parser_json: initialize geneve options list for empty tunnel array
json_parse_cmd_add_object() only initializes obj->tunnel.geneve_opts on
the first iteration of the json_array_foreach() loop, guarded by
"if (index == 0)". A geneve tunnel object whose options array is empty
("tunnel": []) never enters the loop, so the list head is left
uninitialized. obj_tunnel_add_opts() (src/mnl.c) later walks it with
list_for_each_entry() and passes the bogus element to libnftnl, which
dereferences the near-NULL pointer and crashes nft:
# nft -j -f empty_geneve.json
AddressSanitizer: SEGV on unknown address 0x000000000012
#1 nftnl_tunnel_opt_geneve_set obj/tunnel.c:880
#2 nftnl_tunnel_opt_set obj/tunnel.c:910
#3 obj_tunnel_add_opts src/mnl.c:1608
#4 mnl_nft_obj_add src/mnl.c:1757
#5 do_command_add src/rule.c:1542
Initialize the list head unconditionally before the loop and drop the
per-iteration guard, so an empty array leaves a valid empty list. The
equivalent native-syntax empty definition was already handled in commit
f9047c1f ("evaluate: tunnel: don't assume src is set"); this covers the
JSON parser path, which that fix did not reach.
Fixes: 3a957f8f1ff1 ("tunnel: add tunnel object and statement json support")
Signed-off-by: Omkhar Arasaratnam <omkhar@linkedin.com>
Signed-off-by: Florian Westphal <fw@strlen.de>