On Thu, Dec 29, 2016 at 11:39:28AM +0800, [email protected] wrote: > From: Gao Feng <[email protected]> > > Although current nf_tables_alloc_handle doesn't allocate any actual > resource, but it should check invalid condition before allocation in > logic. > > Signed-off-by: Gao Feng <[email protected]> > --- > net/netfilter/nf_tables_api.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c > index a019a87..ecc516c 100644 > --- a/net/netfilter/nf_tables_api.c > +++ b/net/netfilter/nf_tables_api.c > @@ -2175,10 +2175,10 @@ static int nf_tables_newrule(struct net *net, struct > sock *nlsk, > } else { > if (!create || nlh->nlmsg_flags & NLM_F_REPLACE) > return -EINVAL; > - handle = nf_tables_alloc_handle(table); > - > if (chain->use == UINT_MAX) > return -EOVERFLOW; > + > + handle = nf_tables_alloc_handle(table);
NFTA_RULE_POSITION below may also fail, so the handle becomes unused there too. I think it's not worth trying given that this may only happen if we hit a crazy number of rules. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
