The commit is pushed to "branch-rh7-3.10.0-1160.6.1.vz7.171.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git after rh7-3.10.0-1160.6.1.vz7.171.1 ------> commit 5e55c508df5583537bb9be21e26672627f2056fd Author: Aditya Pakki <pakki...@umn.edu> Date: Thu Dec 3 12:21:11 2020 +0300
ms/netfilter: ipset: fix a missing check of nla_parse When nla_parse fails, we should not use the results (the first argument). The fix checks if it fails, and if so, returns its error code upstream. Signed-off-by: Aditya Pakki <pakki...@umn.edu> Signed-off-by: Jozsef Kadlecsik <kad...@blackhole.kfki.hu> (cherry-picked from commit f4f5748bfec94cf418e49bf05f0c81a1b9ebc95) VvS: replaced original nla_parse_deprecated() by nla_parse() https://jira.sw.ru/browse/PSBM-122965 Signed-off-by: Vasily Averin <v...@virtuozzo.com> --- net/netfilter/ipset/ip_set_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index 6ef5898..d5344e5 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1542,10 +1542,14 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set, memcpy(&errmsg->msg, nlh, nlh->nlmsg_len); cmdattr = (void *)&errmsg->msg + min_len; - nla_parse(cda, IPSET_ATTR_CMD_MAX, + ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr, nlh->nlmsg_len - min_len, ip_set_adt_policy); + if (ret) { + nlmsg_free(skb2); + return ret; + } errline = nla_data(cda[IPSET_ATTR_LINENO]); *errline = lineno; _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel