| Message ID | 20210309022854.17904-1-baijiaju1990@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | net: bridge: fix error return code of do_update_counters() | expand |
On 2021/3/9 19:01, Florian Westphal wrote: > Jia-Ju Bai <baijiaju1990@gmail.com> wrote: >> When find_table_lock() returns NULL to t, no error return code of >> do_update_counters() is assigned. > Its -ENOENT. > >> t = find_table_lock(net, name, &ret, &ebt_mutex); > ^^^^^ > > ret is passed to find_table_lock, which passes it to > find_inlist_lock_noload() which will set *ret = -ENOENT > for NULL case. Thanks for the reply! I did not notice "&ret" in find_table_lock()... I am sorry for the false positive. Best wishes, Jia-Ju Bai
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index ebe33b60efd6..66c9e4077985 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -1256,8 +1256,10 @@ static int do_update_counters(struct net *net, const char *name, return -ENOMEM; t = find_table_lock(net, name, &ret, &ebt_mutex); - if (!t) + if (!t) { + ret = -ENOENT; goto free_tmp; + } if (num_counters != t->private->nentries) { ret = -EINVAL;
When find_table_lock() returns NULL to t, no error return code of do_update_counters() is assigned. To fix this bug, ret is assigned with -ENOENT in this case. Fixes: 49facff9f925 ("netfilter: ebtables: split update_counters into two functions") Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- net/bridge/netfilter/ebtables.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)