nf_flow_offload_rule_alloc() allocates space for NF_FLOW_RULE_ACTION_MAX entries. Make sure userspace passes more entries to us. Reported-by: Hyunwoo Kim Signed-off-by: Florian Westphal --- Can also route via nf-next if thats deemed the better tree. include/net/netfilter/nf_flow_table.h | 2 ++ net/netfilter/nf_flow_table_offload.c | 2 -- net/netfilter/nf_tables_offload.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index b09c11c048d5..0b2fb1467b3f 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -13,6 +13,8 @@ #include #include +#define NF_FLOW_RULE_ACTION_MAX 16 + struct nf_flowtable; struct nf_flow_rule; struct flow_offload; diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 9b677e116487..11463682bbfa 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -727,8 +727,6 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow, } EXPORT_SYMBOL_GPL(nf_flow_rule_route_ipv6); -#define NF_FLOW_RULE_ACTION_MAX 16 - static struct nf_flow_rule * nf_flow_offload_rule_alloc(struct net *net, const struct flow_offload_work *offload, diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c index 9101b1703b52..a2f7966bc201 100644 --- a/net/netfilter/nf_tables_offload.c +++ b/net/netfilter/nf_tables_offload.c @@ -88,10 +88,11 @@ static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx, struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rule *rule) { + unsigned int num_actions = 0; struct nft_offload_ctx *ctx; struct nft_flow_rule *flow; - int num_actions = 0, err; struct nft_expr *expr; + int err; expr = nft_expr_first(rule); while (nft_expr_more(rule, expr)) { @@ -102,7 +103,7 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, expr = nft_expr_next(expr); } - if (num_actions == 0) + if (num_actions == 0 || num_actions > NF_FLOW_RULE_ACTION_MAX) return ERR_PTR(-EOPNOTSUPP); flow = nft_flow_rule_alloc(num_actions); -- 2.52.0