netfilter: compat: prepare xt_compat_init_offsets to return errors

BugLink: http://bugs.launchpad.net/bugs/1774063
commit 9782a11efc072faaf91d4aa60e9d23553f918029 upstream.

should have no impact, function still always returns 0.
This patch is only to ease review.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 56c4ed8c91b8ef30b1242b749a913b9160f80629..54f346a45cd0aa57a9502919dfa92709a66ec1c6 100644 (file)
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -508,7 +508,7 @@ void xt_compat_unlock(u_int8_t af);
 
 int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta);
 void xt_compat_flush_offsets(u_int8_t af);
-void xt_compat_init_offsets(u_int8_t af, unsigned int number);
+int xt_compat_init_offsets(u8 af, unsigned int number);
 int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
 
 int xt_compat_match_offset(const struct xt_match *match);

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 895ba1cd9750214966b905264dda8c41d61329e4..4caa3d6b9dbf6edf7620dff4070698fd1c40d630 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1819,10 +1819,14 @@ static int compat_table_info(const struct ebt_table_info *info,
 {
        unsigned int size = info->entries_size;
        const void *entries = info->entries;
+       int ret;
 
        newinfo->entries_size = size;
 
-       xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
+       ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
+       if (ret)
+               return ret;
+
        return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
                                                        entries, newinfo);
 }
@@ -2256,7 +2260,9 @@ static int compat_do_replace(struct net *net, void __user *user,
 
        xt_compat_lock(NFPROTO_BRIDGE);
 
-       xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+       ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+       if (ret < 0)
+               goto out_unlock;
        ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
        if (ret < 0)
                goto out_unlock;

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 76cdb7c23cc5c63fc1118adbf2f4815a32cadd71..f72fd78ff2f8d6b50ab308a46ca557769dfa7978 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -803,7 +803,9 @@ static int compat_table_info(const struct xt_table_info *info,
        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
        newinfo->initial_entries = 0;
        loc_cpu_entry = info->entries;
-       xt_compat_init_offsets(NFPROTO_ARP, info->number);
+       ret = xt_compat_init_offsets(NFPROTO_ARP, info->number);
+       if (ret)
+               return ret;
        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
                if (ret != 0)
@@ -1191,7 +1193,7 @@ static int translate_compat_table(struct xt_table_info **pinfo,
        struct compat_arpt_entry *iter0;
        struct arpt_replace repl;
        unsigned int size;
-       int ret = 0;
+       int ret;
 
        info = *pinfo;
        entry0 = *pentry0;
@@ -1200,7 +1202,9 @@ static int translate_compat_table(struct xt_table_info **pinfo,
 
        j = 0;
        xt_compat_lock(NFPROTO_ARP);
-       xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
+       ret = xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
+       if (ret)
+               goto out_unlock;
        /* Walk through entries, checking offsets. */
        xt_entry_foreach(iter0, entry0, compatr->size) {
                ret = check_compat_entry_size_and_hooks(iter0, info, &size,

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index f12e335f346f3054e22148e484521e0241f5a33c..abaacb79995ec60863fe0c36652efa313f3bf802 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -967,7 +967,9 @@ static int compat_table_info(const struct xt_table_info *info,
        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
        newinfo->initial_entries = 0;
        loc_cpu_entry = info->entries;
-       xt_compat_init_offsets(AF_INET, info->number);
+       ret = xt_compat_init_offsets(AF_INET, info->number);
+       if (ret)
+               return ret;
        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
                if (ret != 0)
@@ -1442,7 +1444,9 @@ translate_compat_table(struct net *net,
 
        j = 0;
        xt_compat_lock(AF_INET);
-       xt_compat_init_offsets(AF_INET, compatr->num_entries);
+       ret = xt_compat_init_offsets(AF_INET, compatr->num_entries);
+       if (ret)
+               goto out_unlock;
        /* Walk through entries, checking offsets. */
        xt_entry_foreach(iter0, entry0, compatr->size) {
                ret = check_compat_entry_size_and_hooks(iter0, info, &size,

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 9ab6ee3f5fcee248debd77831e490c2b18dd3316..09116f0aa0764f1982b6d8fef27680b0edfb1e09 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -984,7 +984,9 @@ static int compat_table_info(const struct xt_table_info *info,
        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
        newinfo->initial_entries = 0;
        loc_cpu_entry = info->entries;
-       xt_compat_init_offsets(AF_INET6, info->number);
+       ret = xt_compat_init_offsets(AF_INET6, info->number);
+       if (ret)
+               return ret;
        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
                if (ret != 0)
@@ -1449,7 +1451,7 @@ translate_compat_table(struct net *net,
        struct compat_ip6t_entry *iter0;
        struct ip6t_replace repl;
        unsigned int size;
-       int ret = 0;
+       int ret;
 
        info = *pinfo;
        entry0 = *pentry0;
@@ -1458,7 +1460,9 @@ translate_compat_table(struct net *net,
 
        j = 0;
        xt_compat_lock(AF_INET6);
-       xt_compat_init_offsets(AF_INET6, compatr->num_entries);
+       ret = xt_compat_init_offsets(AF_INET6, compatr->num_entries);
+       if (ret)
+               goto out_unlock;
        /* Walk through entries, checking offsets. */
        xt_entry_foreach(iter0, entry0, compatr->size) {
                ret = check_compat_entry_size_and_hooks(iter0, info, &size,

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 6d7c94165a0a3ae065c0b0234843bb76d42449b3..46608dddf3b8993041e3361eb0030a441c49276b 100644 (file)
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -605,10 +605,12 @@ int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
 }
 EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
 
-void xt_compat_init_offsets(u_int8_t af, unsigned int number)
+int xt_compat_init_offsets(u8 af, unsigned int number)
 {
        xt[af].number = number;
        xt[af].cur = 0;
+
+       return 0;
 }
 EXPORT_SYMBOL(xt_compat_init_offsets);