* [PATCH] netfilter: ipset: Null pointer exception in ipset list:set
@ 2017-02-15 22:45 Vishwanath Pai
2017-02-16 19:58 ` Jozsef Kadlecsik
0 siblings, 1 reply; 2+ messages in thread
From: Vishwanath Pai @ 2017-02-15 22:45 UTC (permalink / raw)
To: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik
Cc: Vishwanath Pai, johunt, pai.vishwain, netfilter-devel, coreteam, netdev
If we use before/after to add an element to an empty list it will cause
a kernel panic.
$> cat crash.restore
create a hash:ip
create b hash:ip
create test list:set timeout 5 size 4
add test b before a
$> ipset -R < crash.restore
Executing the above will crash the kernel.
Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Reviewed-by: Josh Hunt <johunt@akamai.com>
---
net/netfilter/ipset/ip_set_list_set.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 51077c5..178d4eb 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -260,11 +260,14 @@ struct list_set {
else
prev = e;
}
+
+ /* If before/after is used on an empty set */
+ if ((d->before > 0 && !next) ||
+ (d->before < 0 && !prev))
+ return -IPSET_ERR_REF_EXIST;
+
/* Re-add already existing element */
if (n) {
- if ((d->before > 0 && !next) ||
- (d->before < 0 && !prev))
- return -IPSET_ERR_REF_EXIST;
if (!flag_exist)
return -IPSET_ERR_EXIST;
/* Update extensions */
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] netfilter: ipset: Null pointer exception in ipset list:set
2017-02-15 22:45 [PATCH] netfilter: ipset: Null pointer exception in ipset list:set Vishwanath Pai
@ 2017-02-16 19:58 ` Jozsef Kadlecsik
0 siblings, 0 replies; 2+ messages in thread
From: Jozsef Kadlecsik @ 2017-02-16 19:58 UTC (permalink / raw)
To: Vishwanath Pai
Cc: Pablo Neira Ayuso, Patrick McHardy, johunt, pai.vishwain,
netfilter-devel, coreteam, netdev
Hi,
On Wed, 15 Feb 2017, Vishwanath Pai wrote:
> If we use before/after to add an element to an empty list it will cause
> a kernel panic.
>
> $> cat crash.restore
> create a hash:ip
> create b hash:ip
> create test list:set timeout 5 size 4
> add test b before a
>
> $> ipset -R < crash.restore
>
> Executing the above will crash the kernel.
>
> Signed-off-by: Vishwanath Pai <vpai@akamai.com>
> Reviewed-by: Josh Hunt <johunt@akamai.com>
> ---
> net/netfilter/ipset/ip_set_list_set.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
> index 51077c5..178d4eb 100644
> --- a/net/netfilter/ipset/ip_set_list_set.c
> +++ b/net/netfilter/ipset/ip_set_list_set.c
> @@ -260,11 +260,14 @@ struct list_set {
> else
> prev = e;
> }
> +
> + /* If before/after is used on an empty set */
> + if ((d->before > 0 && !next) ||
> + (d->before < 0 && !prev))
> + return -IPSET_ERR_REF_EXIST;
> +
> /* Re-add already existing element */
> if (n) {
> - if ((d->before > 0 && !next) ||
> - (d->before < 0 && !prev))
> - return -IPSET_ERR_REF_EXIST;
> if (!flag_exist)
> return -IPSET_ERR_EXIST;
> /* Update extensions */
> --
> 1.9.1
Patch is applied, thank you!
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-02-16 19:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-15 22:45 [PATCH] netfilter: ipset: Null pointer exception in ipset list:set Vishwanath Pai
2017-02-16 19:58 ` Jozsef Kadlecsik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).