| From f91aa6d76c6a554c9622fed1ad7e3c4440eb35a6 Mon Sep 17 00:00:00 2001 |
| From: Florian Westphal <fw@strlen.de> |
| Date: Thu, 16 Jan 2020 08:44:11 +0100 |
| Subject: [PATCH] netfilter: nft_tunnel: fix null-attribute check |
| |
| commit 1c702bf902bd37349f6d91cd7f4b372b1e46d0ed upstream. |
| |
| else we get null deref when one of the attributes is missing, both |
| must be non-null. |
| |
| Reported-by: syzbot+76d0b80493ac881ff77b@syzkaller.appspotmail.com |
| Fixes: aaecfdb5c5dd8ba ("netfilter: nf_tables: match on tunnel metadata") |
| Signed-off-by: Florian Westphal <fw@strlen.de> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c |
| index 3d4c2ae605a8..d89c7c553030 100644 |
| --- a/net/netfilter/nft_tunnel.c |
| +++ b/net/netfilter/nft_tunnel.c |
| @@ -76,7 +76,7 @@ static int nft_tunnel_get_init(const struct nft_ctx *ctx, |
| struct nft_tunnel *priv = nft_expr_priv(expr); |
| u32 len; |
| |
| - if (!tb[NFTA_TUNNEL_KEY] && |
| + if (!tb[NFTA_TUNNEL_KEY] || |
| !tb[NFTA_TUNNEL_DREG]) |
| return -EINVAL; |
| |
| -- |
| 2.7.4 |
| |
