* [PATCH] netfilter updates for net (3.7-rc7)
@ 2012-11-27 1:03 pablo
2012-11-27 1:03 ` [PATCH] netfilter: ipset: fix netiface set name overflow pablo
2012-11-28 16:30 ` [PATCH] netfilter updates for net (3.7-rc7) David Miller
0 siblings, 2 replies; 3+ messages in thread
From: pablo @ 2012-11-27 1:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Hi David,
This update contains one patch to fix an overflow via the interface
name attribute in the ipset infrastructure, from Florian Westphal.
You can pull this change from:
git://1984.lsi.us.es/nf master
Thanks!
Florian Westphal (1):
netfilter: ipset: fix netiface set name overflow
net/netfilter/ipset/ip_set_hash_netiface.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
1.7.10.4
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] netfilter: ipset: fix netiface set name overflow
2012-11-27 1:03 [PATCH] netfilter updates for net (3.7-rc7) pablo
@ 2012-11-27 1:03 ` pablo
2012-11-28 16:30 ` [PATCH] netfilter updates for net (3.7-rc7) David Miller
1 sibling, 0 replies; 3+ messages in thread
From: pablo @ 2012-11-27 1:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
attribute is copied to IFNAMSIZ-size stack variable,
but IFNAMSIZ is smaller than IPSET_MAXNAMELEN.
Fortunately nfnetlink needs CAP_NET_ADMIN.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipset/ip_set_hash_netiface.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index b9a6338..45a1014 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -793,7 +793,7 @@ static struct ip_set_type hash_netiface_type __read_mostly = {
[IPSET_ATTR_IP] = { .type = NLA_NESTED },
[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
[IPSET_ATTR_IFACE] = { .type = NLA_NUL_STRING,
- .len = IPSET_MAXNAMELEN - 1 },
+ .len = IFNAMSIZ - 1 },
[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] netfilter updates for net (3.7-rc7)
2012-11-27 1:03 [PATCH] netfilter updates for net (3.7-rc7) pablo
2012-11-27 1:03 ` [PATCH] netfilter: ipset: fix netiface set name overflow pablo
@ 2012-11-28 16:30 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2012-11-28 16:30 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: pablo@netfilter.org
Date: Tue, 27 Nov 2012 02:03:04 +0100
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> Hi David,
>
> This update contains one patch to fix an overflow via the interface
> name attribute in the ipset infrastructure, from Florian Westphal.
>
> You can pull this change from:
>
> git://1984.lsi.us.es/nf master
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-11-28 16:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-11-27 1:03 [PATCH] netfilter updates for net (3.7-rc7) pablo
2012-11-27 1:03 ` [PATCH] netfilter: ipset: fix netiface set name overflow pablo
2012-11-28 16:30 ` [PATCH] netfilter updates for net (3.7-rc7) David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).