[PATCH v1 2/9] sysctl: Fixes nf_conntrack_expect_max bounds
| Newsgroups | gmane.linux.scsi,gmane.linux.kernel,gmane.linux.drivers.rdma,gmane.comp.file-systems.coda.general,gmane.linux.nfs,gmane.linux.network,gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
From: Nicolas Bouchinet <[email protected]> Bound nf_conntrack_expect_max sysctl writings between SYSCTL_ONE and SYSCTL_INT_MAX. The proc_handler has thus been updated to proc_dointvec_minmax. The lower bound is SYSCTL_ONE as defined in the sysctl documentation. Signed-off-by: Nicolas Bouchinet <[email protected]> --- net/netfilter/nf_conntrack_standalone.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 40ed3ef9cb22d..3ea60ff7a6a49 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -657,7 +657,9 @@ static struct ctl_table nf_ct_sysctl_table[] = { .data = &nf_ct_expect_max, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_INT_MAX, }, [NF_SYSCTL_CT_ACCT] = { .procname = "nf_conntrack_acct", -- 2.48.1