From: Vlad Buslov <vladbu@mellanox.com>
Date: Mon, 25 Feb 2019 15:28:27 +0000 (+0200)
Subject: net: sched: act_tunnel_key: fix NULL pointer dereference during init
X-Git-Tag: v4.20.15~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f8ad8a45d4592e5fd5fe8911183a8a58ca84aba0;p=thirdparty%2Fkernel%2Fstable.git

net: sched: act_tunnel_key: fix NULL pointer dereference during init

[ Upstream commit a3df633a3c92bb96b06552c3f828d7c267774379 ]

Metadata pointer is only initialized for action TCA_TUNNEL_KEY_ACT_SET, but
it is unconditionally dereferenced in tunnel_key_init() error handler.
Verify that metadata pointer is not NULL before dereferencing it in
tunnel_key_init error handling code.

Fixes: ee28bb56ac5b ("net/sched: fix memory leak in act_tunnel_key_init()")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 904730b8ce8f2..6f16202d4b4ff 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -377,7 +377,8 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 	return ret;
 
 release_tun_meta:
-	dst_release(&metadata->dst);
+	if (metadata)
+		dst_release(&metadata->dst);
 
 err_out:
 	if (exists)