Loading net/bridge/netfilter/ebtables.c +21 −12 Original line number Original line Diff line number Diff line Loading @@ -1156,38 +1156,47 @@ int ebt_register_table(struct ebt_table *table) { { struct ebt_table_info *newinfo; struct ebt_table_info *newinfo; struct ebt_table *t; struct ebt_table *t; struct ebt_replace *repl; int ret, i, countersize; int ret, i, countersize; void *p; if (!table || !table->table ||!table->table->entries || if (!table || !(repl = table->table) || !repl->entries || table->table->entries_size == 0 || repl->entries_size == 0 || table->table->counters || table->private) { repl->counters || table->private) { BUGPRINT("Bad table data for ebt_register_table!!!\n"); BUGPRINT("Bad table data for ebt_register_table!!!\n"); return -EINVAL; return -EINVAL; } } countersize = COUNTER_OFFSET(table->table->nentries) * countersize = COUNTER_OFFSET(repl->nentries) * (highest_possible_processor_id()+1); (highest_possible_processor_id()+1); newinfo = vmalloc(sizeof(*newinfo) + countersize); newinfo = vmalloc(sizeof(*newinfo) + countersize); ret = -ENOMEM; ret = -ENOMEM; if (!newinfo) if (!newinfo) return -ENOMEM; return -ENOMEM; newinfo->entries = vmalloc(table->table->entries_size); p = vmalloc(repl->entries_size); if (!(newinfo->entries)) if (!p) goto free_newinfo; goto free_newinfo; memcpy(newinfo->entries, table->table->entries, memcpy(p, repl->entries, repl->entries_size); table->table->entries_size); newinfo->entries = p; newinfo->entries_size = repl->entries_size; newinfo->nentries = repl->nentries; if (countersize) if (countersize) memset(newinfo->counters, 0, countersize); memset(newinfo->counters, 0, countersize); /* fill in newinfo and parse the entries */ /* fill in newinfo and parse the entries */ newinfo->chainstack = NULL; newinfo->chainstack = NULL; ret = ebt_verify_pointers(table->table, newinfo); for (i = 0; i < NF_BR_NUMHOOKS; i++) { if (ret != 0) if ((repl->valid_hooks & (1 << i)) == 0) goto free_chainstack; newinfo->hook_entry[i] = NULL; ret = translate_table(table->table->name, newinfo); else newinfo->hook_entry[i] = p + ((char *)repl->hook_entry[i] - repl->entries); } ret = translate_table(repl->name, newinfo); if (ret != 0) { if (ret != 0) { BUGPRINT("Translate_table failed\n"); BUGPRINT("Translate_table failed\n"); goto free_chainstack; goto free_chainstack; Loading Loading
net/bridge/netfilter/ebtables.c +21 −12 Original line number Original line Diff line number Diff line Loading @@ -1156,38 +1156,47 @@ int ebt_register_table(struct ebt_table *table) { { struct ebt_table_info *newinfo; struct ebt_table_info *newinfo; struct ebt_table *t; struct ebt_table *t; struct ebt_replace *repl; int ret, i, countersize; int ret, i, countersize; void *p; if (!table || !table->table ||!table->table->entries || if (!table || !(repl = table->table) || !repl->entries || table->table->entries_size == 0 || repl->entries_size == 0 || table->table->counters || table->private) { repl->counters || table->private) { BUGPRINT("Bad table data for ebt_register_table!!!\n"); BUGPRINT("Bad table data for ebt_register_table!!!\n"); return -EINVAL; return -EINVAL; } } countersize = COUNTER_OFFSET(table->table->nentries) * countersize = COUNTER_OFFSET(repl->nentries) * (highest_possible_processor_id()+1); (highest_possible_processor_id()+1); newinfo = vmalloc(sizeof(*newinfo) + countersize); newinfo = vmalloc(sizeof(*newinfo) + countersize); ret = -ENOMEM; ret = -ENOMEM; if (!newinfo) if (!newinfo) return -ENOMEM; return -ENOMEM; newinfo->entries = vmalloc(table->table->entries_size); p = vmalloc(repl->entries_size); if (!(newinfo->entries)) if (!p) goto free_newinfo; goto free_newinfo; memcpy(newinfo->entries, table->table->entries, memcpy(p, repl->entries, repl->entries_size); table->table->entries_size); newinfo->entries = p; newinfo->entries_size = repl->entries_size; newinfo->nentries = repl->nentries; if (countersize) if (countersize) memset(newinfo->counters, 0, countersize); memset(newinfo->counters, 0, countersize); /* fill in newinfo and parse the entries */ /* fill in newinfo and parse the entries */ newinfo->chainstack = NULL; newinfo->chainstack = NULL; ret = ebt_verify_pointers(table->table, newinfo); for (i = 0; i < NF_BR_NUMHOOKS; i++) { if (ret != 0) if ((repl->valid_hooks & (1 << i)) == 0) goto free_chainstack; newinfo->hook_entry[i] = NULL; ret = translate_table(table->table->name, newinfo); else newinfo->hook_entry[i] = p + ((char *)repl->hook_entry[i] - repl->entries); } ret = translate_table(repl->name, newinfo); if (ret != 0) { if (ret != 0) { BUGPRINT("Translate_table failed\n"); BUGPRINT("Translate_table failed\n"); goto free_chainstack; goto free_chainstack; Loading