summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2015-10-19 18:02:01 -0700
committerPablo Neira Ayuso <pablo@netfilter.org>2015-10-22 12:55:25 +0200
commit45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34 (patch)
treec0fd2f7fb693c42f116985aa8c913013e4bae88d /net
parent104eb270e665f4fcd8cb8c8ab4c4d4538c604e92 (diff)
downloadlinux-45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34.tar.gz
linux-45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34.tar.bz2
linux-45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34.zip
netfilter: xt_TEE: fix NULL dereference
iptables -I INPUT ... -j TEE --gateway 10.1.2.3 <crash> because --oif was not specified tee_tg_check() sets ->priv pointer to NULL in this case. Fixes: bbde9fc1824a ("netfilter: factor out packet duplication for IPv4/IPv6") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/xt_TEE.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index fd980aa7715d..c5fdea18a9af 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -31,8 +31,9 @@ static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{
const struct xt_tee_tginfo *info = par->targinfo;
+ int oif = info->priv ? info->priv->oif : 0;
- nf_dup_ipv4(skb, par->hooknum, &info->gw.in, info->priv->oif);
+ nf_dup_ipv4(skb, par->hooknum, &info->gw.in, oif);
return XT_CONTINUE;
}
@@ -42,8 +43,9 @@ static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
const struct xt_tee_tginfo *info = par->targinfo;
+ int oif = info->priv ? info->priv->oif : 0;
- nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, info->priv->oif);
+ nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, oif);
return XT_CONTINUE;
}