Merge tag 'hwmon-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groec...

[linux.git] / net / netfilter / xt_connmark.c

diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 4277084de2e70c995f49cadd411cab70473b3ad9..2cf27f7d59b95fc8beb0c1b75c7f3e67ea74d6e7 100644 (file)
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -112,6 +112,16 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
        return ret;
 }
 
+static int connmark_tg_check_v2(const struct xt_tgchk_param *par)
+{
+       const struct xt_connmark_tginfo2 *info = par->targinfo;
+
+       if (info->shift_dir > D_SHIFT_RIGHT || info->shift_bits >= 32)
+               return -EINVAL;
+
+       return connmark_tg_check(par);
+}
+
 static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
        nf_ct_netns_put(par->net, par->family);
@@ -162,7 +172,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
                .name           = "CONNMARK",
                .revision       = 2,
                .family         = NFPROTO_IPV4,
-               .checkentry     = connmark_tg_check,
+               .checkentry     = connmark_tg_check_v2,
                .target         = connmark_tg_v2,
                .targetsize     = sizeof(struct xt_connmark_tginfo2),
                .destroy        = connmark_tg_destroy,
@@ -183,7 +193,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
                .name           = "CONNMARK",
                .revision       = 2,
                .family         = NFPROTO_IPV6,
-               .checkentry     = connmark_tg_check,
+               .checkentry     = connmark_tg_check_v2,
                .target         = connmark_tg_v2,
                .targetsize     = sizeof(struct xt_connmark_tginfo2),
                .destroy        = connmark_tg_destroy,