summaryrefslogtreecommitdiff
path: root/net/core/lwtunnel.c
diff options
context:
space:
mode:
authorPan Bian <bianpan2016@163.com>2017-04-23 14:28:37 +0800
committerDavid S. Miller <davem@davemloft.net>2017-04-24 15:51:30 -0400
commita50fe0ffd76fbd17af36209a16caf0b8ad901fef (patch)
treea948f0c673aedde2585c8f243a88e0c0bbbeae9f /net/core/lwtunnel.c
parent09d36071cfbc1fec9c93a30704b687829ee5efef (diff)
lwtunnel: check return value of nla_nest_start
Function nla_nest_start() may return a NULL pointer on error. However, in function lwtunnel_fill_encap(), the return value of nla_nest_start() is not validated before it is used. This patch checks the return value of nla_nest_start() against NULL. Signed-off-by: Pan Bian <bianpan2016@163.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/lwtunnel.c')
-rw-r--r--net/core/lwtunnel.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
index b5888190223c..5cbed3816229 100644
--- a/net/core/lwtunnel.c
+++ b/net/core/lwtunnel.c
@@ -214,6 +214,8 @@ int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate)
ret = -EOPNOTSUPP;
nest = nla_nest_start(skb, RTA_ENCAP);
+ if (!nest)
+ goto nla_put_failure;
rcu_read_lock();
ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
if (likely(ops && ops->fill_encap))