From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754031AbcHUVX0 (ORCPT ); Sun, 21 Aug 2016 17:23:26 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:56834 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753940AbcHUVWA (ORCPT ); Sun, 21 Aug 2016 17:22:00 -0400 Date: Sun, 21 Aug 2016 23:21:25 +0200 From: Willy Tarreau To: Florian Westphal Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Pablo Neira Ayuso , Jay Subject: Re: [PATCH 3.10 007/180] netfilter: x_tables: validate targets of jumps Message-ID: <20160821212125.GA21874@1wt.eu> References: <1471793510-13022-1-git-send-email-w@1wt.eu> <1471793510-13022-8-git-send-email-w@1wt.eu> <20160821195752.GA21254@1wt.eu> <20160821201616.GA23675@breakpoint.cc> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160821201616.GA23675@breakpoint.cc> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Aug 21, 2016 at 10:16:16PM +0200, Florian Westphal wrote: > Willy Tarreau wrote: > > On Sun, Aug 21, 2016 at 05:28:57PM +0200, Willy Tarreau wrote: > > > From: Florian Westphal > > > > > > commit 36472341017529e2b12573093cc0f68719300997 upstream. > > > > > > When we see a jump also check that the offset gets us to beginning of > > > a rule (an ipt_entry). > > (...) > > > > Sorry, this patch is bad and causes performance issues, I didn't notice > > that 3.14 had a different version, below. Thanks to Jay for reporting > > the problem to me. I'll push 3.10.103-rc2 after some cool down period. > > Please either hold this one back or also queue > commit f4dc77713f8016d2e8a3295e1c9c53a21f296def > netfilter: x_tables: speed up jump target validation > > It supersedes this one. OK, I'm postponing it then, as the patch above is not yet in more recent stable versions. Thanks Florian! Willy