From: Eric Dumazet Date: Tue, 20 Oct 2015 01:02:01 +0000 (-0700) Subject: netfilter: xt_TEE: fix NULL dereference X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git netfilter: xt_TEE: fix NULL dereference iptables -I INPUT ... -j TEE --gateway 10.1.2.3 because --oif was not specified tee_tg_check() sets ->priv pointer to NULL in this case. Fixes: bbde9fc1824a ("netfilter: factor out packet duplication for IPv4/IPv6") Signed-off-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c index fd980aa7715d..c5fdea18a9af 100644 --- a/net/netfilter/xt_TEE.c +++ b/net/netfilter/xt_TEE.c @@ -31,8 +31,9 @@ static unsigned int tee_tg4(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_tee_tginfo *info = par->targinfo; + int oif = info->priv ? info->priv->oif : 0; - nf_dup_ipv4(skb, par->hooknum, &info->gw.in, info->priv->oif); + nf_dup_ipv4(skb, par->hooknum, &info->gw.in, oif); return XT_CONTINUE; } @@ -42,8 +43,9 @@ static unsigned int tee_tg6(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_tee_tginfo *info = par->targinfo; + int oif = info->priv ? info->priv->oif : 0; - nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, info->priv->oif); + nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, oif); return XT_CONTINUE; }