-stable review patch. If anyone has any objections, please let us know. ------------------ From: Chuck Ebbert <76306.1226@compuserve.com> We cannot compute the gap until we know we have a 'struct ebt_entry' and not 'struct ebt_entries'. Failure to check can cause crash. Tested-by: Santiago Garcia Mantinan Acked-by: Al Viro Acked-by: Patrick McHardy Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com> Signed-off-by: Chris Wright --- net/bridge/netfilter/ebtables.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- linux-2.6.19.1.orig/net/bridge/netfilter/ebtables.c +++ linux-2.6.19.1/net/bridge/netfilter/ebtables.c @@ -575,7 +575,7 @@ ebt_check_entry(struct ebt_entry *e, str struct ebt_entry_target *t; struct ebt_target *target; unsigned int i, j, hook = 0, hookmask = 0; - size_t gap = e->next_offset - e->target_offset; + size_t gap; int ret; /* don't mess with the struct ebt_entries */ @@ -625,6 +625,7 @@ ebt_check_entry(struct ebt_entry *e, str if (ret != 0) goto cleanup_watchers; t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); + gap = e->next_offset - e->target_offset; target = find_target_lock(t->u.name, &ret, &ebt_mutex); if (!target) goto cleanup_watchers; --