diff options
| author |   Eric Dumazet <edumazet@google.com> | 2015-10-19 18:02:01 -0700 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2015-10-22 12:55:25 +0200 |
| commit | 45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34 (patch) | |
| tree | c0fd2f7fb693c42f116985aa8c913013e4bae88d /net/netfilter/xt_TEE.c | |
| parent | net: sun4i-emac: Properly free resources on probe failure and remove (diff) | |
| download | linux-dev-45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34.tar.xz linux-dev-45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34.zip | |
netfilter: xt_TEE: fix NULL dereference
iptables -I INPUT ... -j TEE --gateway 10.1.2.3
<crash> because --oif was not specified
tee_tg_check() sets ->priv pointer to NULL in this case.
Fixes: bbde9fc1824a ("netfilter: factor out packet duplication for IPv4/IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/xt_TEE.c')
| -rw-r--r-- | net/netfilter/xt_TEE.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c index fd980aa7715d..c5fdea18a9af 100644 --- a/net/netfilter/xt_TEE.c +++ b/net/netfilter/xt_TEE.c @@ -31,8 +31,9 @@ static unsigned int tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_tee_tginfo *info = par->targinfo; + int oif = info->priv ? info->priv->oif : 0; - nf_dup_ipv4(skb, par->hooknum, &info->gw.in, info->priv->oif); + nf_dup_ipv4(skb, par->hooknum, &info->gw.in, oif); return XT_CONTINUE; } @@ -42,8 +43,9 @@ static unsigned int tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_tee_tginfo *info = par->targinfo; + int oif = info->priv ? info->priv->oif : 0; - nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, info->priv->oif); + nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, oif); return XT_CONTINUE; } |