1. May 19, 2023
  2. May 18, 2023
  3. May 17, 2023
    • Florian Westphal's avatar
      netfilter: nft_set_rbtree: fix null deref on element insertion · 61ae320a
      Florian Westphal authored
      There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():
      
      general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
       nft_add_set_elem+0x14b0/0x2990
        nf_tables_newsetelem+0x528/0xb30
      
      Furthermore, there is a possible use-after-free while iterating,
      'node' can be free'd so we need to cache the next value to use.
      
      Fixes: c9e6978e
      
       ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      61ae320a