aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@nbd.name>2020-10-24 21:14:16 +0200
committerFelix Fietkau <nbd@nbd.name>2021-02-16 20:06:51 +0100
commitb10d6044599d8c1fa7fbb2374bcbf30118d39db1 (patch)
tree3fc84f92c14dfa7178487b71e1b8d63c2b688439 /target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch
parent299b8554183791b325e393c880d32360d7d72f73 (diff)
downloadupstream-b10d6044599d8c1fa7fbb2374bcbf30118d39db1.tar.gz
upstream-b10d6044599d8c1fa7fbb2374bcbf30118d39db1.tar.bz2
upstream-b10d6044599d8c1fa7fbb2374bcbf30118d39db1.zip
kernel: add linux 5.10 support
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch')
-rw-r--r--target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch22
1 files changed, 22 insertions, 0 deletions
diff --git a/target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch b/target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch
new file mode 100644
index 0000000000..79da6778b6
--- /dev/null
+++ b/target/linux/generic/pending-5.10/612-netfilter_match_reduce_memory_access.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: netfilter: reduce match memory access
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ net/ipv4/netfilter/ip_tables.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -53,9 +53,9 @@ ip_packet_match(const struct iphdr *ip,
+ if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
+ return true;
+
+- if (NF_INVF(ipinfo, IPT_INV_SRCIP,
++ if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr &&
+ (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
+- NF_INVF(ipinfo, IPT_INV_DSTIP,
++ NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr &&
+ (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr))
+ return false;
+