• Liping Zhang's avatar
    netfilter: nf_tables: fix possible oops when dumping stateful objects · d21e540b
    Liping Zhang authored
    When dumping nft stateful objects, if NFTA_OBJ_TABLE and NFTA_OBJ_TYPE
    attributes are not specified either, filter will become NULL, so oops
    will happen(actually nft utility will always set NFTA_OBJ_TABLE attr,
    so I write a test program to make this happen):
    
      BUG: unable to handle kernel NULL pointer dereference at (null)
      IP: nf_tables_dump_obj+0x17c/0x330 [nf_tables]
      [...]
      Call Trace:
      ? nf_tables_dump_obj+0x5/0x330 [nf_tables]
      ? __kmalloc_reserve.isra.35+0x31/0x90
      ? __alloc_skb+0x5b/0x1e0
      netlink_dump+0x124/0x2a0
      __netlink_dump_start+0x161/0x190
      nf_tables_getobj+0xe8/0x280 [nf_tables]
    
    Fixes: a9fea2a3 ("netfilter: nf_tables: allow to filter stateful object dumps by type")
    Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    d21e540b
nf_tables_api.c 134 KB