* [PATCH] netfiler: compat out of scope fix
@ 2010-02-05 22:17 Alexey Dobriyan
2010-02-08 14:45 ` Patrick McHardy
0 siblings, 1 reply; 2+ messages in thread
From: Alexey Dobriyan @ 2010-02-05 22:17 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel, viro
As per 6.2.4(2) when temporary table data goes out of scope,
the behaviour is undefined:
if (compat) {
struct foo tmp;
...
private = &tmp;
}
[dereference private]
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: stable@kernel.org
---
net/ipv4/netfilter/arp_tables.c | 4 ++--
net/ipv4/netfilter/ip_tables.c | 4 ++--
net/ipv6/netfilter/ip6_tables.c | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -925,10 +925,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
if (t && !IS_ERR(t)) {
struct arpt_getinfo info;
const struct xt_table_info *private = t->private;
-
#ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
if (compat) {
- struct xt_table_info tmp;
ret = compat_table_info(private, &tmp);
xt_compat_flush_offsets(NFPROTO_ARP);
private = &tmp;
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1137,10 +1137,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
if (t && !IS_ERR(t)) {
struct ipt_getinfo info;
const struct xt_table_info *private = t->private;
-
#ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
if (compat) {
- struct xt_table_info tmp;
ret = compat_table_info(private, &tmp);
xt_compat_flush_offsets(AF_INET);
private = &tmp;
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1169,10 +1169,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
if (t && !IS_ERR(t)) {
struct ip6t_getinfo info;
const struct xt_table_info *private = t->private;
-
#ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
if (compat) {
- struct xt_table_info tmp;
ret = compat_table_info(private, &tmp);
xt_compat_flush_offsets(AF_INET6);
private = &tmp;
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] netfiler: compat out of scope fix
2010-02-05 22:17 [PATCH] netfiler: compat out of scope fix Alexey Dobriyan
@ 2010-02-08 14:45 ` Patrick McHardy
0 siblings, 0 replies; 2+ messages in thread
From: Patrick McHardy @ 2010-02-08 14:45 UTC (permalink / raw)
To: Alexey Dobriyan; +Cc: netfilter-devel, viro
Alexey Dobriyan wrote:
> As per 6.2.4(2) when temporary table data goes out of scope,
> the behaviour is undefined:
>
> if (compat) {
> struct foo tmp;
> ...
> private = &tmp;
> }
> [dereference private]
I fixed the changelog to explicitly refer to C99 and applied
your patch, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-02-08 14:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-02-05 22:17 [PATCH] netfiler: compat out of scope fix Alexey Dobriyan
2010-02-08 14:45 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).