diff options
| author | Fernando Fernandez Mancera <fmancera@suse.de> | 2026-08-27 12:32:56 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-09-11 13:04:15 +0200 |
| commit | 444e4c88c9c62a3d823069006563513fe7d5aa66 (patch) | |
| tree | 166c64ee7c3d61881e953106e1b905f1e7d355e4 /tools/perf/scripts/python/stackcollapse.py | |
| parent | d313499df66159b4b7971d760d16729598ab7e5a (diff) | |
| download | linux-444e4c88c9c62a3d823069006563513fe7d5aa66.tar.gz linux-444e4c88c9c62a3d823069006563513fe7d5aa66.zip | |
netfilter: nf_tables: fix device name and prefix match in hook lookup
Currently, a netdev chain or flowtable hooked to a device prefix can be
unintentionally deleted by a control-plane request targeting an exact
device name or even a shorter one due to the usage of min() to calculate
the length to match.
Fix this by making sure an exact device match never matches a prefix and
that both the target and the candidate have the same length during
delete operation. The add and update paths retain the existing overlap
matching to prevent a single device from matching multiple hooks.
Reported-by: Wei Fang <void0red@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/CANE+tVrDeNCHQVmsqkV2ozeBqyE3GtRDMhZgsg1bhw10yGNTRQ@mail.gmail.com/
Fixes: 6d07a289504a ("netfilter: nf_tables: Support wildcard netdev hook specs")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions