netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().

ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id],
but the function is exposed to user space before the entry is allocated
via register_pernet_subsys().

Let's call register_pernet_subsys() before xt_register_template().

Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 52cf104e347881f052f1d515e78f05815bf7f45b..e119d4f090cc88d91a81a73be40c76d71e948018 100644 (file)
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -147,23 +147,27 @@ static struct pernet_operations ip6table_nat_net_ops = {
 
 static int __init ip6table_nat_init(void)
 {
-       int ret = xt_register_template(&nf_nat_ipv6_table,
-                                      ip6table_nat_table_init);
+       int ret;
 
+       /* net->gen->ptr[ip6table_nat_net_id] must be allocated
+        * before calling ip6t_nat_register_lookups().
+        */
+       ret = register_pernet_subsys(&ip6table_nat_net_ops);
        if (ret < 0)
                return ret;
 
-       ret = register_pernet_subsys(&ip6table_nat_net_ops);
+       ret = xt_register_template(&nf_nat_ipv6_table,
+                                  ip6table_nat_table_init);
        if (ret)
-               xt_unregister_template(&nf_nat_ipv6_table);
+               unregister_pernet_subsys(&ip6table_nat_net_ops);
 
        return ret;
 }
 
 static void __exit ip6table_nat_exit(void)
 {
-       unregister_pernet_subsys(&ip6table_nat_net_ops);
        xt_unregister_template(&nf_nat_ipv6_table);
+       unregister_pernet_subsys(&ip6table_nat_net_ops);
 }
 
 module_init(ip6table_nat_init);