninitialized
pointer from nf_tables.

The patches addressed the uninitialized pointers.

Pablo Neira Ayuso (3):
  netfilter: nf_tables: constify nft_reg_load{8, 16, 64}()
  netfilter: nft_set_bitmap: initialize set element extension in lookups
  netfilter: nf_tables: do not update stateful expressions if lookup is
    inverted

 include/net/netfilter/nf_tables.h |  8 ++++----
 net/netfilter/nft_lookup.c        | 12 +++++++-----
 net/netfilter/nft_set_bitmap.c    |  1 +
 3 files changed, 12 insertions(+), 9 deletions(-)

Comments

Thadeu Lima de Souza Cascardo Feb. 7, 2023, 7:02 p.m. UTC | #1 
Second commit is missing the cherry-pick line. Aside from that:

Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Stefan Bader Feb. 8, 2023, 8:38 a.m. UTC | #2 
On 07.02.23 00:24, Bodong Wang wrote:
> When doing DDOS attack on port 22, there is deference of an uninitialized
> pointer from nf_tables.
> 
> The patches addressed the uninitialized pointers.
> 
> Pablo Neira Ayuso (3):
>    netfilter: nf_tables: constify nft_reg_load{8, 16, 64}()
>    netfilter: nft_set_bitmap: initialize set element extension in lookups
>    netfilter: nf_tables: do not update stateful expressions if lookup is
>      inverted
> 
>   include/net/netfilter/nf_tables.h |  8 ++++----
>   net/netfilter/nft_lookup.c        | 12 +++++++-----
>   net/netfilter/nft_set_bitmap.c    |  1 +
>   3 files changed, 12 insertions(+), 9 deletions(-)
> 
v2 labelled as v1 around...