diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-09-27 20:49:19 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-04 08:59:03 +0200 |
| commit | 2fa46c130193300f06e68727ae98ec9f6184cad4 (patch) | |
| tree | a5e44867923127f285cb7acdcd40f1298a5bdcd9 /samples | |
| parent | dbb5918cb333dfeb8897f8e8d542661d2ff5b9a0 (diff) | |
| download | linux-2fa46c130193300f06e68727ae98ec9f6184cad4.tar.bz2 | |
netfilter: nft_limit: fix divided by zero panic
After I input the following nftables rule, a panic happened on my system:
# nft add rule filter OUTPUT limit rate 0xf00000000 bytes/second
divide error: 0000 [#1] SMP
[ ... ]
RIP: 0010:[<ffffffffa059035e>] [<ffffffffa059035e>]
nft_limit_pkt_bytes_eval+0x2e/0xa0 [nft_limit]
Call Trace:
[<ffffffffa05721bb>] nft_do_chain+0xfb/0x4e0 [nf_tables]
[<ffffffffa044f236>] ? nf_nat_setup_info+0x96/0x480 [nf_nat]
[<ffffffff81753767>] ? ipt_do_table+0x327/0x610
[<ffffffffa044f677>] ? __nf_nat_alloc_null_binding+0x57/0x80 [nf_nat]
[<ffffffffa058b21f>] nft_ipv4_output+0xaf/0xd0 [nf_tables_ipv4]
[<ffffffff816f4aa2>] nf_iterate+0x62/0x80
[<ffffffff816f4b33>] nf_hook_slow+0x73/0xd0
[<ffffffff81703d0d>] __ip_local_out+0xcd/0xe0
[<ffffffff81701d90>] ? ip_forward_options+0x1b0/0x1b0
[<ffffffff81703d3c>] ip_local_out+0x1c/0x40
This is because divisor is 64-bit, but we treat it as a 32-bit integer,
then 0xf00000000 becomes zero, i.e. divisor becomes 0.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'samples')
0 files changed, 0 insertions, 0 deletions