[NETFILTER]: nfnetlink_queue: fix nfnetlink message size

Fix oversized message, use NLMSG_SPACE just one since it reserves space
for the netlink header and NFA_SPACE for every attribute.

Thanks to Harald Welte for the feedback

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 2cf5fb8322c4942ab3fce8158cf1f4333ab037d2..b5701662182ecbc064fce8c5f036b176574101a9 100644 (file)
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -354,16 +354,17 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
        QDEBUG("entered\n");
 
        /* all macros expand to constant values at compile time */
-       size =    NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
-               + NLMSG_SPACE(sizeof(u_int32_t))        /* ifindex */
-               + NLMSG_SPACE(sizeof(u_int32_t))        /* ifindex */
+       size =    NLMSG_SPACE(sizeof(struct nfgenmsg)) +
+               + NFA_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
+               + NFA_SPACE(sizeof(u_int32_t))  /* ifindex */
+               + NFA_SPACE(sizeof(u_int32_t))  /* ifindex */
 #ifdef CONFIG_BRIDGE_NETFILTER
-               + NLMSG_SPACE(sizeof(u_int32_t))        /* ifindex */
-               + NLMSG_SPACE(sizeof(u_int32_t))        /* ifindex */
+               + NFA_SPACE(sizeof(u_int32_t))  /* ifindex */
+               + NFA_SPACE(sizeof(u_int32_t))  /* ifindex */
 #endif
-               + NLMSG_SPACE(sizeof(u_int32_t))        /* mark */
-               + NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))
-               + NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
+               + NFA_SPACE(sizeof(u_int32_t))  /* mark */
+               + NFA_SPACE(sizeof(struct nfqnl_msg_packet_hw))
+               + NFA_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
 
        outdev = entinf->outdev;
 
@@ -388,7 +389,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
                else
                        data_len = queue->copy_range;
                
-               size += NLMSG_SPACE(data_len);
+               size += NFA_SPACE(data_len);
                break;
        
        default: