From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965195AbVKVVJf (ORCPT ); Tue, 22 Nov 2005 16:09:35 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S965194AbVKVVJW (ORCPT ); Tue, 22 Nov 2005 16:09:22 -0500 Received: from smtp.osdl.org ([65.172.181.4]:2207 "EHLO smtp.osdl.org") by vger.kernel.org with ESMTP id S965189AbVKVVIt (ORCPT ); Tue, 22 Nov 2005 16:08:49 -0500 Date: Tue, 22 Nov 2005 13:07:51 -0800 From: Chris Wright To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , torvalds@osdl.org, akpm@osdl.org, alan@lxorguk.ukuu.org.uk, Harald Welte , Pablo Neira Ayuso Subject: [patch 11/23] [PATCH] [NETFILTER] ctnetlink: check if protoinfo is present Message-ID: <20051122210751.GL28140@shell0.pdx.osdl.net> References: <20051122205223.099537000@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="ctnetlink-check-if-protoinfo-is-present.patch" User-Agent: Mutt/1.5.6i Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org -stable review patch. If anyone has any objections, please let us know. ------------------ This fixes an oops triggered from userspace. If we don't pass information about the private protocol info, the reference to attr will be NULL. This is likely to happen in update messages. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Harald Welte Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman --- net/ipv4/netfilter/ip_conntrack_proto_tcp.c | 5 +++++ 1 file changed, 5 insertions(+) --- linux-2.6.14.2.orig/net/ipv4/netfilter/ip_conntrack_proto_tcp.c +++ linux-2.6.14.2/net/ipv4/netfilter/ip_conntrack_proto_tcp.c @@ -362,6 +362,11 @@ static int nfattr_to_tcp(struct nfattr * struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1]; struct nfattr *tb[CTA_PROTOINFO_TCP_MAX]; + /* updates could not contain anything about the private + * protocol info, in that case skip the parsing */ + if (!attr) + return 0; + if (nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr) < 0) goto nfattr_failure; --