[PATCH] netfilter updates for net (3.7-rc7)

From: Pablo Neira Ayuso <pablo@netfilter.org>

Hi David,

This update contains one patch to fix an overflow via the interface
name attribute in the ipset infrastructure, from Florian Westphal.

You can pull this change from:

git://1984.lsi.us.es/nf master

Thanks!

Florian Westphal (1):
  netfilter: ipset: fix netiface set name overflow

 net/netfilter/ipset/ip_set_hash_netiface.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
1.7.10.4

From: Florian Westphal <fw@strlen.de>

attribute is copied to IFNAMSIZ-size stack variable,
but IFNAMSIZ is smaller than IPSET_MAXNAMELEN.

Fortunately nfnetlink needs CAP_NET_ADMIN.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/ipset/ip_set_hash_netiface.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index b9a6338..45a1014 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c

@@ -793,7 +793,7 @@ static struct ip_set_type hash_netiface_type __read_mostly = {
 		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
 		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
 		[IPSET_ATTR_IFACE]	= { .type = NLA_NUL_STRING,
-					    .len = IPSET_MAXNAMELEN - 1 },
+					    .len  = IFNAMSIZ - 1 },
 		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
 		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },

-- 
1.7.10.4

From: pablo@netfilter.org
Date: Tue, 27 Nov 2012 02:03:04 +0100

From: Pablo Neira Ayuso <pablo@netfilter.org>

Hi David,

This update contains one patch to fix an overflow via the interface
name attribute in the ipset infrastructure, from Florian Westphal.

You can pull this change from:

git://1984.lsi.us.es/nf master

Pulled, thanks Pablo.