Re: [PATCH nf] netfilter: nft_ct: fix OOB in NFT_CT_SRC/DST eval

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> > which makes nf_ct_l3num(ct) be 0
> 
> How?

Wild guess:

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -78,7 +78,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 		break;
 	}
 
-	if (ct == NULL)
+	if (!ct || nf_ct_is_template(ct))
 		goto err;
 
 	switch (priv->key) {
diff --git a/net/netfilter/nft_ct_fast.c b/net/netfilter/nft_ct_fast.c
--- a/net/netfilter/nft_ct_fast.c
+++ b/net/netfilter/nft_ct_fast.c
@@ -30,7 +30,7 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
 		break;
 	}
 
-	if (!ct) {
+	if (!ct || nf_ct_is_template(ct)) {
 		regs->verdict.code = NFT_BREAK;
 		return;
 	}


.... might also make sense to invert
nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16), i.e.:
nf_ct_l3num(ct) == NFPROTO_IPV6 ? 16 : 4);