[ovs-dev] [PATCH 08/11] datapath: Check for null pointer return from nla_nest_start_noflag

[Yi-Hung Wei]

From: Colin Ian King <colin.king at canonical.com>

upstream commit:

commit ca96534630e2edfd73121c487c957b17eca3b7d7
Author: Colin Ian King <colin.king at canonical.com>
Date:   Wed May 1 14:41:58 2019 +0100

    openvswitch: check for null pointer return from nla_nest_start_noflag

    The call to nla_nest_start_noflag can return null in the unlikely
    event that nla_put returns -EMSGSIZE.  Check for this condition to
    avoid a null pointer dereference on pointer nla_reply.

    Addresses-Coverity: ("Dereference null return value")
    Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Acked-by: Yi-Hung Wei <yihung.wei at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

Signed-off-by: Yi-Hung Wei <yihung.wei at gmail.com>
---
 datapath/conntrack.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index 9a7eab655142..86e7dd24bb9b 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -2273,6 +2273,10 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
 		return PTR_ERR(reply);
 
 	nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT);
+	if (!nla_reply) {
+		err = -EMSGSIZE;
+		goto exit_err;
+	}
 
 	if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
 		err = ovs_ct_limit_get_zone_limit(
-- 
2.7.4