Commit 634f3853 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: flowtable: check for maximum number of encapsulations in bridge vlan 



Add a sanity check to skip path discovery if the maximum number of
encapsulation is reached. While at it, check for underflow too.

Fixes: 26267bf9 ("netfilter: flowtable: bridge vlan hardware offload and switchdev")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent db402985

net/netfilter/nft_flow_offload.c

+8 −1
Original line number Diff line number Diff line
@@ -141,12 +141,19 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack, 
				info->ingress_vlans |= BIT(info->num_encaps - 1);

				break;

			case DEV_PATH_BR_VLAN_TAG:

				if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {

					info->indev = NULL;

					break;

				}

				info->encap[info->num_encaps].id = path->bridge.vlan_id;

				info->encap[info->num_encaps].proto = path->bridge.vlan_proto;

				info->num_encaps++;

				break;

			case DEV_PATH_BR_VLAN_UNTAG:

				info->num_encaps--;

				if (WARN_ON_ONCE(info->num_encaps-- == 0)) {

					info->indev = NULL;

					break;

				}

				break;

			case DEV_PATH_BR_VLAN_KEEP:

				break;