Re: [PATCH nf v3] netfilter: bridge: ebt_among: add more missing match size checks

2018-03-08 Thread Florian Westphal
Eric Dumazet wrote: > > > On 03/08/2018 04:24 PM, Florian Westphal wrote: > >Eric Dumazet wrote: > >>>Fixes: c4585a2823edf ("bridge: ebt_among: add missing match size checks") > >>>Reported-by:

Re: [PATCH nf v3] netfilter: bridge: ebt_among: add more missing match size checks

2018-03-08 Thread Eric Dumazet
On 03/08/2018 04:24 PM, Florian Westphal wrote: Eric Dumazet wrote: Fixes: c4585a2823edf ("bridge: ebt_among: add missing match size checks") Reported-by: Signed-off-by: Florian Westphal ---

Re: [PATCH nf v3] netfilter: bridge: ebt_among: add more missing match size checks

2018-03-08 Thread Florian Westphal
Eric Dumazet wrote: > >Fixes: c4585a2823edf ("bridge: ebt_among: add missing match size checks") > >Reported-by: > >Signed-off-by: Florian Westphal > >--- > > net/bridge/netfilter/ebt_among.c | 35

[PATCH nf v3] netfilter: bridge: ebt_among: add more missing match size checks

2018-03-08 Thread Florian Westphal
ebt_among is special, it has a dynamic match size and is exempt from the central size checks. commit c4585a2823edf ("bridge: ebt_among: add missing match size checks") added validation for pool size, but missed fact that the macros ebt_among_wh_src/dst can already return out-of-bound result