netfilter: ipset: Check CIDR value only when attribute is given

[deliverable/linux.git] / net / netfilter / ipset / ip_set_hash_netiface.c

diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index c80588c3071cd18c2f3724743a6fa142b08f6110..7b69fa28d774bba71458713791fafd1ac44a5cb6 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -541,10 +541,12 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
        if (ret)
                return ret;
 
-       if (tb[IPSET_ATTR_CIDR])
+       if (tb[IPSET_ATTR_CIDR]) {
                e.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-       if (e.cidr > HOST_MASK)
-               return -IPSET_ERR_INVALID_CIDR;
+               if (e.cidr > HOST_MASK)
+                       return -IPSET_ERR_INVALID_CIDR;
+       }
+
        ip6_netmask(&e.ip, e.cidr);
 
        strcpy(iface, nla_data(tb[IPSET_ATTR_IFACE]));