diff options
| author | David S. Miller <davem@davemloft.net> | 2023-12-29 07:57:59 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-12-29 07:57:59 +0000 |
| commit | a4255b2e5c52abe4e94d320cf8276303e192d59d (patch) | |
| tree | 80712bbc35667c33ccc717c3c5e170610ecf5f0b /include/net | |
| parent | 49fcf34ac908784f97bc0f98dc5460239cc53798 (diff) | |
| parent | 7315dc1e122c85ffdfc8defffbb8f8b616c2eb1a (diff) | |
Merge tag 'nf-23-12-20' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablu Neira Syuso says:
====================
netfilter pull request 23-12-20
The following patchset contains Netfilter fixes for net:
1) Skip set commit for deleted/destroyed sets, this might trigger
double deactivation of expired elements.
2) Fix packet mangling from egress, set transport offset from
mac header for netdev/egress.
Both fixes address bugs already present in several releases.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/netfilter/nf_tables_ipv4.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h index 947973623dc7..60a7d0ce3080 100644 --- a/include/net/netfilter/nf_tables_ipv4.h +++ b/include/net/netfilter/nf_tables_ipv4.h @@ -30,7 +30,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) return -1; len = iph_totlen(pkt->skb, iph); - thoff = iph->ihl * 4; + thoff = skb_network_offset(pkt->skb) + (iph->ihl * 4); if (pkt->skb->len < len) return -1; else if (len < thoff) |