The number of `expr` expressions provided by userspace may exceed the declared set expressions, potentially leading to errors or undefined behavior. This patch addresses the issue by validating whether i exceeds set->num_exprs. This patch is inspired by commit 3701cd390fd7("netfilter: nf_tables: bail out on mismatching dynset and set expressions"). Signed-off-by: Chen Yufeng --- net/netfilter/nf_tables_api.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 58c5425d61c2..958a7c8b0b4c 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7338,9 +7338,15 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, expr_array[i] = expr; num_exprs++; - if (set->num_exprs && expr->ops != set->exprs[i]->ops) { - err = -EOPNOTSUPP; - goto err_set_elem_expr; + if (set->num_exprs) { + if (i >= set->num_exprs) { + err = -EINVAL; + goto err_set_elem_expr; + } + if (expr->ops != set->exprs[i]->ops) { + err = -EOPNOTSUPP; + goto err_set_elem_expr; + } } i++; } -- 2.34.1