mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 01:41:39 +00:00
netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present
Unlike ip(6)tables ebtables only counts user-defined chains. The effect is that a 32bit ebtables binary on a 64bit kernel can do 'ebtables -N FOO' only after adding at least one rule, else the request fails with -EINVAL. This is a similar fix as done in3f1e53abff
("netfilter: ebtables: don't attempt to allocate 0-sized compat array"). Fixes:7d7d7e0211
("netfilter: compat: reject huge allocation requests") Reported-by: Francesco Ruggeri <fruggeri@arista.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
53ab60baa1
commit
2035f3ff8e
1 changed files with 6 additions and 3 deletions
|
@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,
|
||||||
|
|
||||||
xt_compat_lock(NFPROTO_BRIDGE);
|
xt_compat_lock(NFPROTO_BRIDGE);
|
||||||
|
|
||||||
ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
|
if (tmp.nentries) {
|
||||||
if (ret < 0)
|
ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
|
||||||
goto out_unlock;
|
if (ret < 0)
|
||||||
|
goto out_unlock;
|
||||||
|
}
|
||||||
|
|
||||||
ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
|
ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
|
||||||
if (ret < 0)
|
if (ret < 0)
|
||||||
goto out_unlock;
|
goto out_unlock;
|
||||||
|
|
Loading…
Reference in a new issue