From: Gao Feng <fgao@xxxxxxxxxx>
Although current nf_tables_alloc_handle doesn't allocate any actual
resource, but it should check invalid condition before allocation in
logic.
Signed-off-by: Gao Feng <fgao@xxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a019a87..ecc516c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2175,10 +2175,10 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
} else {
if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
return -EINVAL;
- handle = nf_tables_alloc_handle(table);
-
if (chain->use == UINT_MAX)
return -EOVERFLOW;
+
+ handle = nf_tables_alloc_handle(table);
}
if (nla[NFTA_RULE_POSITION]) {
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
