Commit 1f305323ff5b9ddc1a4346d36072bcdb58f3f68a
Committed by
David S. Miller
1 parent
0a06ea8718
[NETFILTER]: Fix kernel panic with REDIRECT target.
When connection tracking entry (nf_conn) is about to copy itself it can have some of its extension users (like nat) as being already freed and thus not required to be copied. Actually looking at this function I suspect it was copied from nf_nat_setup_info() and thus bug was introduced. Report and testing from David <david@unsolicited.net>. [ Patrick McHardy states: I now understand whats happening: - new connection is allocated without helper - connection is REDIRECTed to localhost - nf_nat_setup_info adds NAT extension, but doesn't initialize it yet - nf_conntrack_alter_reply performs a helper lookup based on the new tuple, finds the SIP helper and allocates a helper extension, causing reallocation because of too little space - nf_nat_move_storage is called with the uninitialized nat extension So your fix is entirely correct, thanks a lot :) ] Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 1 changed file with 1 additions and 4 deletions Side-by-side Diff
net/ipv4/netfilter/nf_nat_core.c
... | ... | @@ -607,12 +607,9 @@ |
607 | 607 | struct nf_conn_nat *new_nat = nf_ct_ext_find(conntrack, NF_CT_EXT_NAT); |
608 | 608 | struct nf_conn_nat *old_nat = (struct nf_conn_nat *)old; |
609 | 609 | struct nf_conn *ct = old_nat->ct; |
610 | - unsigned int srchash; | |
611 | 610 | |
612 | - if (!(ct->status & IPS_NAT_DONE_MASK)) | |
611 | + if (!ct || !(ct->status & IPS_NAT_DONE_MASK)) | |
613 | 612 | return; |
614 | - | |
615 | - srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); | |
616 | 613 | |
617 | 614 | write_lock_bh(&nf_nat_lock); |
618 | 615 | hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource); |