shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nf_tables: reject expiration higher than timeout

Browse Source 
[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]

Report ERANGE to userspace if user specifies an expiration larger than
the timeout.

Fixes: 8e1102d5a1 ("netfilter: nf_tables: support timeouts larger than 23 days")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso
2024-09-03 01:06:58 +02:00
committed by Greg Kroah-Hartman
parent d7b8d3d4a7
commit 10329d3434
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/netfilter/nf_tables_api.c
View File

@@ -6418,6 +6418,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
&expiration); &expiration);
if (err) if (err)
return err; return err;
if (expiration > timeout)
return -ERANGE;
} }
if (nla[NFTA_SET_ELEM_EXPR]) { if (nla[NFTA_SET_ELEM_EXPR]) {