Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of jumps

[Florian Westphal]

Ben Hutchings <ben@xxxxxxxxxxxxxxx> wrote:
> 3.16.37-rc1 review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Florian Westphal <fw@xxxxxxxxx>
> 
> commit 36472341017529e2b12573093cc0f68719300997 upstream.

[..]

> The extra overhead is negible, even with absurd cases.

Not true, the overhead is huge and increases restore time for
large rulesets from mere seconds to minutes, see

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f4dc77713f8016d2e8a3295e1c9c53a21f296def