* [PATCH nf-next 1/2] netfilter: nf_tables: Check chain's use count before alloc new handle in nf_tables_newrule
@ 2016-12-29 3:39 fgao
2017-01-05 12:33 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: fgao @ 2016-12-29 3:39 UTC (permalink / raw)
To: pablo, netfilter-devel; +Cc: gfree.wind, Gao Feng
From: Gao Feng <fgao@ikuai8.com>
Although current nf_tables_alloc_handle doesn't allocate any actual
resource, but it should check invalid condition before allocation in
logic.
Signed-off-by: Gao Feng <fgao@ikuai8.com>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a019a87..ecc516c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2175,10 +2175,10 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
} else {
if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
return -EINVAL;
- handle = nf_tables_alloc_handle(table);
-
if (chain->use == UINT_MAX)
return -EOVERFLOW;
+
+ handle = nf_tables_alloc_handle(table);
}
if (nla[NFTA_RULE_POSITION]) {
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH nf-next 1/2] netfilter: nf_tables: Check chain's use count before alloc new handle in nf_tables_newrule
2016-12-29 3:39 [PATCH nf-next 1/2] netfilter: nf_tables: Check chain's use count before alloc new handle in nf_tables_newrule fgao
@ 2017-01-05 12:33 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2017-01-05 12:33 UTC (permalink / raw)
To: fgao; +Cc: netfilter-devel, gfree.wind
On Thu, Dec 29, 2016 at 11:39:28AM +0800, fgao@ikuai8.com wrote:
> From: Gao Feng <fgao@ikuai8.com>
>
> Although current nf_tables_alloc_handle doesn't allocate any actual
> resource, but it should check invalid condition before allocation in
> logic.
>
> Signed-off-by: Gao Feng <fgao@ikuai8.com>
> ---
> net/netfilter/nf_tables_api.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index a019a87..ecc516c 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -2175,10 +2175,10 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
> } else {
> if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
> return -EINVAL;
> - handle = nf_tables_alloc_handle(table);
> -
> if (chain->use == UINT_MAX)
> return -EOVERFLOW;
> +
> + handle = nf_tables_alloc_handle(table);
NFTA_RULE_POSITION below may also fail, so the handle becomes unused
there too. I think it's not worth trying given that this may only
happen if we hit a crazy number of rules.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-01-05 12:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-29 3:39 [PATCH nf-next 1/2] netfilter: nf_tables: Check chain's use count before alloc new handle in nf_tables_newrule fgao
2017-01-05 12:33 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).