diff options
| author |   Patrick McHardy <kaber@trash.net> | 2014-01-09 18:42:33 +0000 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2014-01-09 20:17:13 +0100 |
| commit | 758206760cbadf66dc31d6587f5958691b34e9e5 (patch) | |
| tree | 9cb7750c1912a640347f3eeaa88ec87143d60e22 /net/netfilter | |
| parent | netfilter: nf_tables: restore chain change atomicity (diff) | |
| download | linux-dev-758206760cbadf66dc31d6587f5958691b34e9e5.tar.xz linux-dev-758206760cbadf66dc31d6587f5958691b34e9e5.zip | |
netfilter: nf_tables: fix check for table overflow
The table use counter is only increased for new chains, so move the check
to the correct position.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d275d384bbc5..290472c0bf4f 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -834,9 +834,6 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, if (IS_ERR(table)) return PTR_ERR(table); - if (table->use == UINT_MAX) - return -EOVERFLOW; - chain = NULL; name = nla[NFTA_CHAIN_NAME]; @@ -899,6 +896,9 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, goto notify; } + if (table->use == UINT_MAX) + return -EOVERFLOW; + if (nla[NFTA_CHAIN_HOOK]) { struct nf_hook_ops *ops; nf_hookfn *hookfn; |