Commit 40b446a1 authored Feb 16, 2017 by Vishwanath Pai Committed by Jozsef Kadlecsik Feb 19, 2017

netfilter: ipset: Null pointer exception in ipset list:set



If we use before/after to add an element to an empty list it will cause
a kernel panic.

$> cat crash.restore
create a hash:ip
create b hash:ip
create test list:set timeout 5 size 4
add test b before a

$> ipset -R < crash.restore

Executing the above will crash the kernel.

Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Reviewed-by: Josh Hunt <johunt@akamai.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

parent 50054a92

net/netfilter/ipset/ip_set_list_set.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -260,11 +260,14 @@ list_set_uadd(struct ip_set set, void value, const struct ip_set_ext *ext,
		else
		prev = e;
		}
		/* Re-add already existing element */
		if (n) {

		/* If before/after is used on an empty set */
		if ((d->before > 0 && !next) \|\|
		(d->before < 0 && !prev))
		return -IPSET_ERR_REF_EXIST;

		/* Re-add already existing element */
		if (n) {
		if (!flag_exist)
		return -IPSET_ERR_EXIST;
		/* Update extensions */