netfilter: xt_CT: checking for IS_ERR() instead of NULL

We recently changed this from nf_conntrack_alloc() to nf_ct_tmpl_alloc() so the error handling needs to changed to check for NULL instead of IS_ERR().

Fixes 0838aa7fcfcd ('netfilter: fix netns dependencies with conntrack templates')

Signed-off-by Dan Carpenter <[email protected]>

net/netfilter/xt_CT.c +3 -2

index c663003..43ddeee 100644
@@ -202,9 +202,10 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err1;
 
 	ct = nf_ct_tmpl_alloc(par->net, info->zone, GFP_KERNEL);
-	ret = PTR_ERR(ct);
-	if (IS_ERR(ct))
+	if (!ct) {
+		ret = -ENOMEM;
 		goto err2;
+	}
 
 	ret = 0;
 	if ((info->ct_events || info->exp_events) &&

I have also appended this chunk, since synproxy is also affected:

Quoted 1 line · Pablo Neira Ayuso

I have also appended this chunk, since synproxy is also affected:

Thanks. I have rechecked my scripts and I *should* have caught that. I'm not sure what went wrong...

Quoted 6 lines · Dan Carpenter

We recently changed this from nf_conntrack_alloc() to nf_ct_tmpl_alloc() so the error handling needs to changed to check for NULL instead of IS_ERR().

Fixes 0838aa7fcfcd ('netfilter: fix netns dependencies with conntrack templates')

Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks.

I have also appended this chunk, since synproxy is also affected:

Quoted 17 lines · Pablo Neira Ayuso

Quoted 6 lines · Dan Carpenter

We recently changed this from nf_conntrack_alloc() to nf_ct_tmpl_alloc() so the error handling needs to changed to check for NULL instead of IS_ERR().

Fixes 0838aa7fcfcd ('netfilter: fix netns dependencies with conntrack templates')

Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks.

I have also appended this chunk, since synproxy is also affected:

net/netfilter/nf_synproxy_core.c +0 -0

@@ -353,7 +353,7 @@ static int __net_init synproxy_net_init(struct net *net)
        int err = -ENOMEM;
 

net/netfilter/nf_synproxy_core.c static int __net_init synproxy_net_init(struct net *net) · line 359

Quoted 6 lines

net/netfilter/nf_synproxy_core.c +1 -1

        ct = nf_ct_tmpl_alloc(net, 0, GFP_KERNEL);
-       if (IS_ERR(ct)) {
+       if (!ct) {
                err = PTR_ERR(ct);
                goto err1;
        }

Does PTR_ERR() implicitly interpret NULL as -ENOMEM? Seems like the fix applied here is a little different from the xt_CT fix.

Quoted 18 lines · Joe Stringer

Quoted 17 lines · Pablo Neira Ayuso

Quoted 6 lines · Dan Carpenter

We recently changed this from nf_conntrack_alloc() to nf_ct_tmpl_alloc() so the error handling needs to changed to check for NULL instead of IS_ERR().

Fixes 0838aa7fcfcd ('netfilter: fix netns dependencies with conntrack templates')

Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks.

I have also appended this chunk, since synproxy is also affected:

net/netfilter/nf_synproxy_core.c +0 -0

@@ -353,7 +353,7 @@ static int __net_init synproxy_net_init(struct net *net)
        int err = -ENOMEM;
 

Quoted 9 lines

net/netfilter/nf_synproxy_core.c static int __net_init synproxy_net_init(struct net *net) · line 359

Quoted 6 lines

net/netfilter/nf_synproxy_core.c +1 -1

        ct = nf_ct_tmpl_alloc(net, 0, GFP_KERNEL);
-       if (IS_ERR(ct)) {
+       if (!ct) {
                err = PTR_ERR(ct);
                goto err1;
        }

Does PTR_ERR() implicitly interpret NULL as -ENOMEM? Seems like the fix applied here is a little different from the xt_CT fix.

Just saw the initialization of err now, but this would be overridden within the error checking statement.

Quoted 29 lines · Joe Stringer

Quoted 18 lines · Joe Stringer

Quoted 17 lines · Pablo Neira Ayuso

Quoted 6 lines · Dan Carpenter

We recently changed this from nf_conntrack_alloc() to nf_ct_tmpl_alloc() so the error handling needs to changed to check for NULL instead of IS_ERR().

Fixes 0838aa7fcfcd ('netfilter: fix netns dependencies with conntrack templates')

Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks.

I have also appended this chunk, since synproxy is also affected:

net/netfilter/nf_synproxy_core.c +0 -0

@@ -353,7 +353,7 @@ static int __net_init synproxy_net_init(struct net *net)
        int err = -ENOMEM;
 

Quoted 9 lines

net/netfilter/nf_synproxy_core.c static int __net_init synproxy_net_init(struct net *net) · line 359

Quoted 6 lines

net/netfilter/nf_synproxy_core.c +1 -1

        ct = nf_ct_tmpl_alloc(net, 0, GFP_KERNEL);
-       if (IS_ERR(ct)) {
+       if (!ct) {
                err = PTR_ERR(ct);
                goto err1;
        }

Does PTR_ERR() implicitly interpret NULL as -ENOMEM? Seems like the fix applied here is a little different from the xt_CT fix.

Quoted 2 lines

Just saw the initialization of err now, but this would be overridden within the error checking statement.

Right, I noticed before pushing out this change, the final applied patch is here:

http://git.kernel.org/cgit/linux/kernel/git/pablo/nf.git/commit/?id727c63612fc582370cf3dc01239d3d239743b5

Let me know if you still have any concern, thanks Joe.