From: Chuck Ebbert <76306.1226@compuserve.com> We cannot compute the gap until we know we have a 'struct ebt_entry' and not 'struct ebt_entries'. Failure to check can cause crash. Tested-by: Santiago Garcia Mantinan Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com> Cc: Patrick McHardy Cc: "David S. Miller" Cc: Signed-off-by: Andrew Morton --- net/bridge/netfilter/ebtables.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff -puN net/bridge/netfilter/ebtables.c~ebtables-dont-compute-gap-before-checking-struct net/bridge/netfilter/ebtables.c --- a/net/bridge/netfilter/ebtables.c~ebtables-dont-compute-gap-before-checking-struct +++ a/net/bridge/netfilter/ebtables.c @@ -610,7 +610,7 @@ ebt_check_entry(struct ebt_entry *e, str struct ebt_entry_target *t; struct ebt_target *target; unsigned int i, j, hook = 0, hookmask = 0; - size_t gap = e->next_offset - e->target_offset; + size_t gap; int ret; /* don't mess with the struct ebt_entries */ @@ -660,6 +660,7 @@ ebt_check_entry(struct ebt_entry *e, str if (ret != 0) goto cleanup_watchers; t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); + gap = e->next_offset - e->target_offset; target = find_target_lock(t->u.name, &ret, &ebt_mutex); if (!target) goto cleanup_watchers; _