Hi Greg, Sasha,
This is second round of -stable backport fixes for 4.14. This batch includes dependency patches which are not currently in the 4.14 branch.
The following list shows the backported patches, I am using original commit IDs for reference:
1) 08a01c11a5bb ("netfilter: nftables: statify nft_parse_register()")
2) 6e1acfa387b9 ("netfilter: nf_tables: validate registers coming from userspace.")
3) 20a1452c3542 ("netfilter: nf_tables: add nft_setelem_parse_key()")
4) fdb9c405e35b ("netfilter: nf_tables: allow up to 64 bytes in the set element data area")
5) 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data")
6) 215a31f19ded ("netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL")
7) 36d5b2913219 ("netfilter: nf_tables: do not allow RULE_ID to refer to another chain")
8) 470ee20e069a ("netfilter: nf_tables: do not allow SET_ID to refer to another table")
Patches #1, #3 and #4 are dependencies.
Please, apply. Thanks.
Pablo Neira Ayuso (8): netfilter: nftables: statify nft_parse_register() netfilter: nf_tables: validate registers coming from userspace. netfilter: nf_tables: add nft_setelem_parse_key() netfilter: nf_tables: allow up to 64 bytes in the set element data area netfilter: nf_tables: stricter validation of element data netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: do not allow SET_ID to refer to another table
include/net/netfilter/nf_tables.h | 7 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- net/netfilter/nf_tables_api.c | 157 ++++++++++++++--------- net/netfilter/nft_dynset.c | 4 +- 4 files changed, 104 insertions(+), 66 deletions(-)