3 years ago we had to bump the offsets to the extensions (223b02d923ecd7c84cf9780bb3686f455d279279, "netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len") because total size of all extensions had increased to a point where u8 did overflow. We already dieted the extensions back to more reasonable sizes, however, I never wanted to switch back because overflow produces hard to diagnose crash bugs, and we could not add compile-time assert because extensions can be dynamically sized. This series makes the last veriable-sized extension (helper) fixed in size by adding a 32byte scratch area for helpers to use and then adds the compile-time asserts to catch overflow during build time. include/net/netfilter/nf_conntrack.h | 19 ---------------- include/net/netfilter/nf_conntrack_extend.h | 12 ++-------- include/net/netfilter/nf_conntrack_helper.h | 31 ++++++++++++++++++++++---- net/netfilter/nf_conntrack_amanda.c | 2 + net/netfilter/nf_conntrack_core.c | 33 ++++++++++++++++++++++++++++ net/netfilter/nf_conntrack_extend.c | 16 +++++-------- net/netfilter/nf_conntrack_ftp.c | 8 +++--- net/netfilter/nf_conntrack_h323_main.c | 6 +---- net/netfilter/nf_conntrack_helper.c | 6 +---- net/netfilter/nf_conntrack_irc.c | 2 - net/netfilter/nf_conntrack_netbios_ns.c | 2 + net/netfilter/nf_conntrack_pptp.c | 3 +- net/netfilter/nf_conntrack_sane.c | 8 +++--- net/netfilter/nf_conntrack_sip.c | 14 +++++------ net/netfilter/nf_conntrack_tftp.c | 6 +++-- net/netfilter/nfnetlink_cthelper.c | 10 ++++++-- 16 files changed, 106 insertions(+), 72 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
