On Thu, Jun 28, 2012 at 03:57:47PM +0300, Tomasz Bursztyka wrote: > nfnetlink_rcv_msg() might call a NULL callback which will cause NULL pointer > dereference. > > Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@xxxxxxxxxxxxxxx> > --- > net/netfilter/nfnetlink.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c > index 3e797d1..4acdd76 100644 > --- a/net/netfilter/nfnetlink.c > +++ b/net/netfilter/nfnetlink.c > @@ -184,9 +184,11 @@ replay: > lockdep_is_held(&nfnl_mutex)) != ss || > nfnetlink_find_client(type, ss) != nc) > err = -EAGAIN; > - else > + else if (nc->call) > err = nc->call(net->nfnl, skb, nlh, > (const struct nlattr **)cda); > + else > + err = -EINVAL; Hm, I think this is redundant. We got the ipset problem fixed with 2/3. I think we can add some BUG_ON instead as all nc->call needs to be defined. Otherwise, spot a bug message so it is fixed. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
