Re: [PATCH 1/3] nfnetlink: Check callbacks before using those in nfnetlink_rcv_msg

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jun 28, 2012 at 03:57:47PM +0300, Tomasz Bursztyka wrote:
> nfnetlink_rcv_msg() might call a NULL callback which will cause NULL pointer
> dereference.
> 
> Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
> ---
>  net/netfilter/nfnetlink.c |    4 +++-
>  1 files changed, 3 insertions(+), 1 deletions(-)
> 
> diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> index 3e797d1..4acdd76 100644
> --- a/net/netfilter/nfnetlink.c
> +++ b/net/netfilter/nfnetlink.c
> @@ -184,9 +184,11 @@ replay:
>  					lockdep_is_held(&nfnl_mutex)) != ss ||
>  			    nfnetlink_find_client(type, ss) != nc)
>  				err = -EAGAIN;
> -			else
> +			else if (nc->call)
>  				err = nc->call(net->nfnl, skb, nlh,
>  						   (const struct nlattr **)cda);
> +			else
> +				err = -EINVAL;

Hm, I think this is redundant. We got the ipset problem fixed with
2/3. I think we can add some BUG_ON instead as all nc->call needs to
be defined. Otherwise, spot a bug message so it is fixed.