diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-09-15 21:29:08 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-09-23 09:30:16 +0200 |
| commit | 8dc3c2b86bb16e8f345b80a8af69696e9a7edb65 (patch) | |
| tree | 7291fd6d6e0cac21b234a579e593e2059d83bd10 /net | |
| parent | 2462f3f4a7e079192b78f36900c34f18dad824a7 (diff) | |
| download | linux-stable-8dc3c2b86bb16e8f345b80a8af69696e9a7edb65.tar.gz linux-stable-8dc3c2b86bb16e8f345b80a8af69696e9a7edb65.tar.bz2 linux-stable-8dc3c2b86bb16e8f345b80a8af69696e9a7edb65.zip | |
netfilter: nf_tables: improve nft payload fast eval
There's an off-by-one issue in nft_payload_fast_eval, skb_tail_pointer
and ptr + priv->len all point to the last valid address plus 1. So if
they are equal, we can still fetch the valid data. It's unnecessary to
fall back to nft_payload_eval.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index fb8b5892b5ff..36ba4e55d84e 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -98,7 +98,7 @@ static bool nft_payload_fast_eval(const struct nft_expr *expr, ptr += priv->offset; - if (unlikely(ptr + priv->len >= skb_tail_pointer(skb))) + if (unlikely(ptr + priv->len > skb_tail_pointer(skb))) return false; *dest = 0; |