netfilter: nfnetlink_cthelper: unbreak userspace helper support

commit 703acd70f2496537457186211c2f03e792409e68 upstream.

Restore helper data size initialization and fix memcopy of the helper
data size.

Fixes: 157ffffeb5dc ("netfilter: nfnetlink_cthelper: reject too large userspace allocation requests")
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 66154dafa305bae9c25b517b6a9524408dd031a3..ddcb1b60747450f46b2e4d80f56512c0f8ab7feb 100644 (file)
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -106,7 +106,7 @@ nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
        if (help->helper->data_len == 0)
                return -EINVAL;
 
-       nla_memcpy(help->data, nla_data(attr), sizeof(help->data));
+       nla_memcpy(help->data, attr, sizeof(help->data));
        return 0;
 }
 
@@ -242,6 +242,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                ret = -ENOMEM;
                goto err2;
        }
+       helper->data_len = size;
 
        helper->flags |= NF_CT_HELPER_F_USERSPACE;
        memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));