diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-08-05 17:25:59 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-10-05 13:41:11 -0700 |
| commit | e765aed022b94f52e7531d5ee51c98f2c240d129 (patch) | |
| tree | 1ac7d2fec68c42cb2af3cf83ea396520cf4e75c5 /net | |
| parent | 420d3e020dbdc9cb32faffc9307bf85da3e942ec (diff) | |
netfilter: nf_tables: don't update chain with unset counters
commit b88825de8545ad252c31543fef13cadf4de7a2bc upstream.
Fix possible replacement of the per-cpu chain counters by null
pointer when updating an existing chain in the commit path.
Reported-by: Matteo Croce <technoboy85@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 8746ff9a8357..62101ed0d2af 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -899,6 +899,9 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) static void nft_chain_stats_replace(struct nft_base_chain *chain, struct nft_stats __percpu *newstats) { + if (newstats == NULL) + return; + if (chain->stats) { struct nft_stats __percpu *oldstats = nft_dereference(chain->stats); |