Commit 2035f3ff authored Jan 21, 2019 by Florian Westphal Committed by Pablo Neira Ayuso Jan 28, 2019

netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present



Unlike ip(6)tables ebtables only counts user-defined chains.

The effect is that a 32bit ebtables binary on a 64bit kernel can do
'ebtables -N FOO' only after adding at least one rule, else the request
fails with -EINVAL.

This is a similar fix as done in
3f1e53ab ("netfilter: ebtables: don't attempt to allocate 0-sized compat array").

Fixes: 7d7d7e02 ("netfilter: compat: reject huge allocation requests")
Reported-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 53ab60ba

net/bridge/netfilter/ebtables.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net net, void __user user,

		xt_compat_lock(NFPROTO_BRIDGE);

		if (tmp.nentries) {
		ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
		if (ret < 0)
		goto out_unlock;
		}

		ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
		if (ret < 0)
		goto out_unlock;