From c02f0bb60680a36bb45c02f1c28f022632eb8560 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Sun, 24 May 2015 01:00:41 +0200 Subject: [PATCH] netfilter: remove unused comefrom hookmask argument Orabug: 24690280 CVE: CVE-2016-3134 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 2f06550b3b0e26f54045337e34ec2a1b666bb6c6) Signed-off-by: Brian Maly Conflicts: net/ipv4/netfilter/ip_tables.c net/ipv6/netfilter/ip6_tables.c --- net/ipv4/netfilter/ip_tables.c | 4 +--- net/ipv6/netfilter/ip6_tables.c | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 3bcf28bf1525..1dcd8d18d1a6 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1409,7 +1409,6 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr, static int compat_find_calc_match(struct xt_entry_match *m, const struct ipt_ip *ip, - unsigned int hookmask, int *size) { struct xt_match *match; @@ -1479,8 +1478,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, entry_offset = (void *)e - (void *)base; j = 0; xt_ematch_foreach(ematch, e) { - ret = compat_find_calc_match(ematch, &e->ip, e->comefrom, - &off); + ret = compat_find_calc_match(ematch, &e->ip, &off); if (ret != 0) goto release_matches; ++j; diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 5254d76dfce8..b48c375abf38 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1423,7 +1423,6 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr, static int compat_find_calc_match(struct xt_entry_match *m, const struct ip6t_ip6 *ipv6, - unsigned int hookmask, int *size) { struct xt_match *match; @@ -1493,8 +1492,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, entry_offset = (void *)e - (void *)base; j = 0; xt_ematch_foreach(ematch, e) { - ret = compat_find_calc_match(ematch, &e->ipv6, e->comefrom, - &off); + ret = compat_find_calc_match(ematch, &e->ipv6, &off); if (ret != 0) goto release_matches; ++j; -- 2.50.1