Florian Westphal 88f65567b4 netfilter: ebtables: reject non-bridge targets ... commit 11ff7288beb2b7da889a014aff0a7b80bf8efcf3 upstream. the ebtables evaluation loop expects targets to return positive values (jumps), or negative values (absolute verdicts). This is completely different from what xtables does. In xtables, targets are expected to return the standard netfilter verdicts, i.e. NF_DROP, NF_ACCEPT, etc. ebtables will consider these as jumps. Therefore reject any target found due to unspec fallback. v2: also reject watchers. ebtables ignores their return value, so a target that assumes skb ownership (and returns NF_STOLEN) causes use-after-free. The only watchers in the 'ebtables' front-end are log and nflog; both have AF_BRIDGE specific wrappers on kernel side. Reported-by: syzbot+2b43f681169a2a0d306a@syzkaller.appspotmail.com Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-07-22 14:25:54 +02:00
..
netfilter	netfilter: ebtables: reject non-bridge targets	2018-07-22 14:25:54 +02:00
br_device.c
br_fdb.c
br_forward.c
br_if.c	bridge: check iface upper dev when setting master via ioctl	2018-05-26 08:48:46 +02:00
br_input.c
br_ioctl.c
br_mdb.c
br_multicast.c
br_netfilter_hooks.c	netfilter: bridge: honor frag_max_size when refragmenting	2017-12-20 10:04:54 +01:00
br_netfilter_ipv6.c
br_netlink.c	net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks	2018-01-02 20:33:26 +01:00
br_nf_core.c
br_private_stp.h
br_private.h
br_stp_bpdu.c
br_stp_if.c	net: bridge: start hello timer only if device is up	2017-06-14 13:16:19 +02:00
br_stp_timer.c
br_stp.c
br_sysfs_br.c
br_sysfs_if.c	bridge: check brport attr show in brport_show	2018-03-11 16:19:45 +01:00
br_vlan.c
br.c
Kconfig
Makefile