* [PATCH][RESEND] netfilter: fix CONFIG_COMPAT support
@ 2010-08-23 12:56 Florian Westphal
2010-08-23 21:41 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Florian Westphal @ 2010-08-23 12:56 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev, Florian Westphal
commit f3c5c1bfd430858d3a05436f82c51e53104feb6b
(netfilter: xtables: make ip_tables reentrant) forgot to
also compute the jumpstack size in the compat handlers.
Result is that "iptables -I INPUT -j userchain" turns into -j DROP.
Reported by Sebastian Roesner on #netfilter, closes
http://bugzilla.netfilter.org/show_bug.cgi?id=669.
Note: arptables change is compile-tested only.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
---
David, it would nice if you could take this patch as Patrick seems
to be on vacation.
Problem introduced during 2.6.35 development cycle.
net/ipv4/netfilter/arp_tables.c | 3 +++
net/ipv4/netfilter/ip_tables.c | 3 +++
net/ipv6/netfilter/ip6_tables.c | 3 +++
3 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 51d6c31..e8f4f9a 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1420,6 +1420,9 @@ static int translate_compat_table(const char *name,
if (ret != 0)
break;
++i;
+ if (strcmp(arpt_get_target(iter1)->u.user.name,
+ XT_ERROR_TARGET) == 0)
+ ++newinfo->stacksize;
}
if (ret) {
/*
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 97b64b2..d163f2e 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1751,6 +1751,9 @@ translate_compat_table(struct net *net,
if (ret != 0)
break;
++i;
+ if (strcmp(ipt_get_target(iter1)->u.user.name,
+ XT_ERROR_TARGET) == 0)
+ ++newinfo->stacksize;
}
if (ret) {
/*
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 29a7bca..8e754be 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1766,6 +1766,9 @@ translate_compat_table(struct net *net,
if (ret != 0)
break;
++i;
+ if (strcmp(ip6t_get_target(iter1)->u.user.name,
+ XT_ERROR_TARGET) == 0)
+ ++newinfo->stacksize;
}
if (ret) {
/*
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH][RESEND] netfilter: fix CONFIG_COMPAT support
2010-08-23 12:56 [PATCH][RESEND] netfilter: fix CONFIG_COMPAT support Florian Westphal
@ 2010-08-23 21:41 ` David Miller
2010-08-30 14:10 ` Florian Mickler
0 siblings, 1 reply; 4+ messages in thread
From: David Miller @ 2010-08-23 21:41 UTC (permalink / raw)
To: fw; +Cc: netfilter-devel, netdev
From: Florian Westphal <fw@strlen.de>
Date: Mon, 23 Aug 2010 14:56:26 +0200
> commit f3c5c1bfd430858d3a05436f82c51e53104feb6b
> (netfilter: xtables: make ip_tables reentrant) forgot to
> also compute the jumpstack size in the compat handlers.
>
> Result is that "iptables -I INPUT -j userchain" turns into -j DROP.
>
> Reported by Sebastian Roesner on #netfilter, closes
> http://bugzilla.netfilter.org/show_bug.cgi?id=669.
>
> Note: arptables change is compile-tested only.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied, thanks Florian.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][RESEND] netfilter: fix CONFIG_COMPAT support
2010-08-23 21:41 ` David Miller
@ 2010-08-30 14:10 ` Florian Mickler
2010-08-30 21:50 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Florian Mickler @ 2010-08-30 14:10 UTC (permalink / raw)
To: David Miller; +Cc: fw, netfilter-devel, netdev
On Mon, 23 Aug 2010 14:41:46 -0700 (PDT)
David Miller <davem@davemloft.net> wrote:
> From: Florian Westphal <fw@strlen.de>
> Date: Mon, 23 Aug 2010 14:56:26 +0200
>
> > commit f3c5c1bfd430858d3a05436f82c51e53104feb6b
> > (netfilter: xtables: make ip_tables reentrant) forgot to
> > also compute the jumpstack size in the compat handlers.
> >
> > Result is that "iptables -I INPUT -j userchain" turns into -j DROP.
> >
> > Reported by Sebastian Roesner on #netfilter, closes
> > http://bugzilla.netfilter.org/show_bug.cgi?id=669.
> >
> > Note: arptables change is compile-tested only.
> >
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
>
> Applied, thanks Florian.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
Should this go to stable?
It seems commit f3c5c1bdf was introduced in 2.6.35.
It fixes
[Bug #16423] netfilter/iptables stopped logging 2.6.35-rc
which was tracked as a regression.
Cheers,
Flo
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][RESEND] netfilter: fix CONFIG_COMPAT support
2010-08-30 14:10 ` Florian Mickler
@ 2010-08-30 21:50 ` Florian Westphal
0 siblings, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2010-08-30 21:50 UTC (permalink / raw)
To: Florian Mickler; +Cc: David Miller, fw, netfilter-devel, netdev
Florian Mickler <florian@mickler.org> wrote:
> On Mon, 23 Aug 2010 14:41:46 -0700 (PDT)
> David Miller <davem@davemloft.net> wrote:
>
> > From: Florian Westphal <fw@strlen.de>
> > Date: Mon, 23 Aug 2010 14:56:26 +0200
> >
> > > commit f3c5c1bfd430858d3a05436f82c51e53104feb6b
> > > (netfilter: xtables: make ip_tables reentrant) forgot to
> > > also compute the jumpstack size in the compat handlers.
> > >
> > > Result is that "iptables -I INPUT -j userchain" turns into -j DROP.
[..]
>
> Should this go to stable?
> It seems commit f3c5c1bdf was introduced in 2.6.35.
My bad, I forgot to add a "Cc: stable" tag.
I'll submit it now, thanks for the heads-up...
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-08-30 21:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-08-23 12:56 [PATCH][RESEND] netfilter: fix CONFIG_COMPAT support Florian Westphal
2010-08-23 21:41 ` David Miller
2010-08-30 14:10 ` Florian Mickler
2010-08-30 21:50 ` Florian Westphal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.