[nft PATCH 0/2] Sanitize two error conditions in netlink code

[nft PATCH 0/2] Sanitize two error conditions in netlink code

[Phil Sutter]

While reviewing netlink deserialization code I noticed these two
potential issues. Submitting them separately from other work as they are
clear fixes (IMO).

Phil Sutter (2):
  netlink: Avoid potential NULL-ptr deref parsing set elem expressions
  netlink: Catch unknown types when deserializing objects

 src/netlink.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

-- 
2.49.0

[nft PATCH 1/2] netlink: Avoid potential NULL-ptr deref parsing set elem expressions

[Phil Sutter]

Since netlink_parse_set_expr() may return NULL, the following deref must
be guarded.

Fixes: e6d1d0d611958 ("src: add set element multi-statement support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/netlink.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/netlink.c b/src/netlink.c
index d88912457c591..0724190a25d6f 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -969,7 +969,8 @@ static int set_elem_parse_expressions(struct nftnl_expr *e, void *data)
 	struct stmt *stmt;
 
 	stmt = netlink_parse_set_expr(set, cache, e);
-	list_add_tail(&stmt->list, &setelem_parse_ctx->stmt_list);
+	if (stmt)
+		list_add_tail(&stmt->list, &setelem_parse_ctx->stmt_list);
 
 	return 0;
 }
-- 
2.49.0

[nft PATCH 2/2] netlink: Catch unknown types when deserializing objects

[Phil Sutter]

Print an error message and discard the object instead of returning it to
the caller. At least when trying to print it, we would hit an assert()
in obj_type_name() anyway.

Fixes: 4756d92e517ae ("src: listing of stateful objects")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/netlink.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/netlink.c b/src/netlink.c
index 0724190a25d6f..52010c74d4f30 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1802,6 +1802,10 @@ struct obj *netlink_delinearize_obj(struct netlink_ctx *ctx,
 		obj->synproxy.flags =
 			nftnl_obj_get_u32(nlo, NFTNL_OBJ_SYNPROXY_FLAGS);
 		break;
+	default:
+		netlink_io_error(ctx, NULL, "Unknown object type %u", type);
+		obj_free(obj);
+		return NULL;
 	}
 	obj->type = type;
 
-- 
2.49.0

Re: [nft PATCH 0/2] Sanitize two error conditions in netlink code

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> While reviewing netlink deserialization code I noticed these two
> potential issues. Submitting them separately from other work as they are
> clear fixes (IMO).

Thanks Phil, please push them out.

Re: [nft PATCH 0/2] Sanitize two error conditions in netlink code

[Phil Sutter]

On Tue, May 20, 2025 at 12:34:58PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > While reviewing netlink deserialization code I noticed these two
> > potential issues. Submitting them separately from other work as they are
> > clear fixes (IMO).
> 
> Thanks Phil, please push them out.

Series applied, thanks!