Re: [PATCH] rule: fix NULL pointer dereference in do_list_flowtable

[Florian Westphal <fw@strlen.de>]

Anton Moryakov <ant.v.moryakov@gmail.com> wrote:
> Static analysis found a potential NULL pointer dereference in
> do_command_list() when handling CMD_OBJ_FLOWTABLE.
> 
> If cmd->handle.table.name is not specified, the table pointer remains
> NULL after the cache lookup block. However, do_list_flowtable() expects
> a valid table pointer and dereferences it via ft_cache_find().

Not following, table is never NULL in the function:

static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
{
	struct table *table = NULL; [..]

	if (cmd->handle.table.name != NULL) {
		table = table_cache_find(&ctx->nft->cache.table_cache,
					 cmd->handle.table.name,
					 cmd->handle.family);
		if (!table) {
			errno = ENOENT;
			return -1;
		}
	}

	switch (cmd->obj) {
[..]
	case CMD_OBJ_FLOWTABLE:
		return do_list_flowtable(ctx, cmd, table);

This has been the case for almost a year:

commit 853d3a2d3cbdc7aab16d3d33999d00b32a6db7ce
Date:   Thu Mar 20 14:31:42 2025 +0100
rule: return error if table does not exist