diff options
| author | Florian Westphal <fw@strlen.de> | 2018-09-04 16:01:47 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-17 16:11:12 +0200 |
| commit | fa5950e498e7face21a1761f327e6c1152f778c3 (patch) | |
| tree | dcb66f58e24c8412482ce6e89c63ff9158029c30 /net/netfilter/nft_reject.c | |
| parent | 0d704967f4a49cc2212350b3e4a8231f8b4283ed (diff) | |
| download | linux-fa5950e498e7face21a1761f327e6c1152f778c3.tar.gz | |
netfilter: nf_tables: avoid BUG_ON usage
None of these spots really needs to crash the kernel.
In one two cases we can jsut report error to userspace, in the other
cases we can just use WARN_ON (and leak memory instead).
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_reject.c')
| -rw-r--r-- | net/netfilter/nft_reject.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c index 29f5bd2377b0d..b48e58cceeb72 100644 --- a/net/netfilter/nft_reject.c +++ b/net/netfilter/nft_reject.c @@ -94,7 +94,8 @@ static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = { int nft_reject_icmp_code(u8 code) { - BUG_ON(code > NFT_REJECT_ICMPX_MAX); + if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) + return ICMP_NET_UNREACH; return icmp_code_v4[code]; } @@ -111,7 +112,8 @@ static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = { int nft_reject_icmpv6_code(u8 code) { - BUG_ON(code > NFT_REJECT_ICMPX_MAX); + if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) + return ICMPV6_NOROUTE; return icmp_code_v6[code]; } |