bianbu-repo-mirror/bianbu-linux-6.6
1
0
Fork 0
mirror of https://gitee.com/bianbu-linux/linux-6.6 synced 2025-04-24 14:07:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().

Browse source 
[ Upstream commit c22921df777de5606f1047b1345b8d22ef1c0b34 ]

ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id],
but the function is exposed to user space before the entry is allocated
via register_pernet_subsys().

Let's call register_pernet_subsys() before xt_register_template().

Fixes: fdacd57c79 ("netfilter: x_tables: never register tables by default")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Kuniyuki Iwashima 2024-07-25 12:28:21 -07:00 • committed by Greg Kroah-Hartman
parent 70014b73d7
commit e85b9b6a87
1 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
net/ipv6/netfilter/ip6table_nat.c
View file

@ -147,23 +147,27 @@ static struct pernet_operations ip6table_nat_net_ops = {
static int __init ip6table_nat_init(void) static int __init ip6table_nat_init(void)
{ {
int ret = xt_register_template(&nf_nat_ipv6_table, int ret;
ip6table_nat_table_init);
/* net->gen->ptr[ip6table_nat_net_id] must be allocated
* before calling ip6t_nat_register_lookups().
*/
ret = register_pernet_subsys(&ip6table_nat_net_ops);
if (ret < 0) if (ret < 0)
return ret; return ret;
ret = register_pernet_subsys(&ip6table_nat_net_ops); ret = xt_register_template(&nf_nat_ipv6_table,
ip6table_nat_table_init);
if (ret) if (ret)
xt_unregister_template(&nf_nat_ipv6_table); unregister_pernet_subsys(&ip6table_nat_net_ops);
return ret; return ret;
} }
static void __exit ip6table_nat_exit(void) static void __exit ip6table_nat_exit(void)
{ {
unregister_pernet_subsys(&ip6table_nat_net_ops);
xt_unregister_template(&nf_nat_ipv6_table); xt_unregister_template(&nf_nat_ipv6_table);
unregister_pernet_subsys(&ip6table_nat_net_ops);
} }
module_init(ip6table_nat_init); module_init(ip6table_nat_init);