netfilter: nf_tables: don't update chain with unset counters



Fix possible replacement of the per-cpu chain counters by null
pointer when updating an existing chain in the commit path.

Reported-by: Matteo Croce <technoboy85@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent a3716e70

net/netfilter/nf_tables_api.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -899,6 +899,9 @@ static struct nft_stats __percpu nft_stats_alloc(const struct nlattr attr)
		static void nft_chain_stats_replace(struct nft_base_chain *chain,
		struct nft_stats __percpu *newstats)
		{
		if (newstats == NULL)
		return;

		if (chain->stats) {
		struct nft_stats __percpu *oldstats =
		nft_dereference(chain->stats);