target/linux/generic/pending-5.4/612-netfilter_match_reduce_memory_access.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Subject: netfilter: reduce match memory access
   3
   4 Signed-off-by: Felix Fietkau <nbd@nbd.name>
   5 ---
   6  net/ipv4/netfilter/ip_tables.c | 4 ++--
   7  1 file changed, 2 insertions(+), 2 deletions(-)
   8
   9 --- a/net/ipv4/netfilter/ip_tables.c
  10 +++ b/net/ipv4/netfilter/ip_tables.c
  11 @@ -56,9 +56,9 @@ ip_packet_match(const struct iphdr *ip,
  12         if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
  13                 return true;
  14
  15 -       if (NF_INVF(ipinfo, IPT_INV_SRCIP,
  16 +       if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr &&
  17                     (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
  18 -           NF_INVF(ipinfo, IPT_INV_DSTIP,
  19 +           NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr &&
  20                     (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr))
  21                 return false;
  22