secmark: do not return early if there was no error
authorEric Paris <eparis@redhat.com>
Tue, 12 Oct 2010 15:40:08 +0000 (11:40 -0400)
committerJames Morris <jmorris@namei.org>
Wed, 20 Oct 2010 23:12:47 +0000 (10:12 +1100)
Commit 4a5a5c73 attempted to pass decent error messages back to userspace for
netfilter errors.  In xt_SECMARK.c however the patch screwed up and returned
on 0 (aka no error) early and didn't finish setting up secmark.  This results
in a kernel BUG if you use SECMARK.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
net/netfilter/xt_SECMARK.c

index 23b2d6c486b573927dcefd00b575546b35376bfa..364ad160012994bb32273f8968f8e1eae6620f1f 100644 (file)
@@ -101,7 +101,7 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
        switch (info->mode) {
        case SECMARK_MODE_SEL:
                err = checkentry_selinux(info);
-               if (err <= 0)
+               if (err)
                        return err;
                break;