diff options
| author | Florian Westphal | 2023-05-11 22:39:30 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2023-05-24 17:32:48 +0100 |
| commit | a836be60a3aabcedcd9c79f545d409ace1f20ba6 (patch) | |
| tree | 919c4dcf1dd40558fec5131c861b5861275945a7 /kernel/cpu_pm.c | |
| parent | 8f58c538573a0cf799e89bb287ee935adc8da2df (diff) | |
netfilter: nft_set_rbtree: fix null deref on element insertion
[ Upstream commit 61ae320a29b0540c16931816299eb86bf2b66c08 ]
There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
nft_add_set_elem+0x14b0/0x2990
nf_tables_newsetelem+0x528/0xb30
Furthermore, there is a possible use-after-free while iterating,
'node' can be free'd so we need to cache the next value to use.
Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'kernel/cpu_pm.c')
0 files changed, 0 insertions, 0 deletions