diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-10-07 19:02:11 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-10-07 20:16:31 +0200 |
| commit | f0d1f04f0a2f662b6b617e24d115fddcf6ef8723 (patch) | |
| tree | 32d914b7f1baa5a5d5c01936616425226143c234 /firmware | |
| parent | 91c1a09b33c902e20e09d9742560cc238a714de5 (diff) | |
| download | op-kernel-dev-f0d1f04f0a2f662b6b617e24d115fddcf6ef8723.zip op-kernel-dev-f0d1f04f0a2f662b6b617e24d115fddcf6ef8723.tar.gz | |
netfilter: fix wrong arithmetics regarding NFT_REJECT_ICMPX_MAX
NFT_REJECT_ICMPX_MAX should be __NFT_REJECT_ICMPX_MAX - 1.
nft_reject_icmp_code() and nft_reject_icmpv6_code() are called from the
packet path, so BUG_ON in case we try to access an unknown abstracted
ICMP code. This should not happen since we already validate this from
nft_reject_{inet,bridge}_init().
Fixes: 51b0a5d ("netfilter: nft_reject: introduce icmp code abstraction for inet and bridge")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'firmware')
0 files changed, 0 insertions, 0 deletions
