From fa7e056eaee77166b02a37ac0ff199effb6ba09e Mon Sep 17 00:00:00 2001 From: Shane Ringrose Date: Thu, 9 Jul 2026 14:09:08 +1200 Subject: [PATCH] nft_bandwidth: add missing NULL guards to bandwidth_deps/tree_map.h Bandwidth carries its own private copy of the tree_map code family that package/libericstools/src/tree_map.c also uses. That copy already had NULL-pointer guards added earlier for the same segfault class; this copy was missing them. Adds get_string_map_element_with_hashed_key, get_string_map_keys, and sdbm_string_hash NULL checks to match. Found while investigating a separate kernel 6.12 boot corruption bug in this module; tested in isolation and confirmed NOT the cause of that corruption, but a real defensive gap worth fixing on its own merits. --- .../module/bandwidth_deps/tree_map.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/netfilter-match-modules/nftables/bandwidth/module/bandwidth_deps/tree_map.h b/netfilter-match-modules/nftables/bandwidth/module/bandwidth_deps/tree_map.h index ecbf3f168..1d9387fd7 100644 --- a/netfilter-match-modules/nftables/bandwidth/module/bandwidth_deps/tree_map.h +++ b/netfilter-match-modules/nftables/bandwidth/module/bandwidth_deps/tree_map.h @@ -213,6 +213,10 @@ void* get_string_map_element(string_map* map, const char* key) void* get_string_map_element_with_hashed_key(string_map* map, unsigned long hashed_key) { void* return_value; + if(map == NULL) + { + return NULL; + } /* printk("doing lookup for key = %lu\n", hashed_key); */ return_value = get_long_map_element( &(map->lm), hashed_key); if(return_value != NULL && map->store_keys) @@ -278,6 +282,16 @@ void* remove_string_map_element(string_map* map, const char* key) char** get_string_map_keys(string_map* map, unsigned long* num_keys_returned) { char** str_keys; + if(map == NULL) + { + *num_keys_returned = 0; + str_keys = (char**)malloc(sizeof(char*)); + if(str_keys != NULL) + { + str_keys[0] = NULL; + } + return str_keys; + } str_keys = (char**)malloc((map->num_elements+1)*sizeof(char*)); if(str_keys == NULL) /* deal with malloc failure */ { @@ -1079,6 +1093,11 @@ static unsigned long sdbm_string_hash(const char *key) { unsigned long hashed_key = 0; + if(key == NULL) + { + return hashed_key; + } + int index = 0; unsigned int nextch; while(key[index] != '\0')