From patchwork Mon May 14 13:56:34 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [1/6] netfilter: sanity checks on NFPROTO_NUMPROTO Date: Mon, 14 May 2012 03:56:34 -0000 From: Alban Crequy X-Patchwork-Id: 159021 Message-Id: <1337003799-2517-1-git-send-email-alban.crequy@collabora.co.uk> To: Pablo Neira Ayuso , Patrick McHardy Cc: Vincent Sanders , Javier Martinez Canillas , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, Alban Crequy With the NFPROTO_* constants introduced by commit 7e9c6e ("netfilter: Introduce NFPROTO_* constants"), it is too easy to confuse PF_* and NFPROTO_* constants in new protocols. Signed-off-by: Alban Crequy Reviewed-by: Javier Martinez Canillas Reviewed-by: Vincent Sanders --- net/netfilter/core.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/net/netfilter/core.c b/net/netfilter/core.c index e1b7e05..4f16552 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -67,6 +67,11 @@ int nf_register_hook(struct nf_hook_ops *reg) struct nf_hook_ops *elem; int err; + if (reg->pf >= NFPROTO_NUMPROTO || reg->hooknum >= NF_MAX_HOOKS) { + BUG(); + return 1; + } + err = mutex_lock_interruptible(&nf_hook_mutex); if (err < 0) return err;