Message ID | 1487198726-21866-1-git-send-email-vpai@akamai.com |
---|---|
State | Awaiting Upstream, archived |
Delegated to: | David Miller |
Headers | show |
Hi, On Wed, 15 Feb 2017, Vishwanath Pai wrote: > If we use before/after to add an element to an empty list it will cause > a kernel panic. > > $> cat crash.restore > create a hash:ip > create b hash:ip > create test list:set timeout 5 size 4 > add test b before a > > $> ipset -R < crash.restore > > Executing the above will crash the kernel. > > Signed-off-by: Vishwanath Pai <vpai@akamai.com> > Reviewed-by: Josh Hunt <johunt@akamai.com> > --- > net/netfilter/ipset/ip_set_list_set.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c > index 51077c5..178d4eb 100644 > --- a/net/netfilter/ipset/ip_set_list_set.c > +++ b/net/netfilter/ipset/ip_set_list_set.c > @@ -260,11 +260,14 @@ struct list_set { > else > prev = e; > } > + > + /* If before/after is used on an empty set */ > + if ((d->before > 0 && !next) || > + (d->before < 0 && !prev)) > + return -IPSET_ERR_REF_EXIST; > + > /* Re-add already existing element */ > if (n) { > - if ((d->before > 0 && !next) || > - (d->before < 0 && !prev)) > - return -IPSET_ERR_REF_EXIST; > if (!flag_exist) > return -IPSET_ERR_EXIST; > /* Update extensions */ > -- > 1.9.1 Patch is applied, thank you! Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c index 51077c5..178d4eb 100644 --- a/net/netfilter/ipset/ip_set_list_set.c +++ b/net/netfilter/ipset/ip_set_list_set.c @@ -260,11 +260,14 @@ struct list_set { else prev = e; } + + /* If before/after is used on an empty set */ + if ((d->before > 0 && !next) || + (d->before < 0 && !prev)) + return -IPSET_ERR_REF_EXIST; + /* Re-add already existing element */ if (n) { - if ((d->before > 0 && !next) || - (d->before < 0 && !prev)) - return -IPSET_ERR_REF_EXIST; if (!flag_exist) return -IPSET_ERR_EXIST; /* Update extensions */