[PATCH 2.6.11]: Clear NAT status bits on module unload

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 139 bytes --]

Hi Dave,

another patch which I think should go in 2.6.11, it fixes a crash
when unloading, then reloading iptable_nat.

Regards
Patrick



[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1584 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2005/02/05 03:49:38+01:00 kaber@coreworks.de 
#   [NETFILTER]: Clear NAT status bits on module unload
#   
#   ip_nat_core doesn't clear the status bits in struct ip_conntrack on
#   module unload, but zeroes out the nat area. When the module is loaded
#   again and a connection times out ip_nat_cleanup_conntrack tries to
#   list_del the zeroed list-head and crashes. There are probably more
#   conditions under which it can crash or cause other misbehaviour.
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
# net/ipv4/netfilter/ip_nat_core.c
#   2005/02/05 03:49:28+01:00 kaber@coreworks.de +1 -0
#   [NETFILTER]: Clear NAT status bits on module unload
#   
#   ip_nat_core doesn't clear the status bits in struct ip_conntrack on
#   module unload, but zeroes out the nat area. When the module is loaded
#   again and a connection times out ip_nat_cleanup_conntrack tries to
#   list_del the zeroed list-head and crashes. There are probably more
#   conditions under which it can crash or cause other misbehaviour.
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
diff -Nru a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
--- a/net/ipv4/netfilter/ip_nat_core.c	2005-02-05 03:50:14 +01:00
+++ b/net/ipv4/netfilter/ip_nat_core.c	2005-02-05 03:50:14 +01:00
@@ -543,6 +543,7 @@
 static int clean_nat(struct ip_conntrack *i, void *data)
 {
 	memset(&i->nat, 0, sizeof(i->nat));
+	i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK | IPS_SEQ_ADJUST);
 	return 0;
 }