From: Patrick McHardy Date: Thu, 9 Jan 2014 18:42:33 +0000 (+0000) Subject: netfilter: nf_tables: fix check for table overflow X-Git-Tag: archive/raspbian/4.9.13-1+rpi1~10^2~7273^2~245^2~10 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=758206760cbadf66dc31d6587f5958691b34e9e5;p=linux-4.9.git netfilter: nf_tables: fix check for table overflow The table use counter is only increased for new chains, so move the check to the correct position. Signed-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d275d384bbc5..290472c0bf4f 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -834,9 +834,6 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, if (IS_ERR(table)) return PTR_ERR(table); - if (table->use == UINT_MAX) - return -EOVERFLOW; - chain = NULL; name = nla[NFTA_CHAIN_NAME]; @@ -899,6 +896,9 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, goto notify; } + if (table->use == UINT_MAX) + return -EOVERFLOW; + if (nla[NFTA_CHAIN_HOOK]) { struct nf_hook_ops *ops; nf_hookfn *hookfn;