netfilter: nft_hash: fix hash overflow validation

The overflow validation in the init() function establishes that the maximum value that the hash could reach is less than U32_MAX, which is likely to be true.

The fix detects the overflow when the maximum hash value is less than the offset itself.

---
 net/netfilter/nft_hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index bd12f7a..09473b4 100644
@@ -76,7 +76,7 @@ static int nft_hash_init(const struct nft_ctx *ctx,
 	if (priv->modulus <= 1)
 		return -ERANGE;
 
-	if (priv->offset + priv->modulus - 1 < U32_MAX)
+	if (priv->offset + priv->modulus - 1 < priv->offset)
 		return -EOVERFLOW;
 
 	priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED]));

2.8.1

Applied.