commit e70fb3eff0e2776c6bf9d9600f5868a548882ad8
author Pablo Neira Ayuso <pablo@netfilter.org> Sun May 24 21:04:42 2020 +0200
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> Wed Jun 03 08:19:47 2020 +0200
tree 92f3fa5c49e0d9d152e6a16b560f894abdf6ee2a
parent 37bc21bb264b50e2b88c642151979eb6b1ab2620

netfilter: nfnetlink_cthelper: unbreak userspace helper support

commit 703acd70f2496537457186211c2f03e792409e68 upstream.

Restore helper data size initialization and fix memcopy of the helper
data size.

Fixes: 157ffffeb5dc ("netfilter: nfnetlink_cthelper: reject too large userspace allocation requests")
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net/netfilter/nfnetlink_cthelper.c

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 66154da..ddcb1b6 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -106,7 +106,7 @@
 	if (help->helper->data_len == 0)
 		return -EINVAL;
 
-	nla_memcpy(help->data, nla_data(attr), sizeof(help->data));
+	nla_memcpy(help->data, attr, sizeof(help->data));
 	return 0;
 }
 
@@ -242,6 +242,7 @@
 		ret = -ENOMEM;
 		goto err2;
 	}
+	helper->data_len = size;
 
 	helper->flags |= NF_CT_HELPER_F_USERSPACE;
 	memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));