Florian Westphal 766a7ad663 netfilter: ebtables: reject non-bridge targets ... commit 11ff7288be upstream. the ebtables evaluation loop expects targets to return positive values (jumps), or negative values (absolute verdicts). This is completely different from what xtables does. In xtables, targets are expected to return the standard netfilter verdicts, i.e. NF_DROP, NF_ACCEPT, etc. ebtables will consider these as jumps. Therefore reject any target found due to unspec fallback. v2: also reject watchers. ebtables ignores their return value, so a target that assumes skb ownership (and returns NF_STOLEN) causes use-after-free. The only watchers in the 'ebtables' front-end are log and nflog; both have AF_BRIDGE specific wrappers on kernel side. Reported-by: syzbot+2b43f681169a2a0d306a@syzkaller.appspotmail.com Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-07-22 14:28:49 +02:00
..
netfilter
br.c
br_device.c
br_fdb.c
br_forward.c
br_if.c
br_input.c
br_ioctl.c
br_mdb.c
br_multicast.c
br_netfilter_hooks.c
br_netfilter_ipv6.c
br_netlink.c
br_netlink_tunnel.c
br_nf_core.c
br_private.h
br_private_stp.h
br_private_tunnel.h
br_stp.c
br_stp_bpdu.c
br_stp_if.c
br_stp_timer.c
br_switchdev.c
br_sysfs_br.c
br_sysfs_if.c
br_vlan.c
br_vlan_tunnel.c
Kconfig
Makefile