Commit b88825de authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nf_tables: don't update chain with unset counters

Fix possible replacement of the per-cpu chain counters by null
pointer when updating an existing chain in the commit path.
Reported-by: default avatarMatteo Croce <technoboy85@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a3716e70
...@@ -899,6 +899,9 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) ...@@ -899,6 +899,9 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
static void nft_chain_stats_replace(struct nft_base_chain *chain, static void nft_chain_stats_replace(struct nft_base_chain *chain,
struct nft_stats __percpu *newstats) struct nft_stats __percpu *newstats)
{ {
if (newstats == NULL)
return;
if (chain->stats) { if (chain->stats) {
struct nft_stats __percpu *oldstats = struct nft_stats __percpu *oldstats =
nft_dereference(chain->stats); nft_dereference(chain->stats);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment