netfilter: nf_tables: initialize set before expression setup
nft_set_elem_expr_alloc() needs an initialized set if expression sets on
the NFT_EXPR_GC flag. Move set fields initialization before expression
setup.
[
4512935.019450] ==================================================================
[
4512935.019456] BUG: KASAN: null-ptr-deref in nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[
4512935.019487] Read of size 8 at addr
0000000000000070 by task nft/23532
[
4512935.019494] CPU: 1 PID: 23532 Comm: nft Not tainted 5.12.0-rc4+ #48
[...]
[
4512935.019502] Call Trace:
[
4512935.019505] dump_stack+0x89/0xb4
[
4512935.019512] ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[
4512935.019536] ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[
4512935.019560] kasan_report.cold.12+0x5f/0xd8
[
4512935.019566] ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[
4512935.019590] nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[
4512935.019615] nf_tables_newset+0xc7f/0x1460 [nf_tables]
Reported-by: syzbot+ce96ca2b1d0b37c6422d@syzkaller.appspotmail.com
Fixes: 65038428b2c6 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>