From: Gao Feng <[email protected]> Although current nf_tables_alloc_handle doesn't allocate any actual resource, but it should check invalid condition before allocation in logic.
Signed-off-by: Gao Feng <[email protected]> --- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index a019a87..ecc516c 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2175,10 +2175,10 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, } else { if (!create || nlh->nlmsg_flags & NLM_F_REPLACE) return -EINVAL; - handle = nf_tables_alloc_handle(table); - if (chain->use == UINT_MAX) return -EOVERFLOW; + + handle = nf_tables_alloc_handle(table); } if (nla[NFTA_RULE_POSITION]) { -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
