netfilter: fix ABI breakage caused by the netfilter match optimization (fixes #5628)

SVN-Revision: 20552

diff --git a/target/linux/generic-2.6/patches-2.6.30/110-netfilter_match_speedup.patch b/target/linux/generic-2.6/patches-2.6.30/110-netfilter_match_speedup.patch
index 950a432959e3081d0d533b66464706fe72e4c264..926966ced01ce381a1b31200956bf8c7e8ef5c29 100644 (file)
--- a/target/linux/generic-2.6/patches-2.6.30/110-netfilter_match_speedup.patch
+++ b/target/linux/generic-2.6/patches-2.6.30/110-netfilter_match_speedup.patch
@@ -119,3 +119,26 @@
        /* For return from builtin chain */
        back = get_entry(table_base, private->underflow[hook]);
  
+@@ -976,6 +1015,7 @@ copy_entries_to_user(unsigned int total_
+               unsigned int i;
+               const struct ipt_entry_match *m;
+               const struct ipt_entry_target *t;
++              u8 flags;
+ 
+               e = (struct ipt_entry *)(loc_cpu_entry + off);
+               if (copy_to_user(userptr + off
+@@ -986,6 +1026,14 @@ copy_entries_to_user(unsigned int total_
+                       goto free_counters;
+               }
+ 
++              flags = e->ip.flags & ~IPT_F_NO_DEF_MATCH;
++              if (copy_to_user(userptr + off
++                               + offsetof(struct ipt_entry, ip.flags),
++                               &flags, sizeof(flags)) != 0) {
++                      ret = -EFAULT;
++                      goto free_counters;
++              }
++
+               for (i = sizeof(struct ipt_entry);
+                    i < e->target_offset;
+                    i += m->u.match_size) {

diff --git a/target/linux/generic-2.6/patches-2.6.31/110-netfilter_match_speedup.patch b/target/linux/generic-2.6/patches-2.6.31/110-netfilter_match_speedup.patch
index 3dd114522ac106db8994f7dea4a9aa92e54323bb..d6c113aa3e10d5131f9459deeb65cf68a11bea07 100644 (file)
--- a/target/linux/generic-2.6/patches-2.6.31/110-netfilter_match_speedup.patch
+++ b/target/linux/generic-2.6/patches-2.6.31/110-netfilter_match_speedup.patch
@@ -119,3 +119,26 @@
        /* For return from builtin chain */
        back = get_entry(table_base, private->underflow[hook]);
  
+@@ -978,6 +1017,7 @@ copy_entries_to_user(unsigned int total_
+               unsigned int i;
+               const struct ipt_entry_match *m;
+               const struct ipt_entry_target *t;
++              u8 flags;
+ 
+               e = (struct ipt_entry *)(loc_cpu_entry + off);
+               if (copy_to_user(userptr + off
+@@ -988,6 +1028,14 @@ copy_entries_to_user(unsigned int total_
+                       goto free_counters;
+               }
+ 
++              flags = e->ip.flags & ~IPT_F_NO_DEF_MATCH;
++              if (copy_to_user(userptr + off
++                               + offsetof(struct ipt_entry, ip.flags),
++                               &flags, sizeof(flags)) != 0) {
++                      ret = -EFAULT;
++                      goto free_counters;
++              }
++
+               for (i = sizeof(struct ipt_entry);
+                    i < e->target_offset;
+                    i += m->u.match_size) {

diff --git a/target/linux/generic-2.6/patches-2.6.32/110-netfilter_match_speedup.patch b/target/linux/generic-2.6/patches-2.6.32/110-netfilter_match_speedup.patch
index 2f4c7a292284d46314d411f00d14a342234f2ab5..a9eb1089f5f206af1793b3897c123bf26bb1b00f 100644 (file)
--- a/target/linux/generic-2.6/patches-2.6.32/110-netfilter_match_speedup.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/110-netfilter_match_speedup.patch
@@ -119,3 +119,26 @@
        /* For return from builtin chain */
        back = get_entry(table_base, private->underflow[hook]);
  
