From patchwork Tue May 15 12:32:51 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [v3,1/6] netfilter: sanity checks on NFPROTO_NUMPROTO Date: Tue, 15 May 2012 02:32:51 -0000 From: Alban Crequy X-Patchwork-Id: 159311 Message-Id: <1337085171-1907-1-git-send-email-alban.crequy@collabora.co.uk> To: Pablo Neira Ayuso , Patrick McHardy Cc: Alban Crequy , Javier Martinez Canillas , Vincent Sanders , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org With the NFPROTO_* constants introduced by commit 7e9c6e ("netfilter: Introduce NFPROTO_* constants"), it is too easy to confuse PF_* and NFPROTO_* constants in new protocols. Signed-off-by: Alban Crequy --- v2: - use WARN - return -EINVAL v3: - two checkings net/netfilter/core.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/net/netfilter/core.c b/net/netfilter/core.c index e1b7e05..448b531 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -67,6 +67,16 @@ int nf_register_hook(struct nf_hook_ops *reg) struct nf_hook_ops *elem; int err; + if (reg->pf >= NFPROTO_NUMPROTO) { + WARN(1, "netfilter: Invalid nfproto %d\n", reg->pf); + return -EINVAL; + } + + if (reg->hooknum >= NF_MAX_HOOKS) { + WARN(1, "netfilter: Invalid hooknum %d\n", reg->hooknum); + return -EINVAL; + } + err = mutex_lock_interruptible(&nf_hook_mutex); if (err < 0) return err;