Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755272Ab0KKTKR (ORCPT ); Thu, 11 Nov 2010 14:10:17 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58414 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751977Ab0KKTKQ (ORCPT ); Thu, 11 Nov 2010 14:10:16 -0500 From: Eric Paris Subject: [PATCH] netfilter: NF_HOOK_COND has wrong conditional To: netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org, coreteam@netfilter.org Cc: kaber@trash.net, linux-kernel@vger.kernel.org Date: Thu, 11 Nov 2010 14:09:54 -0500 Message-ID: <20101111190954.29005.61686.stgit@paris.rdu.redhat.com> User-Agent: StGIT/0.14.3 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1563 Lines: 40 The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an error in the code as the order of operations is not what was intended. C will evalutate == before =. Which means ret is getting set to the bool result, rather than the return value of the function call. The code says if (ret = function() == 1) when it meant to say: if ((ret = function()) == 1) Normally the compiler would warn, but it doesn't notice it because its a actually complex conditional and so the wrong code is wrapped in an explict set of () [exactly what the compiler wants you to do if this was intentional]. Fixing this means that errors when netfilter denies a packet get propagated back up the stack rather than lost. Signed-off-by: Eric Paris --- include/linux/netfilter.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 89341c3..03317c8 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -215,7 +215,7 @@ NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb, int ret; if (!cond || - (ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN) == 1)) + ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1)) ret = okfn(skb); return ret; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/