Commit 8bea728d authored Dec 25, 2017 by Hangbin Liu Committed by Pablo Neira Ayuso Dec 26, 2017

netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()



If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in
nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(),
we need to check if filter is NULL first.

Fixes: e46abbcc ("netfilter: nf_tables: Allow table names of up to 255 chars")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 4c82fd0a

net/netfilter/nf_tables_api.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -4665,8 +4665,10 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)
		{
		struct nft_obj_filter *filter = cb->data;

		if (filter) {
		kfree(filter->table);
		kfree(filter);
		}

		return 0;
		}