<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 3/27/23 13:22, Pablo Neira Ayuso
wrote:<br>
</div>
<blockquote type="cite" cite="mid:ZCFuaDrSdsyzRdgJ@salvia">
<pre class="moz-quote-pre" wrap="">On Mon, Mar 27, 2023 at 12:41:16PM +0300, Igor Artemiev wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">After having been compared to NULL value at nfnetlink_log.c:560,
pointer 'skb->dev' is dereferenced at nfnetlink_log.c:576.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Igor Artemiev <a class="moz-txt-link-rfc2396E" href="mailto:Igor.A.Artemiev@mcst.ru"><Igor.A.Artemiev@mcst.ru></a>
---
net/netfilter/nfnetlink_log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index d97eb280cb2e..2711509eb9a5 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -572,7 +572,7 @@ __build_packet_message(struct nfnl_log_net *log,
}
}
- if (indev && skb_mac_header_was_set(skb)) {
+ if (indev && skb->dev && skb_mac_header_was_set(skb)) {
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
This cannot ever happen, we assume skb->dev is always set on.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
nla_put_be16(inst->skb, NFULA_HWLEN,
htons(skb->dev->hard_header_len)))
--
2.30.2
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">If skb->dev is always set on, should the check at nfnetlink_log.c:560 be removed?
<code><pre><span class="k"> if</span> <span class="p">(</span><span class="n">indev</span> <span class="o">&&</span> <span class="n">skb</span><span class="o">-></span><span class="n">dev</span> <span class="o">&&</span>
<span class="n"> skb_mac_header_was_set</span><span class="p">(</span><span class="n">skb</span><span class="p">)</span> <span class="o">&&</span>
<span class="n">skb_mac_header_len</span><span class="p">(</span><span class="n">skb</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{
</span></pre></code><span style="font-family:monospace"><code></code></span><span style="font-family:monospace">Thanks,
Igor
</span>
</pre>
</body>
</html>