Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f4f5748b authored by Aditya Pakki's avatar Aditya Pakki Committed by Jozsef Kadlecsik
Browse files

netfilter: ipset: fix a missing check of nla_parse 



When nla_parse fails, we should not use the results (the first
argument). The fix checks if it fails, and if so, returns its error code
upstream.

Signed-off-by: default avatarAditya Pakki <pakki001@umn.edu>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
parent f0cb8390

net/netfilter/ipset/ip_set_core.c

+7 −3
Original line number Diff line number Diff line
@@ -1544,10 +1544,14 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set, 
		memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);

		cmdattr = (void *)&errmsg->msg + min_len;



		nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,

		ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,

					   nlh->nlmsg_len - min_len,

					   ip_set_adt_policy, NULL);



		if (ret) {

			nlmsg_free(skb2);

			return ret;

		}

		errline = nla_data(cda[IPSET_ATTR_LINENO]);



		*errline = lineno;