Hi Pablo,
While checking netfilter backports to the stable series, I noticed that 6e1acfa387b9 ("netfilter: nf_tables: validate registers coming from userspace.") was backported in various series for stable, and included in 4.14.316, 4.19.284, 5.4.244, 5.15.32, 5.16.18, 5.17.1, where the original fix was in 5.18-rc1.
While the commit has
Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing")
the 6e1acfa387b9 change got not backported to the 5.10.y series.
The backports to the other series are
https://lore.kernel.org/stable/20230516151606.4892-1-pablo@netfilter.org/ https://lore.kernel.org/stable/20230516150613.4566-1-pablo@netfilter.org/ https://lore.kernel.org/stable/20230516144435.4010-1-pablo@netfilter.org/
Pablo, was this an oversight and can the change as well be applied to 5.10.y?
From looking at the 5.4.y series, from the stable dependencies, 08a01c11a5bb ("netfilter: nftables: statify nft_parse_register()") is missing in 5.10.y, then 6e1acfa387b9 ("netfilter: nf_tables: validate registers coming from userspace.") can be applied (almost, the comment needs to be dropped, as done in the backports).
I'm right now not understanding what I'm missing that it was for 5.4.y but not 5.10.y after the report of the failed apply by Greg.
At least the two attached bring 5.10.y inline with 5.4.y up to 4) from https://lore.kernel.org/stable/20230516144435.4010-1-pablo@netfilter.org/ but I'm unsure if you want/need as well the remaining 5), 6), 7), 8) and 9).
Regards, Salvatore