From mboxrd@z Thu Jan 1 00:00:00 1970 From: Changli Gao Subject: Re: [PATCH] netfilter: guard the size of the nf_ct_ext Date: Mon, 15 Nov 2010 19:35:33 +0800 Message-ID: References: <1289801749-8993-1-git-send-email-xiaosuo@gmail.com> <4CE1150D.1080302@trash.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Cc: "David S. Miller" , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org To: Patrick McHardy Return-path: Received: from mail-fx0-f46.google.com ([209.85.161.46]:47498 "EHLO mail-fx0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752182Ab0KOLfz (ORCPT ); Mon, 15 Nov 2010 06:35:55 -0500 In-Reply-To: <4CE1150D.1080302@trash.net> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Mon, Nov 15, 2010 at 7:10 PM, Patrick McHardy wrote: > On 15.11.2010 07:15, Changli Gao wrote: >> We'd better guard the size of the nf_ct_ext, as the nf_ct_ext.len is u8. >> If the size is bigger than 255, a warning will be printed. > > Why are you checking this in basically every possible spot? > Just checking once during registration (assuming the worst > case of a conntrack using every possible extension) should > be enough. > Yes. It is enough, if we check every patch carefully. Thanks. -- Regards, Changli Gao(xiaosuo@gmail.com)