mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-23 00:20:52 -05:00
Code Activity

netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().

Browse source 
ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id],
but the function is exposed to user space before the entry is allocated
via register_pernet_subsys().

Let's call register_pernet_subsys() before xt_register_template().

Fixes: fdacd57c79 ("netfilter: x_tables: never register tables by default")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Kuniyuki Iwashima 2024-07-25 12:28:21 -07:00 committed by Pablo Neira Ayuso
parent 5830aa8639
commit c22921df77
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
net/ipv6/netfilter/ip6table_nat.c
View file

@ -147,23 +147,27 @@ static struct pernet_operations ip6table_nat_net_ops = {
static int __init ip6table_nat_init(void)
{
int ret = xt_register_template(&nf_nat_ipv6_table,
ip6table_nat_table_init);
int ret;
/* net->gen->ptr[ip6table_nat_net_id] must be allocated
* before calling ip6t_nat_register_lookups().
*/
ret = register_pernet_subsys(&ip6table_nat_net_ops);
if (ret < 0)
return ret;
ret = register_pernet_subsys(&ip6table_nat_net_ops);
ret = xt_register_template(&nf_nat_ipv6_table,
ip6table_nat_table_init);
if (ret)
xt_unregister_template(&nf_nat_ipv6_table);
unregister_pernet_subsys(&ip6table_nat_net_ops);
return ret;
}
static void __exit ip6table_nat_exit(void)
{
unregister_pernet_subsys(&ip6table_nat_net_ops);
xt_unregister_template(&nf_nat_ipv6_table);
unregister_pernet_subsys(&ip6table_nat_net_ops);
}
module_init(ip6table_nat_init);