diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2023-07-06 12:02:57 +0300 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2023-07-06 12:02:58 +0300 |
| commit | ceb20a3cc52611cb84d164f03e466f64b4ed9fb4 (patch) | |
| tree | ee49c9ba142698d859ed84e60978f012b6993c42 /net/netfilter/nft_objref.c | |
| parent | 21327f81db6337c8843ce755b01523c7d3df715b (diff) | |
| parent | caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd (diff) | |
| download | linux-ceb20a3cc52611cb84d164f03e466f64b4ed9fb4.tar.xz | |
Merge tag 'nf-23-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains Netfilter fixes for net:
1) Fix missing overflow use refcount checks in nf_tables.
2) Do not set IPS_ASSURED for IPS_NAT_CLASH entries in GRE tracker,
from Florian Westphal.
3) Bail out if nf_ct_helper_hash is NULL before registering helper,
from Florent Revest.
4) Use siphash() instead siphash_4u64() to fix performance regression,
also from Florian.
5) Do not allow to add rules to removed chains via ID,
from Thadeu Lima de Souza Cascardo.
6) Fix oob read access in byteorder expression, also from Thadeu.
netfilter pull request 23-07-06
====================
Link: https://lore.kernel.org/r/20230705230406.52201-1-pablo@netfilter.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/netfilter/nft_objref.c')
| -rw-r--r-- | net/netfilter/nft_objref.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c index a48dd5b5d45b..509011b1ef59 100644 --- a/net/netfilter/nft_objref.c +++ b/net/netfilter/nft_objref.c @@ -41,8 +41,10 @@ static int nft_objref_init(const struct nft_ctx *ctx, if (IS_ERR(obj)) return -ENOENT; + if (!nft_use_inc(&obj->use)) + return -EMFILE; + nft_objref_priv(expr) = obj; - obj->use++; return 0; } @@ -72,7 +74,7 @@ static void nft_objref_deactivate(const struct nft_ctx *ctx, if (phase == NFT_TRANS_COMMIT) return; - obj->use--; + nft_use_dec(&obj->use); } static void nft_objref_activate(const struct nft_ctx *ctx, @@ -80,7 +82,7 @@ static void nft_objref_activate(const struct nft_ctx *ctx, { struct nft_object *obj = nft_objref_priv(expr); - obj->use++; + nft_use_inc_restore(&obj->use); } static const struct nft_expr_ops nft_objref_ops = { |