From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 26 Feb 2018 12:16:05 +0000 (+0100)
Subject: netfilter: nf_tables: missing attribute validation in nf_tables_delflowtable()
X-Git-Tag: v4.16-rc5~37^2~7^2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e603ea4ba778846b5b2203546f0c6056ec198b16;p=thirdparty%2Fkernel%2Flinux.git

netfilter: nf_tables: missing attribute validation in nf_tables_delflowtable()

Return -EINVAL is mandatory attributes are missing.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 43acdeef045df..2b5aa78979db8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5161,6 +5161,11 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
 	struct nft_table *table;
 	struct nft_ctx ctx;
 
+	if (!nla[NFTA_FLOWTABLE_TABLE] ||
+	    (!nla[NFTA_FLOWTABLE_NAME] &&
+	     !nla[NFTA_FLOWTABLE_HANDLE]))
+		return -EINVAL;
+
 	table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
 				       family, genmask);
 	if (IS_ERR(table))