Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of jumps
From: Ben Hutchings <hidden>
Date: 2016-08-17 00:27:43
Also in:
lkml
On Sat, 2016-08-13 at 22:35 +0200, Florian Westphal wrote:
quoted
Ben Hutchings [off-list ref] wrote: On Sat, 2016-08-13 at 20:30 +0200, Florian Westphal wrote:quoted
quoted
quoted
quoted
quoted
quoted
Ben Hutchings [off-list ref] wrote:3.16.37-rc1 review patch. If anyone has any objections, please let me know. ------------------quoted
quoted
quoted
quoted
quoted
quoted
quoted
quoted
From: Florian Westphal <fw@strlen.de>commit 36472341017529e2b12573093cc0f68719300997 upstream.[..]quoted
The extra overhead is negible, even with absurd cases.Not true, the overhead is huge and increases restore time for large rulesets from mere seconds to minutes, see https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f4dc77713f8016d2e8a3295e1c9c53a21f296defSo do you think I should add that to this update or defer the netfilter changes to the next update?Depends on what your focus is for 3.16. If your focus is to better not break anything I would just drop this patch and apply it for the next round with the fix (f4dc77713f8016d2e8a3295e1c9c53a21f296def) on top once it had more soak time.
I thought there were more that depended on this one, but in fact dropping just this seems to work. So that's what I've done for now. Thanks. Ben. -- Ben Hutchings If at first you don't succeed, you're doing about average.
Attachments
- signature.asc [application/pgp-signature] 819 bytes