--- net/netfilter/nf_log.c

+++ net/netfilter/nf_log.c

@@ -83,6 +83,8 @@ EXPORT_SYMBOL(nf_log_unregister);

int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)

{

+ if (pf >= ARRAY_SIZE(nf_loggers))

+ return -EINVAL;

mutex_lock(&nf_log_mutex);

if (__find_logger(pf, logger->name) == NULL) {

mutex_unlock(&nf_log_mutex);

@@ -96,6 +98,8 @@ EXPORT_SYMBOL(nf_log_bind_pf);

void nf_log_unbind_pf(u_int8_t pf)

{

+ if (pf >= ARRAY_SIZE(nf_loggers))

+ return;

mutex_lock(&nf_log_mutex);

rcu_assign_pointer(nf_loggers[pf], NULL);

mutex_unlock(&nf_log_mutex);