]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 542ce5f) | patch
netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
authorPablo Neira Ayuso <pablo@netfilter.org>
Fri, 6 Dec 2019 21:09:14 +0000 (22:09 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 9 Dec 2019 12:14:03 +0000 (13:14 +0100)
commit027ec19af00c3d299dbee5bd52e8c17abb644a52
treef7bdfa04d63e35348b2b8160841518207119975btree | snapshot
parent542ce5f414dd02148a912f879084cdb12286d190commit | diff
netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()

Userspace might bogusly sent NFT_DATA_VERDICT in several netlink
attributes that assume NFT_DATA_VALUE. Moreover, make sure that error
path invokes nft_data_release() to decrement the reference count on the
chain object.

Fixes: 14793e629b67 ("netfilter: add nftables")
Fixes: 7a14dbb3696f ("netfilter: nf_tables: add range expression")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c diff | blob | history
net/netfilter/nft_bitwise.c diff | blob | history
net/netfilter/nft_cmp.c diff | blob | history
net/netfilter/nft_range.c diff | blob | history
Linux Kernel Source Tree.