| Message ID | 1337085171-1907-1-git-send-email-alban.crequy@collabora.co.uk |
|---|---|
| State | Not Applicable |
| Headers | show |
diff --git a/net/netfilter/core.c b/net/netfilter/core.c index e1b7e05..448b531 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -67,6 +67,16 @@ int nf_register_hook(struct nf_hook_ops *reg) struct nf_hook_ops *elem; int err; + if (reg->pf >= NFPROTO_NUMPROTO) { + WARN(1, "netfilter: Invalid nfproto %d\n", reg->pf); + return -EINVAL; + } + + if (reg->hooknum >= NF_MAX_HOOKS) { + WARN(1, "netfilter: Invalid hooknum %d\n", reg->hooknum); + return -EINVAL; + } + err = mutex_lock_interruptible(&nf_hook_mutex); if (err < 0) return err;
With the NFPROTO_* constants introduced by commit 7e9c6e ("netfilter: Introduce NFPROTO_* constants"), it is too easy to confuse PF_* and NFPROTO_* constants in new protocols. Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk> --- v2: - use WARN - return -EINVAL v3: - two checkings net/netfilter/core.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)