+@@ -992,6 +1031,7 @@ copy_entries_to_user(unsigned int total_
+               unsigned int i;
+               const struct ipt_entry_match *m;
+               const struct ipt_entry_target *t;
++              u8 flags;
+ 
+               e = (struct ipt_entry *)(loc_cpu_entry + off);
+               if (copy_to_user(userptr + off
+@@ -1002,6 +1042,14 @@ copy_entries_to_user(unsigned int total_
+                       goto free_counters;
+               }
+ 
++              flags = e->ip.flags & ~IPT_F_NO_DEF_MATCH;
++              if (copy_to_user(userptr + off
++                               + offsetof(struct ipt_entry, ip.flags),
++                               &flags, sizeof(flags)) != 0) {
++                      ret = -EFAULT;
++                      goto free_counters;
++              }
++
+               for (i = sizeof(struct ipt_entry);
+                    i < e->target_offset;
+                    i += m->u.match_size) {

diff --git a/target/linux/generic-2.6/patches-2.6.33/110-netfilter_match_speedup.patch b/target/linux/generic-2.6/patches-2.6.33/110-netfilter_match_speedup.patch
index 69344a91fa5cb525407fe2cea51dc957f2a7c79d..e99c6db4d1b5f5bf687b22887d769bcde4d91768 100644 (file)
--- a/target/linux/generic-2.6/patches-2.6.33/110-netfilter_match_speedup.patch
+++ b/target/linux/generic-2.6/patches-2.6.33/110-netfilter_match_speedup.patch
@@ -119,3 +119,26 @@
        /* For return from builtin chain */
        back = get_entry(table_base, private->underflow[hook]);
  
+@@ -992,6 +1031,7 @@ copy_entries_to_user(unsigned int total_
+               unsigned int i;
+               const struct ipt_entry_match *m;
+               const struct ipt_entry_target *t;
++              u8 flags;
+ 
+               e = (struct ipt_entry *)(loc_cpu_entry + off);
+               if (copy_to_user(userptr + off
+@@ -1002,6 +1042,14 @@ copy_entries_to_user(unsigned int total_
+                       goto free_counters;
+               }
+ 
++              flags = e->ip.flags & ~IPT_F_NO_DEF_MATCH;
++              if (copy_to_user(userptr + off
++                               + offsetof(struct ipt_entry, ip.flags),
++                               &flags, sizeof(flags)) != 0) {
++                      ret = -EFAULT;
++                      goto free_counters;
++              }
++
+               for (i = sizeof(struct ipt_entry);
+                    i < e->target_offset;
+                    i += m->u.match_size) {

diff --git a/target/linux/generic-2.6/patches-2.6.34/110-netfilter_match_speedup.patch b/target/linux/generic-2.6/patches-2.6.34/110-netfilter_match_speedup.patch
index 69344a91fa5cb525407fe2cea51dc957f2a7c79d..e99c6db4d1b5f5bf687b22887d769bcde4d91768 100644 (file)
--- a/target/linux/generic-2.6/patches-2.6.34/110-netfilter_match_speedup.patch
+++ b/target/linux/generic-2.6/patches-2.6.34/110-netfilter_match_speedup.patch
@@ -119,3 +119,26 @@
        /* For return from builtin chain */
        back = get_entry(table_base, private->underflow[hook]);
  
+@@ -992,6 +1031,7 @@ copy_entries_to_user(unsigned int total_
+               unsigned int i;
+               const struct ipt_entry_match *m;
+               const struct ipt_entry_target *t;
++              u8 flags;
+ 
+               e = (struct ipt_entry *)(loc_cpu_entry + off);
+               if (copy_to_user(userptr + off
+@@ -1002,6 +1042,14 @@ copy_entries_to_user(unsigned int total_
+                       goto free_counters;
+               }
+ 
++              flags = e->ip.flags & ~IPT_F_NO_DEF_MATCH;
++              if (copy_to_user(userptr + off
++                               + offsetof(struct ipt_entry, ip.flags),
++                               &flags, sizeof(flags)) != 0) {
++                      ret = -EFAULT;
++                      goto free_counters;
++              }
++
+               for (i = sizeof(struct ipt_entry);
+                    i < e->target_offset;
+                    i += m->u.match_size) {