Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92b4423e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: fix IS_ERR_VALUE usage 

This is a forward-port of the original patch from Andrzej Hajda,
he said:

"IS_ERR_VALUE should be used only with unsigned long type.
Otherwise it can work incorrectly. To achieve this function
xt_percpu_counter_alloc is modified to return unsigned long,
and its result is assigned to temporary variable to perform
error checking, before assigning to .pcnt field.

The patch follows conclusion from discussion on LKML [1][2].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2120927
[2]: http://permalink.gmane.org/gmane.linux.kernel/2150581"

Original patch from Andrzej is here:

http://patchwork.ozlabs.org/patch/582970/



This patch has clashed with input validation fixes for x_tables.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6cd54fc6

include/linux/netfilter/x_tables.h

+3 −3
Original line number Diff line number Diff line
@@ -380,16 +380,16 @@ static inline unsigned long ifname_compare_aligned(const char *_a, 
 * allows us to return 0 for single core systems without forcing

 * callers to deal with SMP vs. NONSMP issues.

 */

static inline u64 xt_percpu_counter_alloc(void)

static inline unsigned long xt_percpu_counter_alloc(void)

{

	if (nr_cpu_ids > 1) {

		void __percpu *res = __alloc_percpu(sizeof(struct xt_counters),

						    sizeof(struct xt_counters));



		if (res == NULL)

			return (u64) -ENOMEM;

			return -ENOMEM;



		return (u64) (__force unsigned long) res;

		return (__force unsigned long) res;

	}



	return 0;

net/ipv4/netfilter/arp_tables.c

+4 −2
Original line number Diff line number Diff line
@@ -513,11 +513,13 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) 
{

	struct xt_entry_target *t;

	struct xt_target *target;

	unsigned long pcnt;

	int ret;



	e->counters.pcnt = xt_percpu_counter_alloc();

	if (IS_ERR_VALUE(e->counters.pcnt))

	pcnt = xt_percpu_counter_alloc();

	if (IS_ERR_VALUE(pcnt))

		return -ENOMEM;

	e->counters.pcnt = pcnt;



	t = arpt_get_target(e);

	target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,

net/ipv4/netfilter/ip_tables.c

+4 −2
Original line number Diff line number Diff line
@@ -656,10 +656,12 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, 
	unsigned int j;

	struct xt_mtchk_param mtpar;

	struct xt_entry_match *ematch;

	unsigned long pcnt;



	e->counters.pcnt = xt_percpu_counter_alloc();

	if (IS_ERR_VALUE(e->counters.pcnt))

	pcnt = xt_percpu_counter_alloc();

	if (IS_ERR_VALUE(pcnt))

		return -ENOMEM;

	e->counters.pcnt = pcnt;



	j = 0;

	mtpar.net	= net;

net/ipv6/netfilter/ip6_tables.c

+4 −2
Original line number Diff line number Diff line
@@ -669,10 +669,12 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, 
	unsigned int j;

	struct xt_mtchk_param mtpar;

	struct xt_entry_match *ematch;

	unsigned long pcnt;



	e->counters.pcnt = xt_percpu_counter_alloc();

	if (IS_ERR_VALUE(e->counters.pcnt))

	pcnt = xt_percpu_counter_alloc();

	if (IS_ERR_VALUE(pcnt))

		return -ENOMEM;

	e->counters.pcnt = pcnt;



	j = 0;

	mtpar.net	= net;