If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the
rule and then tries to add it to the rule cache. Better return 0
(failure) instead of continuing.
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
iptables/nft.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index b893859d28660..1c076510962b3 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1173,8 +1173,10 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
} else
type = NFT_COMPAT_RULE_APPEND;
- if (batch_rule_add(h, type, r) < 0)
+ if (batch_rule_add(h, type, r) < 0) {
nftnl_rule_free(r);
+ return 0;
+ }
if (verbose)
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
--
2.18.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
