Re: [PATCH] Check returnvalue of nfct_nat()

[Martin Josefsson <gandalf@wlug.westbo.se>]

[-- Attachment #1: Type: text/plain, Size: 1304 bytes --]

On Mon, 2006-11-27 at 17:24 +0100, Patrick McHardy wrote:

> Thanks, I just noticed the same crash when loading iptable_nat over
> ssh (it works fine with the additional checks now).

:)

I seem to always find new bugs when porting my patches to a newer
kernels :)
This time it was this bug and a strange locking bug in what appears to
be socket locking, Peter Zijlstra just mailed me a possible fix for
that.

> > Some of the checks in the patch might not be strictly neccessary, I havn't
> > audited the calls, it was 4 AM :) The check added in nf_nat_fn() should take
> > care of things for us...
> 
> The nfct_help part is a bit more trickier since not only can
> nfct_help return NULL, but nfct_help(ct)->help can become NULL
> as well when the helper is unloaded even while it is still
> executing. I want to think about this some more, but I went
> over the nfct_nat part and added the ones that look necessary,
> it came down to only two :)

:) My brain was shutting down and the NAT core is still a lot of voodoo
for me :) I just added checks everywhere so I could continue to test my
patches, great that you reviewed it and sorted out which ones are really
neccessary.

I'll give your revised patch a go and see if it survives my tests.

Thanks.

-- 
/Martin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]