Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4c4ed074 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix wrong length for jump/goto verdicts 



NFT_JUMP/GOTO erronously sets length to sizeof(void *).

We then allocate insufficient memory when such element is added to a vmap.

Suggested-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b357a364

net/netfilter/nf_tables_api.c

+1 −2
Original line number Diff line number Diff line
@@ -4340,7 +4340,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 
	case NFT_CONTINUE:

	case NFT_BREAK:

	case NFT_RETURN:

		desc->len = sizeof(data->verdict);

		break;

	case NFT_JUMP:

	case NFT_GOTO:
@@ -4355,10 +4354,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 


		chain->use++;

		data->verdict.chain = chain;

		desc->len = sizeof(data);

		break;

	}



	desc->len = sizeof(data->verdict);

	desc->type = NFT_DATA_VERDICT;

	return 0;

}