Received-SPF: pass (google.com: domain of linux-kernel+bounces-35400-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <c49c716a-e070-4ad5-9a90-896537bcd1b5@web.de>
Date: Tue, 23 Jan 2024 14:45:12 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
 netdev@vger.kernel.org, kernel-janitors@vger.kernel.org,
 "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>,
 Florian Westphal <fw@strlen.de>, Jakub Kicinski <kuba@kernel.org>,
 Jozsef Kadlecsik <kadlec@netfilter.org>,
 Pablo Neira Ayuso <pablo@netfilter.org>, Paolo Abeni <pabeni@redhat.com>,
 Phil Sutter <phil@nwl.cc>
Content-Language: en-GB
Cc: LKML <linux-kernel@vger.kernel.org>, Kunwu Chan <chentao@kylinos.cn>
From: Markus Elfring <Markus.Elfring@web.de>
Subject: [PATCH] netfilter: nf_tables: Add a null pointer check in two
 functions
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:urrv4rpcajc=;/nHaTBh4XMqzTVirGs4oOTwcSi7
 ZIxCLy+7hJuCSuOhVg8aSGW9cJwf9yHPN21+TmX07Z/erdwvtYb/qpAQU6mGPotw2bCCj9kb2
 lxcnr74Pxs904yx/f/sIhE59WjCjx5zFH3HwdJKNk49/2vliqEweKn9eGG251M7Rt+o8iE0At
 LzCScwwIV+gvJPJObXmCzdJfzu/vIJkNNyOoQARaDAumB1KXXgi4Ov88uqwFh/ZhKXyFS75MU
 FIOzvKOEcHAObp/lj7TqFrkEYcKHITFD7cUIFKS9Z1kQOuOTjh3kHF8wiEL+Fh5NZdb1PN2Xl
 QmUDRsaV0LmU+76U4nkG8R7bi+pcRhWin6OKQejoiYq/A7r99hbi8FDcYc4Z8Hyba64CRvC/R
 fiB0N4WDHHfX1Dk31xsL/AuTne8LgZpV4KB+1Mk8FZk8mo3BHd1db8lOCL+5x6Qztn/M9eFn9
 v1OJCeX5DuR95qT5bzhcoiTfWJGDjZVEan7sK0wjbU/+oQHAh9rTJUofA5QtaAxqHWH5PycLk
 ju1YZzmimdsVbq69r8a0AWeN2XeemLAbE9vSBkej7h9vvhfozIXNPlZgLdzxXwWJGI2Xtg4Hy
 F3FwWe/foM6cjRVm1QwgIXl1xPRovRK1njOBLBYashgtubclcXgsXr6iOqxLETIx1K3spPAt+
 hsYsGaMSBFc5M9Yi4mskv7EhSnNQf+gHgq4tsVTQWZdvAg6Pc6YFmZWUO4LDOZsgdHmNNjwol
 pnEv0Uq09v4os/Bh+7cm1Dm1RjNllvkmXTr5ljqUua5qL+WrJ5aHrRJXNMiFv4qRhlNLP1fdH
 K0j/3Ln9kHwG8bmQ2ZyGyRyybo1kxcSMMd6fvA9yE2new+Cbg8RB+kvluHjhKCSw7SQdBlgwk
 NdQAoOrgI1+VMj0yTMCqOPPIb82a5lfDA37+T31k5iZL5J50EyJ9DhSnmM6nB9bwgcW/xkzoe
 S/cmXQ==

From: Markus Elfring <elfring@users.sourceforge.net>
Date: Tue, 23 Jan 2024 14:28:31 +0100

The result from a call of the function =E2=80=9Ckasprintf=E2=80=9D was pas=
sed to
a subsequent function call without checking for a null pointer before
(according to a memory allocation failure).
This issue was detected by using the Coccinelle software.

Thus add a null pointer check and a jump target in affected functions.

Fixes: 8877393029e76 ("netfilter: nf_tables: Open-code audit log call in n=
f_tables_getrule()")
Fixes: 0854db2aaef3f ("netfilter: nf_tables: use net_generic infra for tra=
nsaction data")
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
=2D--
 net/netfilter/nf_tables_api.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8438a8922e4a..cb61c7a39a76 100644
=2D-- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3728,10 +3728,13 @@ static int nf_tables_getrule_reset(struct sk_buff =
*skb,
 			nla_len(nla[NFTA_RULE_TABLE]),
 			(char *)nla_data(nla[NFTA_RULE_TABLE]),
 			nft_net->base_seq);
+	if (!buf)
+		goto exit;
+
 	audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1,
 			AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC);
 	kfree(buf);
-
+exit:
 	return nfnetlink_unicast(skb2, net, portid);
 }

@@ -7917,6 +7920,8 @@ static int nf_tables_getobj(struct sk_buff *skb, con=
st struct nfnl_info *info,

 		nft_net =3D nft_pernet(net);
 		buf =3D kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq);
+		if (!buf)
+			goto fill_obj_info;

 		audit_log_nfcfg(buf,
 				family,
@@ -7925,7 +7930,7 @@ static int nf_tables_getobj(struct sk_buff *skb, con=
st struct nfnl_info *info,
 				GFP_ATOMIC);
 		kfree(buf);
 	}
-
+fill_obj_info:
 	err =3D nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
 				      info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
 				      family, table, obj, reset);
=2D-
2.43.0