netfilter: Add the missed return value check of nft_register_chain_type

There are some codes of netfilter module which did not check the return
value of nft_register_chain_type. Add the checks now.

Signed-off-by: Gao Feng <fgao@ikuai8.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/bridge/netfilter/nf_tables_bridge.c b/net/bridge/netfilter/nf_tables_bridge.c
index 06f0f81..97afdc0 100644 (file)
--- a/net/bridge/netfilter/nf_tables_bridge.c
+++ b/net/bridge/netfilter/nf_tables_bridge.c
@@ -139,12 +139,20 @@ static int __init nf_tables_bridge_init(void)
        int ret;
 
        nf_register_afinfo(&nf_br_afinfo);
-       nft_register_chain_type(&filter_bridge);
+       ret = nft_register_chain_type(&filter_bridge);
+       if (ret < 0)
+               goto err1;
+
        ret = register_pernet_subsys(&nf_tables_bridge_net_ops);
-       if (ret < 0) {
-               nft_unregister_chain_type(&filter_bridge);
-               nf_unregister_afinfo(&nf_br_afinfo);
-       }
+       if (ret < 0)
+               goto err2;
+
+       return ret;
+
+err2:
+       nft_unregister_chain_type(&filter_bridge);
+err1:
+       nf_unregister_afinfo(&nf_br_afinfo);
        return ret;
 }
 

diff --git a/net/ipv4/netfilter/nf_tables_arp.c b/net/ipv4/netfilter/nf_tables_arp.c
index 058c034..805c8dd 100644 (file)
--- a/net/ipv4/netfilter/nf_tables_arp.c
+++ b/net/ipv4/netfilter/nf_tables_arp.c
@@ -80,7 +80,10 @@ static int __init nf_tables_arp_init(void)
 {
        int ret;
 
-       nft_register_chain_type(&filter_arp);
+       ret = nft_register_chain_type(&filter_arp);
+       if (ret < 0)
+               return ret;
+
        ret = register_pernet_subsys(&nf_tables_arp_net_ops);
        if (ret < 0)
                nft_unregister_chain_type(&filter_arp);

diff --git a/net/ipv4/netfilter/nf_tables_ipv4.c b/net/ipv4/netfilter/nf_tables_ipv4.c
index e44ba3b..2840a29 100644 (file)
--- a/net/ipv4/netfilter/nf_tables_ipv4.c
+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
@@ -103,7 +103,10 @@ static int __init nf_tables_ipv4_init(void)
 {
        int ret;
 
-       nft_register_chain_type(&filter_ipv4);
+       ret = nft_register_chain_type(&filter_ipv4);
+       if (ret < 0)
+               return ret;
+
        ret = register_pernet_subsys(&nf_tables_ipv4_net_ops);
        if (ret < 0)
                nft_unregister_chain_type(&filter_ipv4);

diff --git a/net/ipv6/netfilter/nf_tables_ipv6.c b/net/ipv6/netfilter/nf_tables_ipv6.c
index 05d0592..d6e4ba5 100644 (file)
--- a/net/ipv6/netfilter/nf_tables_ipv6.c
+++ b/net/ipv6/netfilter/nf_tables_ipv6.c
@@ -100,7 +100,10 @@ static int __init nf_tables_ipv6_init(void)
 {
        int ret;
 
-       nft_register_chain_type(&filter_ipv6);
+       ret = nft_register_chain_type(&filter_ipv6);
+       if (ret < 0)
+               return ret;
+
        ret = register_pernet_subsys(&nf_tables_ipv6_net_ops);
        if (ret < 0)
                nft_unregister_chain_type(&filter_ipv6);

diff --git a/net/netfilter/nf_tables_inet.c b/net/netfilter/nf_tables_inet.c
index 6b5f762..f713cc2 100644 (file)
--- a/net/netfilter/nf_tables_inet.c
+++ b/net/netfilter/nf_tables_inet.c
@@ -82,7 +82,10 @@ static int __init nf_tables_inet_init(void)
 {
        int ret;
 
-       nft_register_chain_type(&filter_inet);
+       ret = nft_register_chain_type(&filter_inet);
+       if (ret < 0)
+               return ret;
+
        ret = register_pernet_subsys(&nf_tables_inet_net_ops);
        if (ret < 0)
                nft_unregister_chain_type(&filter_inet);

diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index 38a3e83..9e2ae42 100644 (file)
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -149,7 +149,10 @@ static int __init nf_tables_netdev_init(void)
 {
        int ret;
 
-       nft_register_chain_type(&nft_filter_chain_netdev);
+       ret = nft_register_chain_type(&nft_filter_chain_netdev);
+       if (ret)
+               return ret;
+
        ret = register_pernet_subsys(&nf_tables_netdev_net_ops);
        if (ret)
                goto err1;