xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: xtables: avoid BUG_ON

Browse Source 
I see no reason for them, label or timer cannot be NULL, and if they
were, we'll crash with null deref anyway.

For skb_header_pointer failure, just set hotdrop to true and toss
such packet.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal
2018-09-04 16:01:57 +02:00
committed by Pablo Neira Ayuso
parent fa5950e498
commit 70c0eb1ca0
4 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
net/ipv6/netfilter/ip6t_ipv6header.c
View File

@@ -65,7 +65,10 @@ ipv6header_mt6(const struct sk_buff *skb, struct xt_action_param *par)
}
hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
BUG_ON(hp == NULL);
if (!hp) {
par->hotdrop = true;
return false;
}
/* Calculate the header length */
if (nexthdr == NEXTHDR_FRAGMENT)

10
net/ipv6/netfilter/ip6t_rt.c
View File

@@ -137,7 +137,10 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
sizeof(_addr),
&_addr);
BUG_ON(ap == NULL);
if (ap == NULL) {
par->hotdrop = true;
return false;
}
if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
pr_debug("i=%d temp=%d;\n", i, temp);
@@ -166,7 +169,10 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ temp * sizeof(_addr),
sizeof(_addr),
&_addr);
BUG_ON(ap == NULL);
if (ap == NULL) {
par->hotdrop = true;
return false;
}
if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
break;