From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-co1nam03on0092.outbound.protection.outlook.com ([104.47.40.92]:4928 "EHLO NAM03-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752400AbeBCSEV (ORCPT ); Sat, 3 Feb 2018 13:04:21 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Hangbin Liu , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 058/110] netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done() Date: Sat, 3 Feb 2018 18:00:56 +0000 Message-ID: <20180203180015.29073-58-alexander.levin@microsoft.com> References: <20180203180015.29073-1-alexander.levin@microsoft.com> In-Reply-To: <20180203180015.29073-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Hangbin Liu [ Upstream commit 8bea728dce8972e534e6b99fd550f7b5cc3864e8 ] If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done= (), we need to check if filter is NULL first. Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 = chars") Signed-off-by: Hangbin Liu Acked-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_tables_api.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index ce49946f755e..5b504aa653f5 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4596,8 +4596,10 @@ static int nf_tables_dump_obj_done(struct netlink_ca= llback *cb) { struct nft_obj_filter *filter =3D cb->data; =20 - kfree(filter->table); - kfree(filter); + if (filter) { + kfree(filter->table); + kfree(filter); + } =20 return 0; } --=20 2.11.0