MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-08 10:25:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: reject expiration higher than timeout

Browse Source 
[ Upstream commit c0f38a8c60 ]

Report ERANGE to userspace if user specifies an expiration larger than
the timeout.

Fixes: 8e1102d5a1 ("netfilter: nf_tables: support timeouts larger than 23 days")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso 2024-09-03 01:06:58 +02:00 committed by Greg Kroah-Hartman
parent 2a5e648a0c
commit 9431e5eddc
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/netfilter/nf_tables_api.c
View File

@ -6705,6 +6705,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
&expiration); &expiration);
if (err) if (err)
return err; return err;
if (expiration > timeout)
return -ERANGE;
} }
if (nla[NFTA_SET_ELEM_EXPR]) { if (nla[NFTA_SET_ELEM_EXPR]) {