From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 6/6] netfilter: xt_socket: check sk before checking for netns.
Date: Tue, 2 Oct 2018 00:37:45 +0200 [thread overview]
Message-ID: <20181001223745.29010-7-pablo@netfilter.org> (raw)
In-Reply-To: <20181001223745.29010-1-pablo@netfilter.org>
From: Flavio Leitner <fbl@redhat.com>
Only check for the network namespace if the socket is available.
Fixes: f564650106a6 ("netfilter: check if the socket netns is correct.")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Flavio Leitner <fbl@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_socket.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 0472f3472842..ada144e5645b 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -56,7 +56,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
struct sk_buff *pskb = (struct sk_buff *)skb;
struct sock *sk = skb->sk;
- if (!net_eq(xt_net(par), sock_net(sk)))
+ if (sk && !net_eq(xt_net(par), sock_net(sk)))
sk = NULL;
if (!sk)
@@ -117,7 +117,7 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
struct sk_buff *pskb = (struct sk_buff *)skb;
struct sock *sk = skb->sk;
- if (!net_eq(xt_net(par), sock_net(sk)))
+ if (sk && !net_eq(xt_net(par), sock_net(sk)))
sk = NULL;
if (!sk)
--
2.11.0
next prev parent reply other threads:[~2018-10-01 22:37 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-01 22:37 [PATCH 0/6] Netfilter fixes for net Pablo Neira Ayuso
2018-10-01 22:37 ` [PATCH 1/6] netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev Pablo Neira Ayuso
2018-10-01 22:37 ` [PATCH 2/6] netfilter: nft_osf: use enum nft_data_types for nft_validate_register_store Pablo Neira Ayuso
2018-10-01 22:37 ` [PATCH 3/6] netfilter: conntrack: get rid of double sizeof Pablo Neira Ayuso
2018-10-01 22:37 ` [PATCH 4/6] netfilter: nft_set_rbtree: add missing rb_erase() in GC routine Pablo Neira Ayuso
2018-10-01 22:37 ` [PATCH 5/6] netfilter: avoid erronous array bounds warning Pablo Neira Ayuso
2018-10-01 22:37 ` Pablo Neira Ayuso [this message]
2018-10-01 22:41 ` [PATCH 0/6] Netfilter fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001223745.29010-7-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.