NFT_REJECT_ICMPX_MAX should be __NFT_REJECT_ICMPX_MAX - 1. nft_reject_icmp_code() and nft_reject_icmpv6_code() are called from the packet path, so BUG_ON in case we try to access an unknown abstracted ICMP code. This should not happen since we already validate this from nft_reject_{inet,bridge}_init().
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -774,7 +774,7 @@ enum nft_reject_inet_code { · 773 unmodified lines | ||
| 774 | 774 | NFT_REJECT_ICMPX_ADMIN_PROHIBITED, |
| 775 | 775 | __NFT_REJECT_ICMPX_MAX |
| 776 | 776 | }; |
| 777 | −#define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX + 1) | |
| 777 | +#define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX - 1) | |
| 778 | 778 | |
| 779 | 779 | /** |
| 780 | 780 | * enum nft_reject_attributes - nf_tables reject expression netlink attributes |