Commit 3f1e53ab authored Apr 04, 2018 by Florian Westphal Committed by Pablo Neira Ayuso Apr 09, 2018

netfilter: ebtables: don't attempt to allocate 0-sized compat array



Dmitry reports 32bit ebtables on 64bit kernel got broken by
a recent change that returns -EINVAL when ruleset has no entries.

ebtables however only counts user-defined chains, so for the
initial table nentries will be 0.

Don't try to allocate the compat array in this case, as no user
defined rules exist no rule will need 64bit translation.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: 7d7d7e02 ("netfilter: compat: reject huge allocation requests")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 5c64576a

net/bridge/netfilter/ebtables.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -1825,13 +1825,14 @@ static int compat_table_info(const struct ebt_table_info *info,
		{
		unsigned int size = info->entries_size;
		const void *entries = info->entries;
		int ret;

		newinfo->entries_size = size;

		ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
		if (info->nentries) {
		int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
		info->nentries);
		if (ret)
		return ret;
		}

		return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
		entries, newinfo);