From 406dbfc9ae0e6b7eb4da4a52c0a6556a0d7e6a2f Mon Sep 17 00:00:00 2001
From: Patrick McHardy <kaber@trash.net>
Date: Sun, 12 Mar 2006 20:32:47 -0800
Subject: [PATCH] [NETFILTER]: nfnetlink_queue: fix possible NULL-ptr
 dereference

Fix NULL-ptr dereference when a config message for a non-existant
queue containing only an NFQA_CFG_PARAMS attribute is received.

Coverity #433

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/netfilter/nfnetlink_queue.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cac38b2e147a..2cf5fb8322c4 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -928,8 +928,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
 
 	if (nfqa[NFQA_CFG_PARAMS-1]) {
 		struct nfqnl_msg_config_params *params;
-		params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
 
+		if (!queue) {
+			ret = -ENOENT;
+			goto out_put;
+		}
+		params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
 		nfqnl_set_mode(queue, params->copy_mode,
 				ntohl(params->copy_range));
 	}
-- 
GitLab