Messages in this thread Patch in this message | | | Date | Tue, 26 Dec 2006 12:54:22 -0500 | From | Chuck Ebbert <> | Subject | [patch] ebtables: don't compute gap before checking struct type |
| |
We cannot compute the gap until we know we have a 'struct ebt_entry' and not 'struct ebt_entries'. Failure to check can cause crash.
Tested by Santiago Garcia Mantinan <manty@manty.net>
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com> --- Can we get this upstream quickly? The bug's also in 2.6.19.1 and 2.6.18.6.
--- 2.6.20-rc1-32smp.orig/net/bridge/netfilter/ebtables.c +++ 2.6.20-rc1-32smp/net/bridge/netfilter/ebtables.c @@ -610,7 +610,7 @@ ebt_check_entry(struct ebt_entry *e, str struct ebt_entry_target *t; struct ebt_target *target; unsigned int i, j, hook = 0, hookmask = 0; - size_t gap = e->next_offset - e->target_offset; + size_t gap; int ret; /* don't mess with the struct ebt_entries */ @@ -660,6 +660,7 @@ ebt_check_entry(struct ebt_entry *e, str if (ret != 0) goto cleanup_watchers; t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); + gap = e->next_offset - e->target_offset; target = find_target_lock(t->u.name, &ret, &ebt_mutex); if (!target) goto cleanup_watchers; -- MBTI: IXTP - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |