summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2020-01-16 10:44:11 +0300
committerPablo Neira Ayuso <pablo@netfilter.org>2020-01-16 16:22:32 +0300
commit1c702bf902bd37349f6d91cd7f4b372b1e46d0ed (patch)
treec6836978eccfc621716e0c01a38ff0905f1924b9 /net
parentec7470b834fe7b5d7eff11b6677f5d7fdf5e9a91 (diff)
downloadlinux-1c702bf902bd37349f6d91cd7f4b372b1e46d0ed.tar.xz
netfilter: nft_tunnel: fix null-attribute check
else we get null deref when one of the attributes is missing, both must be non-null. Reported-by: syzbot+76d0b80493ac881ff77b@syzkaller.appspotmail.com Fixes: aaecfdb5c5dd8ba ("netfilter: nf_tables: match on tunnel metadata") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/nft_tunnel.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
index 3d4c2ae605a8..d89c7c553030 100644
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -76,7 +76,7 @@ static int nft_tunnel_get_init(const struct nft_ctx *ctx,
struct nft_tunnel *priv = nft_expr_priv(expr);
u32 len;
- if (!tb[NFTA_TUNNEL_KEY] &&
+ if (!tb[NFTA_TUNNEL_KEY] ||
!tb[NFTA_TUNNEL_DREG])
return -EINVAL;