From 567ca7659e1ee6c04b1652eb5df8ceeecd8ce2c9 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 11 Jun 2025 14:15:38 +0200 Subject: [PATCH] netlink: Do not allocate a bogus flowtable priority expr commit 10b9a85b3278e0933bf47226588fede8c9fcbcc8 upstream. Code accidentally treats missing NFTNL_FLOWTABLE_PRIO attribute as zero prio value which may not be correct. Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter Reviewed-by: Pablo Neira Ayuso --- src/netlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/netlink.c b/src/netlink.c index 508b6ea8..5c639881 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -1845,14 +1845,16 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx, sizeof(char *), qsort_device_cmp); } - priority = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO); - flowtable->priority.expr = + if (nftnl_flowtable_is_set(nlo, NFTNL_FLOWTABLE_PRIO)) { + priority = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO); + flowtable->priority.expr = constant_expr_alloc(&netlink_location, &integer_type, BYTEORDER_HOST_ENDIAN, sizeof(int) * BITS_PER_BYTE, &priority); + } flowtable->hook.num = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_HOOKNUM); flowtable->flags = -- 2.47.2