@@ -2608,7 +2608,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
2608
2608
}
2609
2609
2610
2610
desc .klen = ntohl (nla_get_be32 (nla [NFTA_SET_KEY_LEN ]));
2611
- if (desc .klen == 0 || desc .klen > FIELD_SIZEOF ( struct nft_data , data ) )
2611
+ if (desc .klen == 0 || desc .klen > NFT_DATA_VALUE_MAXLEN )
2612
2612
return - EINVAL ;
2613
2613
2614
2614
flags = 0 ;
@@ -2634,11 +2634,10 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
2634
2634
if (nla [NFTA_SET_DATA_LEN ] == NULL )
2635
2635
return - EINVAL ;
2636
2636
desc .dlen = ntohl (nla_get_be32 (nla [NFTA_SET_DATA_LEN ]));
2637
- if (desc .dlen == 0 ||
2638
- desc .dlen > FIELD_SIZEOF (struct nft_data , data ))
2637
+ if (desc .dlen == 0 || desc .dlen > NFT_DATA_VALUE_MAXLEN )
2639
2638
return - EINVAL ;
2640
2639
} else
2641
- desc .dlen = sizeof (struct nft_data );
2640
+ desc .dlen = sizeof (struct nft_verdict );
2642
2641
} else if (flags & NFT_SET_MAP )
2643
2642
return - EINVAL ;
2644
2643
@@ -2854,12 +2853,10 @@ void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
2854
2853
2855
2854
const struct nft_set_ext_type nft_set_ext_types [] = {
2856
2855
[NFT_SET_EXT_KEY ] = {
2857
- .len = sizeof (struct nft_data ),
2858
- .align = __alignof__(struct nft_data ),
2856
+ .align = __alignof__(u32 ),
2859
2857
},
2860
2858
[NFT_SET_EXT_DATA ] = {
2861
- .len = sizeof (struct nft_data ),
2862
- .align = __alignof__(struct nft_data ),
2859
+ .align = __alignof__(u32 ),
2863
2860
},
2864
2861
[NFT_SET_EXT_FLAGS ] = {
2865
2862
.len = sizeof (u8 ),
@@ -3299,15 +3296,15 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3299
3296
timeout = set -> timeout ;
3300
3297
}
3301
3298
3302
- err = nft_data_init (ctx , & elem .key , sizeof (elem .key ), & d1 ,
3299
+ err = nft_data_init (ctx , & elem .key . val , sizeof (elem .key ), & d1 ,
3303
3300
nla [NFTA_SET_ELEM_KEY ]);
3304
3301
if (err < 0 )
3305
3302
goto err1 ;
3306
3303
err = - EINVAL ;
3307
3304
if (d1 .type != NFT_DATA_VALUE || d1 .len != set -> klen )
3308
3305
goto err2 ;
3309
3306
3310
- nft_set_ext_add (& tmpl , NFT_SET_EXT_KEY );
3307
+ nft_set_ext_add_length (& tmpl , NFT_SET_EXT_KEY , d1 . len );
3311
3308
if (timeout > 0 ) {
3312
3309
nft_set_ext_add (& tmpl , NFT_SET_EXT_EXPIRATION );
3313
3310
if (timeout != set -> timeout )
@@ -3342,7 +3339,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3342
3339
goto err3 ;
3343
3340
}
3344
3341
3345
- nft_set_ext_add (& tmpl , NFT_SET_EXT_DATA );
3342
+ nft_set_ext_add_length (& tmpl , NFT_SET_EXT_DATA , d2 . len );
3346
3343
}
3347
3344
3348
3345
/* The full maximum length of userdata can exceed the maximum
@@ -3358,7 +3355,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3358
3355
}
3359
3356
3360
3357
err = - ENOMEM ;
3361
- elem .priv = nft_set_elem_init (set , & tmpl , elem .key .data , data .data ,
3358
+ elem .priv = nft_set_elem_init (set , & tmpl , elem .key .val . data , data .data ,
3362
3359
timeout , GFP_KERNEL );
3363
3360
if (elem .priv == NULL )
3364
3361
goto err3 ;
@@ -3393,7 +3390,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3393
3390
if (nla [NFTA_SET_ELEM_DATA ] != NULL )
3394
3391
nft_data_uninit (& data , d2 .type );
3395
3392
err2 :
3396
- nft_data_uninit (& elem .key , d1 .type );
3393
+ nft_data_uninit (& elem .key . val , d1 .type );
3397
3394
err1 :
3398
3395
return err ;
3399
3396
}
@@ -3460,7 +3457,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
3460
3457
if (nla [NFTA_SET_ELEM_KEY ] == NULL )
3461
3458
goto err1 ;
3462
3459
3463
- err = nft_data_init (ctx , & elem .key , sizeof (elem .key ), & desc ,
3460
+ err = nft_data_init (ctx , & elem .key . val , sizeof (elem .key ), & desc ,
3464
3461
nla [NFTA_SET_ELEM_KEY ]);
3465
3462
if (err < 0 )
3466
3463
goto err1 ;
@@ -3488,7 +3485,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
3488
3485
err3 :
3489
3486
kfree (trans );
3490
3487
err2 :
3491
- nft_data_uninit (& elem .key , desc .type );
3488
+ nft_data_uninit (& elem .key . val , desc .type );
3492
3489
err1 :
3493
3490
return err ;
3494
3491
}
0 commit comments