From: Colin Ian King Date: Wed, 1 May 2019 13:41:58 +0000 (+0100) Subject: openvswitch: check for null pointer return from nla_nest_start_noflag X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=ca96534630e2edfd73121c487c957b17eca3b7d7;p=android-x86%2Fkernel.git openvswitch: check for null pointer return from nla_nest_start_noflag The call to nla_nest_start_noflag can return null in the unlikely event that nla_put returns -EMSGSIZE. Check for this condition to avoid a null pointer dereference on pointer nla_reply. Addresses-Coverity: ("Dereference null return value") Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Signed-off-by: Colin Ian King Acked-by: Yi-Hung Wei Signed-off-by: David S. Miller --- diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index bded32144619..caeabf5215e8 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2161,6 +2161,10 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) return PTR_ERR(reply); nla_reply = nla_nest_start_noflag(reply, OVS_CT_LIMIT_ATTR_ZONE_LIMIT); + if (!nla_reply) { + err = -EMSGSIZE; + goto exit_err; + } if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { err = ovs_ct_limit_get_zone_limit(