Skip to content

Commit

Permalink
netfilter: CONFIG_COMPAT: allow delta to exceed 32767
Browse files Browse the repository at this point in the history
with 32 bit userland and 64 bit kernels, it is unlikely but possible
that insertion of new rules fails even tough there are only about 2000
iptables rules.

This happens because the compat delta is using a short int.
Easily reproducible via "iptables -m limit" ; after about 2050
rules inserting new ones fails with -ELOOP.

Note that compat_delta included 2 bytes of padding on x86_64, so
structure size remains the same.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
  • Loading branch information
Florian Westphal authored and Patrick McHardy committed Feb 15, 2010
1 parent fc0e3df commit 3e5e524
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
2 changes: 1 addition & 1 deletion include/linux/netfilter/x_tables.h
Original file line number Diff line number Diff line change
Expand Up @@ -588,7 +588,7 @@ extern void xt_compat_unlock(u_int8_t af);

extern int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta);
extern void xt_compat_flush_offsets(u_int8_t af);
extern short xt_compat_calc_jump(u_int8_t af, unsigned int offset);
extern int xt_compat_calc_jump(u_int8_t af, unsigned int offset);

extern int xt_compat_match_offset(const struct xt_match *match);
extern int xt_compat_match_from_user(struct xt_entry_match *m,
Expand Down
6 changes: 3 additions & 3 deletions net/netfilter/x_tables.c
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
struct compat_delta {
struct compat_delta *next;
unsigned int offset;
short delta;
int delta;
};

struct xt_af {
Expand Down Expand Up @@ -439,10 +439,10 @@ void xt_compat_flush_offsets(u_int8_t af)
}
EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);

short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
{
struct compat_delta *tmp;
short delta;
int delta;

for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)
if (tmp->offset < offset)
Expand Down

0 comments on commit 3e5e524

Please sign in to comment.