iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: ebtables: don't attempt to allocate 0-sized compat array

Browse Source 
commit 3f1e53abff84cf40b1adb3455d480dd295bf42e8 upstream.

Dmitry reports 32bit ebtables on 64bit kernel got broken by
a recent change that returns -EINVAL when ruleset has no entries.

ebtables however only counts user-defined chains, so for the
initial table nentries will be 0.

Don't try to allocate the compat array in this case, as no user
defined rules exist no rule will need 64bit translation.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: 7d7d7e02111e9 ("netfilter: compat: reject huge allocation requests")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Florian Westphal 2018-04-04 21:13:30 +02:00 committed by Greg Kroah-Hartman
parent 88c43b469d
commit 725f5ae1a6
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
net/bridge/netfilter/ebtables.c
View File

@ -1819,13 +1819,14 @@ static int compat_table_info(const struct ebt_table_info *info,
{
unsigned int size = info->entries_size;
const void *entries = info->entries;
int ret;
newinfo->entries_size = size;
ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
if (ret)
return ret;
if (info->nentries) {
int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
info->nentries);
if (ret)
return ret;
}
return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
entries, newinfo);