archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:44:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

netfilter: flowtable: check for maximum number of encapsulations in bridge vlan

Browse source 
Add a sanity check to skip path discovery if the maximum number of
encapsulation is reached. While at it, check for underflow too.

Fixes: 26267bf9bb ("netfilter: flowtable: bridge vlan hardware offload and switchdev")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2025-11-27 23:26:22 +00:00
parent db4029859d
commit 634f3853cc
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
net/netfilter/nft_flow_offload.c
View file

@ -141,12 +141,19 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
info->ingress_vlans |= BIT(info->num_encaps - 1);
break;
case DEV_PATH_BR_VLAN_TAG:
if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
info->indev = NULL;
break;
}
info->encap[info->num_encaps].id = path->bridge.vlan_id;
info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
info->num_encaps++;
break;
case DEV_PATH_BR_VLAN_UNTAG:
info->num_encaps--;
if (WARN_ON_ONCE(info->num_encaps-- == 0)) {
info->indev = NULL;
break;
}
break;
case DEV_PATH_BR_VLAN_KEEP:
break;