[prev in list] [next in list] [prev in thread] [next in thread]
List: kernel-janitors
Subject: Re: [PATCH][next] netfilter: nf_tables: Fix dereference of null pointer flow
From: Pablo Neira Ayuso <pablo () netfilter ! org>
Date: 2021-06-25 10:20:21
Message-ID: 20210625102021.GA32352 () salvia
[Download RAW message or body]
Hi,
On Fri, Jun 25, 2021 at 12:59:01PM +0300, Dan Carpenter wrote:
> Btw, why is there no clean up if nft_table_validate() fails?
See below.
> net/netfilter/nf_tables_api.c
> 3432 list_add_tail_rcu(&rule->list, &old_rule->list);
> 3433 else
> 3434 list_add_rcu(&rule->list, &chain->rules);
> 3435 }
> 3436 }
> 3437 kvfree(expr_info);
> 3438 chain->use++;
> 3439
> 3440 if (flow)
> 3441 nft_trans_flow_rule(trans) = flow;
> 3442
> 3443 if (nft_net->validate_state == NFT_VALIDATE_DO)
> 3444 return nft_table_validate(net, table);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> The cleanup for this would be quite involved unfortunately... Not
> necessarily something to attempt without being able to test the code.
At this stage, the transaction has been already registered in the
list, and the nf_tables_abort() path takes care of undoing what has
been updated in the preparation phase.
Having said this, Colin patch is correct, it's fixing up the error
path.
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic