* re: netfilter: nft_ct: add ct expectations support
@ 2019-06-18 13:57 Colin Ian King
0 siblings, 0 replies; only message in thread
From: Colin Ian King @ 2019-06-18 13:57 UTC (permalink / raw)
To: Stéphane Veyret, Pablo Neira Ayuso, Jozsef Kadlecsik,
Florian Westphal, David S. Miller, netfilter-devel, coreteam,
netdev
Cc: linux-kernel
Hi,
Static analysis with Coverity on linux-next has found a potential issue
with the following commit:
commit 857b46027d6f91150797295752581b7155b9d0e1
Author: Stéphane Veyret <sveyret@gmail.com>
Date: Sat May 25 15:30:58 2019 +0200
netfilter: nft_ct: add ct expectations support
Specifically in function nft_ct_expect_obj_eval)() in the following code:
+ help = nfct_help(ct);
+ if (!help)
+ help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
+
+ if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
+ regs->verdict.code = NFT_BREAK;
+ return;
+ }
The call to nf_ct_helper_ext_add can potentially return NULL, however,
this is not being checked and pointer 'help' is being dereferenced even
though it potentially can be null.
Colin
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-06-18 13:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-18 13:57 netfilter: nft_ct: add ct expectations support Colin Ian King
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).