From aa4095a156b56b00ca202d482b40d191ef5c54e8 Mon Sep 17 00:00:00 2001 From: Fernando Fernandez Mancera Date: Wed, 4 Sep 2019 14:29:07 +0200 Subject: [PATCH] netfilter: nf_tables: fix possible null-pointer dereference in object update Not all objects have an update operation. If the object type doesn't implement an update operation and the user tries to update it will hit EOPNOTSUPP. Fixes: d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object update operation") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index cf767bc58e188..013d28899cabc 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5140,6 +5140,9 @@ static int nf_tables_updobj(const struct nft_ctx *ctx, struct nft_trans *trans; int err; + if (!obj->ops->update) + return -EOPNOTSUPP; + trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, sizeof(struct nft_trans_obj)); if (!trans) -- 2.30.2