Ian Wilson 78146572b9 netfilter: Zero the tuple in nfnl_cthelper_parse_tuple() ... nfnl_cthelper_parse_tuple() is called from nfnl_cthelper_new(), nfnl_cthelper_get() and nfnl_cthelper_del(). In each case they pass a pointer to an nf_conntrack_tuple data structure local variable: struct nf_conntrack_tuple tuple; ... ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); The problem is that this local variable is not initialized, and nfnl_cthelper_parse_tuple() only initializes two fields: src.l3num and dst.protonum. This leaves all other fields with undefined values based on whatever is on the stack: tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]); The symptom observed was that when the rpc and tns helpers were added then traffic to port 1536 was being sent to user-space. Signed-off-by: Ian Wilson <iwilson@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2015-03-12 13:07:36 +01:00
..
6lowpan	net/6lowpan: Remove FSF address from GPL statement.	2014-12-05 12:43:04 +01:00
9p	virtio/9p: verify device has config space	2015-01-21 16:28:45 +10:30
802
8021q	vlan: advertise link netns via netlink	2015-01-23 17:51:15 -08:00
appletalk	new helper: memcpy_from_msg()	2014-11-24 04:28:48 -05:00
atm	put iov_iter into msghdr	2014-12-09 16:29:03 -05:00
ax25	new helper: memcpy_from_msg()	2014-11-24 04:28:48 -05:00
batman-adv	batman-adv: Kconfig, Add missing DEBUG_FS dependency	2015-01-07 22:17:11 +01:00
bluetooth	Bluetooth: Fix potential NULL dereference	2015-02-03 09:02:12 +01:00
bridge	net: bridge: add compile-time assert for cb struct size	2015-03-03 14:07:04 -05:00
caif	caif: fix a signedness bug in cfpkt_iterate()	2015-02-20 17:35:14 -05:00
can	can: add missing initialisations in CAN related skbuffs	2015-03-09 10:22:24 +01:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2015-02-19 14:14:42 -08:00
core	net: Handle unregister properly when netdev namespace change fails.	2015-03-10 21:59:46 -04:00
dcb	dcbnl : Disable software interrupts before taking dcb_lock	2014-11-16 14:50:52 -05:00
dccp	net: introduce helper macro for_each_cmsghdr	2014-12-10 22:41:55 -05:00
decnet	decnet: Fix obvious o/0 typo	2015-02-23 15:28:50 -05:00
dns_resolver	Merge commit 'v3.16' into next	2014-10-01 00:44:04 +10:00
dsa	net: dsa: Set valid phy interface type	2015-02-17 10:37:39 -08:00
ethernet	net: Add Transparent Ethernet Bridging GRO support.	2015-01-02 15:46:41 -05:00
hsr	net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface.	2015-03-01 13:40:23 -05:00
ieee802154	netlink: make nlmsg_end() and genlmsg_end() void	2015-01-18 01:03:45 -05:00
ipv4	ip: fix error queue empty skb handling	2015-03-08 23:01:54 -04:00
ipv6	ip: fix error queue empty skb handling	2015-03-08 23:01:54 -04:00
ipx	switch ipxrtr_route_packet() from iovec to msghdr	2014-11-24 04:28:49 -05:00
irda	TTY/Serial fixes for 4.0-rc3	2015-03-08 12:25:40 -07:00
iucv	net: introduce helper macro for_each_cmsghdr	2014-12-10 22:41:55 -05:00
key	new helper: memcpy_from_msg()	2014-11-24 04:28:48 -05:00
l2tp	netlink: make nlmsg_end() and genlmsg_end() void	2015-01-18 01:03:45 -05:00
lapb	lapb: move EXPORT_SYMBOL after functions.	2014-10-24 15:51:42 -04:00
llc	net: llc: use correct size for sysctl timeout entries	2015-01-25 00:23:21 -08:00
mac80211	mac80211: Send EAPOL frames at lowest rate	2015-02-26 21:03:06 +01:00
mac802154	mac802154: fix kbuild test robot warning	2015-01-03 01:51:51 +01:00
mpls	net: mark some potential candidates __read_mostly	2015-01-30 17:58:39 -08:00
netfilter	netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()	2015-03-12 13:07:36 +01:00
netlabel	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2015-02-11 20:25:11 -08:00
netlink	rhashtable: remove indirection for grow/shrink decision functions	2015-02-27 16:06:02 -05:00
netrom	new helper: memcpy_from_msg()	2014-11-24 04:28:48 -05:00
nfc	NFC: nci: Move NFCEE discovery logic	2015-02-04 09:15:18 +01:00
openvswitch	openvswitch: Fix serialization of non-masked set actions.	2015-03-03 14:38:57 -05:00
packet	net: delete stale packet_mclist entries	2015-03-09 16:17:43 -04:00
phonet	phonet netlink: allow multiple messages per skb in route dump	2015-01-19 16:20:17 -05:00
rds	rds: rds_cong_queue_updates needs to defer the congestion update transmission	2015-02-11 14:35:44 -08:00
rfkill	Last round of updates for net-next:	2015-02-04 14:57:45 -08:00
rose	new helper: memcpy_from_msg()	2014-11-24 04:28:48 -05:00
rxrpc	ip: fix error queue empty skb handling	2015-03-08 23:01:54 -04:00
sched	net_sched: fix struct tc_u_hnode layout in u32	2015-03-09 23:44:31 -04:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-02-05 14:33:28 -08:00
sunrpc	sunrpc: fix braino in ->poll()	2015-03-08 12:53:46 -07:00
switchdev	Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild	2015-02-19 10:36:45 -08:00
tipc	tipc: fix bug in link failover handling	2015-03-09 16:20:41 -04:00
unix	net: remove sock_iocb	2015-01-28 23:15:07 -08:00
vmw_vsock	vmci: propagate msghdr all way down to __qp_memcpy_to_queue()	2015-02-04 01:34:14 -05:00
wimax	wimax: convert printk to pr_foo()	2014-10-07 20:28:44 -04:00
wireless	cfg80211: calls nl80211_exit on error	2015-02-24 11:41:21 +01:00
x25	new helper: memcpy_from_msg()	2014-11-24 04:28:48 -05:00
xfrm	netlink: make nlmsg_end() and genlmsg_end() void	2015-01-18 01:03:45 -05:00
compat.c	net: compat: Ignore MSG_CMSG_COMPAT in compat_sys_{send, recv}msg	2015-02-23 17:22:05 -05:00
Kconfig	kconfig: use bool instead of boolean for type definition attributes	2015-01-07 13:08:04 +01:00
Makefile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-12-16 15:53:03 -08:00
socket.c	net: switch sockets to ->read_iter/->write_iter	2015-02-04 01:34:15 -05:00
sysctl_net.c