Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit adc972c5 authored by Taehee Yoo's avatar Taehee Yoo Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain() 



When depth of chain is bigger than NFT_JUMP_STACK_SIZE, the nft_do_chain
crashes. But there is no need to crash hard here.

Suggested-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
Acked-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0a2cf5ee

net/netfilter/nf_tables_core.c

+2 −1
Original line number Diff line number Diff line
@@ -183,7 +183,8 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) 


	switch (regs.verdict.code) {

	case NFT_JUMP:

		BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);

		if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE))

			return NF_DROP;

		jumpstack[stackptr].chain = chain;

		jumpstack[stackptr].rules = rules + 1;

		stackptr++;