From 64e88114437072b29bed8aae9eb04ed5e773708f Mon Sep 17 00:00:00 2001 From: Juliana Rodrigueiro Date: Tue, 20 Aug 2019 13:30:39 +0200 Subject: extensions: nfacct: Fix alignment mismatch in xt_nfacct_match_info When running a 64-bit kernel with a 32-bit iptables binary, the size of the xt_nfacct_match_info struct diverges. kernel: sizeof(struct xt_nfacct_match_info) : 40 iptables: sizeof(struct xt_nfacct_match_info)) : 36 This patch is the userspace fix of the memory misalignment. It introduces a v1 ABI with the correct alignment and stays compatible with unfixed revision 0 kernels. Signed-off-by: Juliana Rodrigueiro Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_nfacct.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) (limited to 'extensions') diff --git a/extensions/libxt_nfacct.c b/extensions/libxt_nfacct.c index 2ad59d52..d9c0309a 100644 --- a/extensions/libxt_nfacct.c +++ b/extensions/libxt_nfacct.c @@ -70,20 +70,36 @@ static void nfacct_save(const void *ip, const struct xt_entry_match *match) nfacct_print_name(info, "--"); } -static struct xtables_match nfacct_match = { - .family = NFPROTO_UNSPEC, - .name = "nfacct", - .version = XTABLES_VERSION, - .size = XT_ALIGN(sizeof(struct xt_nfacct_match_info)), - .userspacesize = offsetof(struct xt_nfacct_match_info, nfacct), - .help = nfacct_help, - .x6_parse = nfacct_parse, - .print = nfacct_print, - .save = nfacct_save, - .x6_options = nfacct_opts, +static struct xtables_match nfacct_matches[] = { + { + .family = NFPROTO_UNSPEC, + .revision = 0, + .name = "nfacct", + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_nfacct_match_info)), + .userspacesize = offsetof(struct xt_nfacct_match_info, nfacct), + .help = nfacct_help, + .x6_parse = nfacct_parse, + .print = nfacct_print, + .save = nfacct_save, + .x6_options = nfacct_opts, + }, + { + .family = NFPROTO_UNSPEC, + .revision = 1, + .name = "nfacct", + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_nfacct_match_info_v1)), + .userspacesize = offsetof(struct xt_nfacct_match_info_v1, nfacct), + .help = nfacct_help, + .x6_parse = nfacct_parse, + .print = nfacct_print, + .save = nfacct_save, + .x6_options = nfacct_opts, + }, }; void _init(void) { - xtables_register_match(&nfacct_match); + xtables_register_matches(nfacct_matches, ARRAY_SIZE(nfacct_matches)); } -- cgit v1.2.3