Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 493618a9 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_compat: fix hook validation for non-base chains 



Set hook_mask to zero for non-base chains, otherwise people may hit
bogus errors from the xt_check_target() and xt_check_match() when
validating the uninitialized hook_mask.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7210e4e3

net/netfilter/nft_compat.c

+4 −0
Original line number Diff line number Diff line
@@ -95,6 +95,8 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par, 
		const struct nf_hook_ops *ops = &basechain->ops[0];



		par->hook_mask = 1 << ops->hooknum;

	} else {

		par->hook_mask = 0;

	}

	par->family	= ctx->afi->family;

}
@@ -293,6 +295,8 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, 
		const struct nf_hook_ops *ops = &basechain->ops[0];



		par->hook_mask = 1 << ops->hooknum;

	} else {

		par->hook_mask = 0;

	}

	par->family	= ctx->afi->family;

}