On Thu, Dec 29, 2016 at 11:39:28AM +0800, fgao@xxxxxxxxxx wrote:
> From: Gao Feng <fgao@xxxxxxxxxx>
>
> Although current nf_tables_alloc_handle doesn't allocate any actual
> resource, but it should check invalid condition before allocation in
> logic.
>
> Signed-off-by: Gao Feng <fgao@xxxxxxxxxx>
> ---
> net/netfilter/nf_tables_api.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index a019a87..ecc516c 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -2175,10 +2175,10 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> } else {
> if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
> return -EINVAL;
> - handle = nf_tables_alloc_handle(table);
> -
> if (chain->use == UINT_MAX)
> return -EOVERFLOW;
> +
> + handle = nf_tables_alloc_handle(table);
NFTA_RULE_POSITION below may also fail, so the handle becomes unused
there too. I think it's not worth trying given that this may only
happen if we hit a crazy number of rules.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
