Three late fixes for netfilter:
1) If nf_queue user requests packet truncation below size of l3 header,
we corrupt the skb, then crash. Reject such requests.
2) add cond_resched() calls when doing cycle detection in the
nf_tables graph. This avoids softlockup warning with certain
rulesets.
3) Reject rulesets that use nftables 'queue' expression in family/chain
combinations other than those that are supported. Currently the ruleset
will load, but when userspace attempts to reinject you get WARN splat +
packet drops.
The following changes since commit 9b134b1694ec8926926ba6b7b80884ea829245a0:
bridge: Do not send empty IFLA_AF_SPEC attribute (2022-07-26 15:35:53 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
for you to fetch changes up to 47f4f510ad586032b85c89a0773fbb011d412425:
netfilter: nft_queue: only allow supported familes and hooks (2022-07-26 21:12:42 +0200)
----------------------------------------------------------------
Florian Westphal (3):
netfilter: nf_queue: do not allow packet truncation below transport header offset
netfilter: nf_tables: add rescheduling points during loop detection walks
netfilter: nft_queue: only allow supported familes and hooks
net/netfilter/nf_tables_api.c | 6 ++++++
net/netfilter/nfnetlink_queue.c | 7 ++++++-
net/netfilter/nft_queue.c | 27 +++++++++++++++++++++++++++
3 files changed, 39 insertions(+), 1 deletion(-)