netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
authorLiping Zhang <zlpnobody@gmail.com>
Sun, 19 Mar 2017 14:35:59 +0000 (22:35 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 21 Mar 2017 14:47:09 +0000 (15:47 +0100)
commitae5c682113f9f94cc5e76f92cf041ee624c173ee
tree228c9db7cad11d2de27c8614237016ca4d7dce4f
parentdb7f00b8dba6d687b6ab1f2e9309acfd214fcb4b
netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max

The helper->expect_class_max must be set to the total number of
expect_policy minus 1, since we will use the statement "if (class >
helper->expect_class_max)" to validate the CTA_EXPECT_CLASS attr in
ctnetlink_alloc_expect.

So for compatibility, set the helper->expect_class_max to the
NFCTH_POLICY_SET_NUM attr's value minus 1.

Also: it's invalid when the NFCTH_POLICY_SET_NUM attr's value is zero.
1. this will result "expect_policy = kzalloc(0, GFP_KERNEL);";
2. we cannot set the helper->expect_class_max to a proper value.

So if nla_get_be32(tb[NFCTH_POLICY_SET_NUM]) is zero, report -EINVAL to
the userspace.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nfnetlink_cthelper.c