If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the rule and then tries to add it to the rule cache. Better return 0 (failure) instead of continuing.
Signed-off-by: Phil Sutter <[email protected]> --- iptables/nft.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/iptables/nft.c b/iptables/nft.c index b893859d28660..1c076510962b3 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1173,8 +1173,10 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table, } else type = NFT_COMPAT_RULE_APPEND; - if (batch_rule_add(h, type, r) < 0) + if (batch_rule_add(h, type, r) < 0) { nftnl_rule_free(r); + return 0; + } if (verbose) h->ops->print_rule(r, 0, FMT_PRINT_RULE); -- 2.18.0 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
