| Message ID | 20240731213046.6194-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 5830aa863981d43560748aa93589c0695191d95d |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/2] netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Wed, 31 Jul 2024 23:30:45 +0200 you wrote: > From: Kuniyuki Iwashima <kuniyu@amazon.com> > > We had a report that iptables-restore sometimes triggered null-ptr-deref > at boot time. [0] > > The problem is that iptable_nat_table_init() is exposed to user space > before the kernel fully initialises netns. > > [...] Here is the summary with links: - [net,1/2] netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). https://git.kernel.org/netdev/net/c/5830aa863981 - [net,2/2] netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). https://git.kernel.org/netdev/net/c/c22921df777d You are awesome, thank you!
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c index 4d42d0756fd7..a5db7c67d61b 100644 --- a/net/ipv4/netfilter/iptable_nat.c +++ b/net/ipv4/netfilter/iptable_nat.c @@ -145,25 +145,27 @@ static struct pernet_operations iptable_nat_net_ops = { static int __init iptable_nat_init(void) { - int ret = xt_register_template(&nf_nat_ipv4_table, - iptable_nat_table_init); + int ret; + /* net->gen->ptr[iptable_nat_net_id] must be allocated + * before calling iptable_nat_table_init(). + */ + ret = register_pernet_subsys(&iptable_nat_net_ops); if (ret < 0) return ret; - ret = register_pernet_subsys(&iptable_nat_net_ops); - if (ret < 0) { - xt_unregister_template(&nf_nat_ipv4_table); - return ret; - } + ret = xt_register_template(&nf_nat_ipv4_table, + iptable_nat_table_init); + if (ret < 0) + unregister_pernet_subsys(&iptable_nat_net_ops); return ret; } static void __exit iptable_nat_exit(void) { - unregister_pernet_subsys(&iptable_nat_net_ops); xt_unregister_template(&nf_nat_ipv4_table); + unregister_pernet_subsys(&iptable_nat_net_ops); } module_init(iptable_nat_init);