Function nla_nest_start() may return a NULL pointer on error. However, in function lwtunnel_fill_encap(), the return value of nla_nest_start() is not checked against NULL (see line 218), and may result in bad memory access. Related code snippets are shown as follows.

lwtunnel_fill_encap @@ net/core/lwtunnel.c: 204
204 int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate)
205 {
206     const struct lwtunnel_encap_ops *ops;
207     struct nlattr *nest;
208     int ret = -EINVAL;
209 
210     if (!lwtstate)
211         return 0;
212 
213     if (lwtstate->type == LWTUNNEL_ENCAP_NONE ||
214         lwtstate->type > LWTUNNEL_ENCAP_MAX)
215         return 0;
216 
217     ret = -EOPNOTSUPP;
218     nest = nla_nest_start(skb, RTA_ENCAP);
219     rcu_read_lock();
220     ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
221     if (likely(ops && ops->fill_encap))
222         ret = ops->fill_encap(skb, lwtstate);
223     rcu_read_unlock();
224 
225     if (ret)
226         goto nla_put_failure;
227     nla_nest_end(skb, nest);
228     ret = nla_put_u16(skb, RTA_ENCAP_TYPE, lwtstate->type);
229     if (ret)
230         goto nla_put_failure;
231 
232     return 0;
233 
234 nla_put_failure:
235     nla_nest_cancel(skb, nest);
236 
237     return (ret == -EOPNOTSUPP ? 0 : ret);
238 }

Generally, the return value of function nla_nest_start() should be checked against NULL, as follows.
rtnetlink_put_metrics @@ net/core/rtnetlink.c: 
 686 int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
 687 {
 688     struct nlattr *mx;
 689     int i, valid = 0;
 690 
 691     mx = nla_nest_start(skb, RTA_METRICS);
 692     if (mx == NULL)
 693         return -ENOBUFS;
         ...
 726     return nla_nest_end(skb, mx);
 727 
 728 nla_put_failure:
 729     nla_nest_cancel(skb, mx);
 730     return -EMSGSIZE;
 731 }

 
Thanks very much for your attention!

Pan Bian