Commit 2f0513d4 authored Jun 19, 2019 by Stéphane Veyret Committed by Pablo Neira Ayuso Jun 19, 2019

netfilter: nft_ct: fix null pointer in ct expectations support



nf_ct_helper_ext_add may return null, which must then be checked.

Fixes: 857b4602 ("netfilter: nft_ct: add ct expectations support")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Stéphane Veyret <sveyret@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 72c5e118

net/netfilter/nft_ct.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -1232,6 +1232,10 @@ static void nft_ct_expect_obj_eval(struct nft_object *obj,
		help = nfct_help(ct);
		if (!help)
		help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
		if (!help) {
		regs->verdict.code = NF_DROP;
		return;
		}

		if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
		regs->verdict.code = NFT_BREAK;