diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-02-21 14:01:05 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-02-21 14:01:05 +0100 |
| commit | 3ef767e5cbd405abfd01339c7e5daaf98e037be2 (patch) | |
| tree | 4924c8ecac2f2e70087b2db97fe2f47617b37ddc /net/netfilter | |
| parent | 4eba8b78e1390f46828e00d6fa4d651c3d219894 (diff) | |
| parent | 40b446a1d8af17274746ff7079aa0a618dffbac3 (diff) | |
| download | linux-3ef767e5cbd405abfd01339c7e5daaf98e037be2.tar.gz linux-3ef767e5cbd405abfd01339c7e5daaf98e037be2.tar.bz2 linux-3ef767e5cbd405abfd01339c7e5daaf98e037be2.zip | |
Merge branch 'master' of git://blackhole.kfki.hu/nf
Jozsef Kadlecsik says:
====================
ipset patches for nf
Please apply the next patches for ipset in your nf branch.
Both patches should go into the stable kernel branches as well,
because these are important bugfixes:
* Sometimes valid entries in hash:* types of sets were evicted
due to a typo in an index. The wrong evictions happen when
entries are deleted from the set and the bucket is shrinked.
Bug was reported by Eric Ewanco and the patch fixes
netfilter bugzilla id #1119.
* Fixing of a null pointer exception when someone wants to add an
entry to an empty list type of set and specifies an add before/after
option. The fix is from Vishwanath Pai.
====================
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/ipset/ip_set_hash_gen.h | 2 | ||||
| -rw-r--r-- | net/netfilter/ipset/ip_set_list_set.c | 9 |
2 files changed, 7 insertions, 4 deletions
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 1b05d4a7d5a1..f236c0bc7b3f 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -897,7 +897,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, continue; data = ahash_data(n, j, dsize); memcpy(tmp->value + k * dsize, data, dsize); - set_bit(j, tmp->used); + set_bit(k, tmp->used); k++; } tmp->pos = k; diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c index 51077c53d76b..178d4eba013b 100644 --- a/net/netfilter/ipset/ip_set_list_set.c +++ b/net/netfilter/ipset/ip_set_list_set.c @@ -260,11 +260,14 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, else prev = e; } + + /* If before/after is used on an empty set */ + if ((d->before > 0 && !next) || + (d->before < 0 && !prev)) + return -IPSET_ERR_REF_EXIST; + /* Re-add already existing element */ if (n) { - if ((d->before > 0 && !next) || - (d->before < 0 && !prev)) - return -IPSET_ERR_REF_EXIST; if (!flag_exist) return -IPSET_ERR_EXIST; /* Update extensions */ |