tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: reject expiration higher than timeout

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2089340

[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]

Report ERANGE to userspace if user specifies an expiration larger than
the timeout.

Fixes: 8e1102d5a1 ("netfilter: nf_tables: support timeouts larger than 23 days")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Portia Stephens <portia.stephens@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
This commit is contained in:
Pablo Neira Ayuso
2024-09-03 01:06:58 +02:00
committed by Mehmet Basaran
parent bbd5eaf55f
commit ff59274de4
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/netfilter/nf_tables_api.c
+3
View File
@@ -6877,6 +6877,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
&expiration);
if (err)
return err;
if (expiration > timeout)
return -ERANGE;
}
if (nla[NFTA_SET_ELEM_EXPR]) {