[PATCH] netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel

[PATCH] netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel

[Hongxu Jia]

Since the following commit applied in kernel (https://git.kernel.org/cgit/
linux/kernel/git/torvalds/linux.git/commit/?id=09d9686047dbbe1cf4faa558d3ecc4aae2046054)
--------------------------------------
commit 09d9686047dbbe1cf4faa558d3ecc4aae2046054
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Apr 1 14:17:34 2016 +0200

    netfilter: x_tables: do compat validation via translate_table
--------------------------------------
It used compatr structure to assign newinfo structure.
In translate_compat_table of ip_tables.c and ip6_tables.c, it used
compatr->hook_entry to replace info->hook_entry and
compatr->underflow to replace info->underflow, but not do the same
replacement in arp_tables.c.

It caused invoking 32-bit "arptbale -P INPUT ACCEPT" failed in 64bit kernel.
--------------------------------------
root@qemux86-64:~# arptables -P INPUT ACCEPT
root@qemux86-64:~# arptables -P INPUT ACCEPT
ERROR: Policy for `INPUT' offset 448 != underflow 0
arptables: Incompatible with this kernel
--------------------------------------

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
 net/ipv4/netfilter/arp_tables.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index b31df59..6975384 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1201,8 +1201,8 @@ static int translate_compat_table(struct xt_table_info **pinfo,
 
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
-		newinfo->hook_entry[i] = info->hook_entry[i];
-		newinfo->underflow[i] = info->underflow[i];
+		newinfo->hook_entry[i] = compatr->hook_entry[i];
+		newinfo->underflow[i] = compatr->underflow[i];
 	}
 	entry1 = newinfo->entries;
 	pos = entry1;
-- 
2.8.1

Re: [PATCH] netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel

[Florian Westphal]

Hongxu Jia <hongxu.jia@windriver.com> wrote:
> Since the following commit applied in kernel (https://git.kernel.org/cgit/
> linux/kernel/git/torvalds/linux.git/commit/?id=09d9686047dbbe1cf4faa558d3ecc4aae2046054)
> --------------------------------------
> commit 09d9686047dbbe1cf4faa558d3ecc4aae2046054
> Author: Florian Westphal <fw@strlen.de>
> Date:   Fri Apr 1 14:17:34 2016 +0200
> 
>     netfilter: x_tables: do compat validation via translate_table
> --------------------------------------
> It used compatr structure to assign newinfo structure.
> In translate_compat_table of ip_tables.c and ip6_tables.c, it used
> compatr->hook_entry to replace info->hook_entry and
> compatr->underflow to replace info->underflow, but not do the same
> replacement in arp_tables.c.

Right, thanks for fixing this:

Acked-by: Florian Westphal <fw@strlen.de>

Re: [PATCH] netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel

[Pablo Neira Ayuso]

On Wed, Nov 30, 2016 at 12:53:07PM +0100, Florian Westphal wrote:
> Hongxu Jia <hongxu.jia@windriver.com> wrote:
> > Since the following commit applied in kernel (https://git.kernel.org/cgit/
> > linux/kernel/git/torvalds/linux.git/commit/?id=09d9686047dbbe1cf4faa558d3ecc4aae2046054)
> > --------------------------------------
> > commit 09d9686047dbbe1cf4faa558d3ecc4aae2046054
> > Author: Florian Westphal <fw@strlen.de>
> > Date:   Fri Apr 1 14:17:34 2016 +0200
> > 
> >     netfilter: x_tables: do compat validation via translate_table
> > --------------------------------------
> > It used compatr structure to assign newinfo structure.
> > In translate_compat_table of ip_tables.c and ip6_tables.c, it used
> > compatr->hook_entry to replace info->hook_entry and
> > compatr->underflow to replace info->underflow, but not do the same
> > replacement in arp_tables.c.
> 
> Right, thanks for fixing this:
> 
> Acked-by: Florian Westphal <fw@strlen.de>

Applied, thanks everyone.