Thadeu Lima de Souza Cascardo 9e7dcb88ec netfilter: nf_tables: do not allow CHAIN_ID to refer to another table ... commit 95f466d223 upstream. When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is added to a table but refers to a chain in a different table, it will be linked to the chain in table2, but would have expressions referring to objects in table1. Then, when table1 is removed, the rule will not be removed as its linked to a chain in table2. When expressions in the rule are processed or removed, that will lead to a use-after-free. When looking for chains by ID, use the table that was used for the lookup by name, and only return chains belonging to that same table. Fixes: 837830a4b4 ("netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Cc: <stable@vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-21 15:15:27 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	xen/9p: use alloc/free_pages_exact()	2022-03-11 12:11:54 +01:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: make free_netdev() more lenient with unregistering devices	2022-07-29 17:19:07 +02:00
appletalk
atm
ax25	net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg	2022-06-22 14:13:17 +02:00
batman-adv	batman-adv: Don't skb_split skbuffs with frag_list	2022-05-18 10:23:42 +02:00
bluetooth	Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put	2022-08-03 12:00:43 +02:00
bpf	bpf: Add PROG_TEST_RUN support for sk_lookup programs	2022-08-03 12:00:52 +02:00
bpfilter
bridge	netfilter: br_netfilter: do not skip all hooks with 0 priority	2022-07-21 21:20:13 +02:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 12:27:56 +02:00
can	can: bcm: use call_rcu() instead of costly synchronize_rcu()	2022-07-12 16:32:16 +02:00
ceph	libceph: fix potential use-after-free on linger ping and resends	2022-05-25 09:17:56 +02:00
core	bpf: Add PROG_TEST_RUN support for sk_lookup programs	2022-08-03 12:00:52 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:09:37 +01:00
dccp	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2022-06-09 10:21:09 +02:00
decnet
dns_resolver
dsa	net: dsa: Add missing of_node_put() in dsa_port_link_register_of	2022-05-09 09:05:02 +02:00
ethernet
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-17 10:14:41 +01:00
hsr
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:30:37 +01:00
ife
ipv4	tcp: Fix data-races around sysctl_tcp_reflect_tos.	2022-08-03 12:00:48 +02:00
ipv6	tcp: Fix data-races around sysctl_tcp_reflect_tos.	2022-08-03 12:00:48 +02:00
iucv
kcm
key	Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"	2022-06-14 18:32:43 +02:00
l2tp	ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg	2022-06-22 14:13:15 +02:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-27 13:53:50 +02:00
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 09:57:10 +02:00
mac80211	wifi: mac80211: fix queue selection for mesh/OCB interfaces	2022-07-21 21:20:00 +02:00
mac802154
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:03:23 +01:00
mptcp	tcp: Fix data-races around sysctl_tcp_moderate_rcvbuf.	2022-08-03 12:00:45 +02:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:40:32 +01:00
netfilter	netfilter: nf_tables: do not allow CHAIN_ID to refer to another table	2022-08-21 15:15:27 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-13 21:01:00 +02:00
netlink	netlink: do not reset transport header in netlink_recvmsg()	2022-05-18 10:23:43 +02:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 10:54:03 +01:00
nfc	NFC: NULL out the dev->rfkill to prevent UAF	2022-06-09 10:21:01 +02:00
nsh
openvswitch	net: openvswitch: fix parsing of nw_proto for IPv6 fragments	2022-06-29 08:59:45 +02:00
packet	net/packet: fix packet_sock xmit return value checking	2022-04-27 13:53:50 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:25:01 +01:00
psample
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:09:21 +02:00
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:30:54 +01:00
rfkill
rose	net: rose: fix UAF bug caused by rose_t0timer_expiry	2022-07-12 16:32:17 +02:00
rxrpc	rxrpc: Fix decision on when to generate an IDLE ACK	2022-06-09 10:21:12 +02:00
sched	net/sched: act_api: Notify user space if any actions were flushed before error	2022-07-07 17:52:18 +02:00
sctp	sctp: leave the err path free in sctp_stream_init to sctp_stream_free	2022-08-03 12:00:49 +02:00
smc	tcp: Fix data-races around keepalive sysctl knobs.	2022-07-29 17:19:16 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
sunrpc	SUNRPC: Fix READ_PLUS crasher	2022-07-07 17:52:16 +02:00
switchdev
tipc	net: tipc: fix possible refcount leak in tipc_sk_create()	2022-07-21 21:20:14 +02:00
tls	net/tls: Remove the context from the list in tls_device_down	2022-08-03 12:00:46 +02:00
unix	af_unix: Fix a data-race in unix_dgram_peer_wake_me().	2022-06-14 18:32:40 +02:00
vmw_vsock	vsock: each transport cycles only on its own sockets	2022-03-23 09:13:27 +01:00
wimax
wireless	cfg80211: declare MODULE_FIRMWARE for regulatory.db	2022-06-09 10:21:26 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-08 14:40:30 +02:00
xdp	xsk: Clear page contiguity bit when unmapping pool	2022-07-12 16:32:21 +02:00
xfrm	ip: Fix data-races around sysctl_ip_no_pmtu_disc.	2022-07-29 17:19:12 +02:00
compat.c
devres.c
Kconfig
Makefile
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c