Re: [iptables PATCH] nft: Exit if nftnl_alloc_expr fails

[Phil Sutter <phil@nwl.cc>]

On Wed, Jun 15, 2022 at 09:04:00AM +0200, Pablo Neira Ayuso wrote:
> On Tue, Jun 14, 2022 at 06:44:57PM +0200, Phil Sutter wrote:
> > In some code-paths, 'reg' pointer remaining unallocated is used later so
> > at least minimal error checking is necessary. Given that a call to
> > nftnl_alloc_expr() should never fail with sane argument, complain and
> > exit if it happens.
> > 
> > Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation")
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> >  iptables/nft-shared.c | 32 +++++++++++++++++---------------
> >  1 file changed, 17 insertions(+), 15 deletions(-)
> > 
> > diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
> > index 27e95c1ae4f38..d603e7c9d663b 100644
> > --- a/iptables/nft-shared.c
> > +++ b/iptables/nft-shared.c
> > @@ -40,15 +40,25 @@ extern struct nft_family_ops nft_family_ops_ipv6;
> >  extern struct nft_family_ops nft_family_ops_arp;
> >  extern struct nft_family_ops nft_family_ops_bridge;
> >  
> > +static struct nftnl_expr *nftnl_expr_alloc_or_die(const char *name)
> 
> better call this:
> 
> xt_nftnl_expr_alloc()
> 
> or such, to not enter nftnl_ namespace, I'd suggest.

ACK, will do.

> > +{
> > +	struct nftnl_expr *expr = nftnl_expr_alloc(name);
> > +
> > +	if (expr)
> > +		return expr;
> > +
> 
> extra line space.

Oh, thanks.