Re: [PATCH nf-next] netfilter: fix IS_ERR_VALUE usage

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Apr 29, 2016 at 11:17:54AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > This is a forward-ported original patch from Andrzej Hajda, he said:
> > 
> > "IS_ERR_VALUE should be used only with unsigned long type.
> > Otherwise it can work incorrectly. To achieve this function
> > xt_percpu_counter_alloc is modified to return unsigned long,
> > and its result is assigned to temporary variable to perform
> > error checking, before assigning to .pcnt field.
> > 
> > The patch follows conclusion from discussion on LKML [1][2].
> > 
> > [1]: http://permalink.gmane.org/gmane.linux.kernel/2120927
> > [2]: http://permalink.gmane.org/gmane.linux.kernel/2150581"
> > 
> > Original patch from Andrzej is here:
> > 
> > http://patchwork.ozlabs.org/patch/582970/
> > 
> > This patch has clashed with input validation fixes for x_tables.
> 
> AFAICS this isn't a bug fix so I'm fine with this going into nf-next.

This seems to affect 32-bits arch, we could qualify this as nf. But
this has been there for a while without nobody noticing in runtime
kernels, this problem got uncovered by analysis I think.