> In updating a 32bit arm device from 4.6 to Linus' current HEAD, I
> noticed I was having some trouble with networking, and realized that
> /proc/net/ip_tables_names was suddenly empty.
> Digging through the registration process, it seems we're catching on the:
> if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
> target_offset + sizeof(struct xt_standard_target) != next_offset)
> return -EINVAL;
> check added in 7ed2abddd20cf ("netfilter: x_tables: check standard
> target size too").
> Where next_offset seems to be 4 bytes larger then the the offset +
> standard_target struct size.
I guess its because arm32 needs 8 byte alignment for 64bit
quantities. So we can fix this either via XT_ALIGN()'ing the
target_offset + sizeof() result or by weakening the test to a '>'.
Since we already test proper alignment of start-of-rule in
check_entry_size_and_hooks() I'd suggest we just change the test
to fail only if the next offset is within the min size, i.e.: