|
 |
f1d1c0 |
From 55c537734f476d04c18f67083642b96bbead6219 Mon Sep 17 00:00:00 2001
|
|
|
f1d1c0 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
f1d1c0 |
Date: Mon, 27 Jan 2020 16:11:41 +0100
|
|
|
f1d1c0 |
Subject: [PATCH] netlink: Avoid potential NULL-pointer deref in
|
|
|
f1d1c0 |
netlink_gen_payload_stmt()
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1793030
|
|
|
f1d1c0 |
Upstream Status: nftables commit c9ddf0bff363f
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
commit c9ddf0bff363fc9101b563b592db600bdf4d65c5
|
|
|
f1d1c0 |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
f1d1c0 |
Date: Mon Jan 20 16:32:40 2020 +0100
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
netlink: Avoid potential NULL-pointer deref in netlink_gen_payload_stmt()
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
With payload_needs_l4csum_update_pseudohdr() unconditionally
|
|
|
f1d1c0 |
dereferencing passed 'desc' parameter and a previous check for it to be
|
|
|
f1d1c0 |
non-NULL, make sure to call the function only if input is sane.
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
Fixes: 68de70f2b3fc6 ("netlink_linearize: fix IPv6 layer 4 checksum mangling")
|
|
|
f1d1c0 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
f1d1c0 |
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
f1d1c0 |
---
|
|
|
f1d1c0 |
src/netlink_linearize.c | 2 +-
|
|
|
f1d1c0 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
|
|
|
f1d1c0 |
index 498326d..cb1b7fe 100644
|
|
|
f1d1c0 |
--- a/src/netlink_linearize.c
|
|
|
f1d1c0 |
+++ b/src/netlink_linearize.c
|
|
|
f1d1c0 |
@@ -941,7 +941,7 @@ static void netlink_gen_payload_stmt(struct netlink_linearize_ctx *ctx,
|
|
|
f1d1c0 |
nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_CSUM_OFFSET,
|
|
|
f1d1c0 |
csum_off / BITS_PER_BYTE);
|
|
|
f1d1c0 |
}
|
|
|
f1d1c0 |
- if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
|
|
|
f1d1c0 |
+ if (expr->payload.base == PROTO_BASE_NETWORK_HDR && desc &&
|
|
|
f1d1c0 |
payload_needs_l4csum_update_pseudohdr(expr, desc))
|
|
|
f1d1c0 |
nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
|
|
|
f1d1c0 |
NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
|
|
|
f1d1c0 |
--
|
|
|
bfbb76 |
2.31.1
|
|
|
f1d1c0 |
|