Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

netfilter: nft_masq: fix uninitialized range in nft_masq_{ipv4, ipv6}_eval

When transferring from the original range in nf_nat_masquerade_{ipv4,ipv6}()
we copy over values from stack in from min_proto/max_proto due to uninitialized
range variable in both, nft_masq_{ipv4,ipv6}_eval. As we only initialize
flags at this time from nft_masq struct, just zero out the rest.

Fixes: 9ba1f726bec09 ("netfilter: nf_tables: add new nft_masq expression")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

authored by

Daniel Borkmann and committed by
Pablo Neira Ayuso
6b96686e d52fdbb7

+2
+1
net/ipv4/netfilter/nft_masq_ipv4.c
··· 24 24 struct nf_nat_range range; 25 25 unsigned int verdict; 26 26 27 + memset(&range, 0, sizeof(range)); 27 28 range.flags = priv->flags; 28 29 29 30 verdict = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,
+1
net/ipv6/netfilter/nft_masq_ipv6.c
··· 25 25 struct nf_nat_range range; 26 26 unsigned int verdict; 27 27 28 + memset(&range, 0, sizeof(range)); 28 29 range.flags = priv->flags; 29 30 30 31 verdict = nf_nat_masquerade_ipv6(pkt->skb, &range, pkt->out);