diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-06-10 10:53:01 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-06-16 13:07:44 +0200 |
| commit | a0a7379e16b6e4c229d082f24c7e3ef9e812ed46 (patch) | |
| tree | 5a7dc2ef6db3db90ae1a6807ebbaa6b9bdb627aa /net | |
| parent | 5bc5c307653cbf8fe9da6cbd8ae6c6bd5b86ff4b (diff) | |
| download | linux-a0a7379e16b6e4c229d082f24c7e3ef9e812ed46.tar.gz linux-a0a7379e16b6e4c229d082f24c7e3ef9e812ed46.tar.bz2 linux-a0a7379e16b6e4c229d082f24c7e3ef9e812ed46.zip | |
netfilter: nf_tables: use u32 for chain use counter
Since 4fefee5 ("netfilter: nf_tables: allow to delete several objects
from a batch"), every new rule bumps the chain use counter. However,
this is limited to 16 bits, which means that it will overrun after
2^16 rules.
Use a u32 chain counter and check for overflows (just like we do for
table objects).
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index ba37c10e5139..5586426a6169 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1730,6 +1730,9 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb, if (!create || nlh->nlmsg_flags & NLM_F_REPLACE) return -EINVAL; handle = nf_tables_alloc_handle(table); + + if (chain->use == UINT_MAX) + return -EOVERFLOW; } if (nla[NFTA_RULE_POSITION]) { |