diff mbox

netfilter: ipset: Null pointer exception in ipset list:set

Message ID 1487198726-21866-1-git-send-email-vpai@akamai.com
State Accepted
Delegated to: Jozsef Kadlecsik
Headers show

Commit Message

Vishwanath Pai Feb. 15, 2017, 10:45 p.m. UTC 
If we use before/after to add an element to an empty list it will cause
a kernel panic.

$> cat crash.restore
create a hash:ip
create b hash:ip
create test list:set timeout 5 size 4
add test b before a

$> ipset -R < crash.restore

Executing the above will crash the kernel.

Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Reviewed-by: Josh Hunt <johunt@akamai.com>
---
 net/netfilter/ipset/ip_set_list_set.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

Comments

Jozsef Kadlecsik Feb. 16, 2017, 7:58 p.m. UTC | #1 
Hi,

On Wed, 15 Feb 2017, Vishwanath Pai wrote:

> If we use before/after to add an element to an empty list it will cause
> a kernel panic.
> 
> $> cat crash.restore
> create a hash:ip
> create b hash:ip
> create test list:set timeout 5 size 4
> add test b before a
> 
> $> ipset -R < crash.restore
> 
> Executing the above will crash the kernel.
> 
> Signed-off-by: Vishwanath Pai <vpai@akamai.com>
> Reviewed-by: Josh Hunt <johunt@akamai.com>
> ---
>  net/netfilter/ipset/ip_set_list_set.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
> index 51077c5..178d4eb 100644
> --- a/net/netfilter/ipset/ip_set_list_set.c
> +++ b/net/netfilter/ipset/ip_set_list_set.c
> @@ -260,11 +260,14 @@ struct list_set {
>  		else
>  			prev = e;
>  	}
> +
> +	/* If before/after is used on an empty set */
> +	if ((d->before > 0 && !next) ||
> +	    (d->before < 0 && !prev))
> +		return -IPSET_ERR_REF_EXIST;
> +
>  	/* Re-add already existing element */
>  	if (n) {
> -		if ((d->before > 0 && !next) ||
> -		    (d->before < 0 && !prev))
> -			return -IPSET_ERR_REF_EXIST;
>  		if (!flag_exist)
>  			return -IPSET_ERR_EXIST;
>  		/* Update extensions */
> -- 
> 1.9.1

Patch is applied, thank you!

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 51077c5..178d4eb 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -260,11 +260,14 @@  struct list_set {
 		else
 			prev = e;
 	}
+
+	/* If before/after is used on an empty set */
+	if ((d->before > 0 && !next) ||
+	    (d->before < 0 && !prev))
+		return -IPSET_ERR_REF_EXIST;
+
 	/* Re-add already existing element */
 	if (n) {
-		if ((d->before > 0 && !next) ||
-		    (d->before < 0 && !prev))
-			return -IPSET_ERR_REF_EXIST;
 		if (!flag_exist)
 			return -IPSET_ERR_EXIST;
 		/* Update extensions */