From patchwork Tue May 15 12:32:51 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alban Crequy X-Patchwork-Id: 159311 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 5097EB6FB4 for ; Tue, 15 May 2012 22:33:25 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758721Ab2EOMdX (ORCPT ); Tue, 15 May 2012 08:33:23 -0400 Received: from bhuna.collabora.co.uk ([93.93.135.160]:50230 "EHLO bhuna.collabora.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758666Ab2EOMdW (ORCPT ); Tue, 15 May 2012 08:33:22 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: alban) with ESMTPSA id 74FDD600183 From: Alban Crequy To: Pablo Neira Ayuso , Patrick McHardy Cc: Alban Crequy , Javier Martinez Canillas , Vincent Sanders , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v3 1/6] netfilter: sanity checks on NFPROTO_NUMPROTO Date: Tue, 15 May 2012 13:32:51 +0100 Message-Id: <1337085171-1907-1-git-send-email-alban.crequy@collabora.co.uk> X-Mailer: git-send-email 1.7.2.5 In-Reply-To: <20120514190416.GD14897@1984> References: <20120514190416.GD14897@1984> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org With the NFPROTO_* constants introduced by commit 7e9c6e ("netfilter: Introduce NFPROTO_* constants"), it is too easy to confuse PF_* and NFPROTO_* constants in new protocols. Signed-off-by: Alban Crequy --- v2: - use WARN - return -EINVAL v3: - two checkings net/netfilter/core.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/net/netfilter/core.c b/net/netfilter/core.c index e1b7e05..448b531 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -67,6 +67,16 @@ int nf_register_hook(struct nf_hook_ops *reg) struct nf_hook_ops *elem; int err; + if (reg->pf >= NFPROTO_NUMPROTO) { + WARN(1, "netfilter: Invalid nfproto %d\n", reg->pf); + return -EINVAL; + } + + if (reg->hooknum >= NF_MAX_HOOKS) { + WARN(1, "netfilter: Invalid hooknum %d\n", reg->hooknum); + return -EINVAL; + } + err = mutex_lock_interruptible(&nf_hook_mutex); if (err < 0) return err;