lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 016/410] netfilter: ebtables: fix erroneous reject of last rule
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Westphal <fw@strlen.de>

    commit 932909d9b28d27e807ff8eecb68c7748f6701628 upstream.

    The last rule in the blob has next_entry offset that is same as total size.
    This made "ebtables32 -A OUTPUT -d de:ad:be:ef:01:02" fail on 64 bit kernel.

    Fixes: b71812168571fa ("netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/bridge/netfilter/ebtables.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    --- a/net/bridge/netfilter/ebtables.c
    +++ b/net/bridge/netfilter/ebtables.c
    @@ -2070,8 +2070,12 @@ static int size_entry_mwt(struct ebt_ent
    * offsets are relative to beginning of struct ebt_entry (i.e., 0).
    */
    for (i = 0; i < 4 ; ++i) {
    - if (offsets[i] >= *total)
    + if (offsets[i] > *total)
    return -EINVAL;
    +
    + if (i < 3 && offsets[i] == *total)
    + return -EINVAL;
    +
    if (i == 0)
    continue;
    if (offsets[i-1] > offsets[i])
    \
     
     \ /
      Last update: 2018-06-07 18:16    [W:4.767 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site