Fix ct_sync crash

Fix ct_sync crash

[Holger Eitzenberger]

Hi,

the following two patches fix a bug in ct_sync.

Please apply, thanks!

/holger

Fix ct_sync crash

[Holger Eitzenberger]

GIT: Please enter your email below.
GIT: Lines beginning in "GIT: " will be removed.
GIT: Consider including an overall diffstat or table of contents
GIT: for the patch you are writing.
Hi,

the following two patches fix a bug in ct_sync.

Please apply, thanks!

/holger

Fix ct_sync crash

[Holger Eitzenberger]

Hi,

the following two patches fix a bug in ct_sync.

Please apply, thanks!

/holger

[PATCH] [CT_SYNC] Fix use of unitializied tuplehash list-head

[Holger Eitzenberger]

ct_sync fails to initialize its tuplehash list-head upon creation
of a new conntrack, so that an list_del() later on in
destroy_conntrack() leads to a crash.

This patch initializes the list-head.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Holger Eitzenberger <heitzenberger@astaro.com>

---

 ct_sync/ct_sync_main.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

3bdbf56aa5e9e7411d8f32fa896f51ebd5a8ce15
diff --git a/ct_sync/ct_sync_main.c b/ct_sync/ct_sync_main.c
index 372374d..a73fd97 100644
--- a/ct_sync/ct_sync_main.c
+++ b/ct_sync/ct_sync_main.c
@@ -613,6 +613,8 @@ ct_sync_msg_process_update_ct(struct ct_
 			CT_SYNC_LEAVE();
 			return -1;
 		}
+
+		INIT_LIST_HEAD(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
 		new = 1;
 	}
 
-- 
-dirty

[PATCH] [NETFILTER] Remove BUG_ON() in destroy_conntrack()

[Holger Eitzenberger]

Remove BUG_ON(list_empty(...)) check in destroy_conntrack because
it is perfectly valid for conntracks to be in no list at all, e. g.
if ct_sync is used.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Holger Eitzenberger <heitzenberger@astaro.com>

---

 net/ipv4/netfilter/ip_conntrack_core.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

8f62bac9822927ea1306d4752ca48cb1d9f73ff0
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 14660db..6bec236 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -339,10 +339,8 @@ destroy_conntrack(struct nf_conntrack *n
 	ip_ct_remove_expectations(ct);
 
 	/* We overload first tuple to link into unconfirmed list. */
-	if (!is_confirmed(ct)) {
-		BUG_ON(list_empty(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list));
+	if (!is_confirmed(ct))
 		list_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
-	}
 
 	CONNTRACK_STAT_INC(delete);
 	write_unlock_bh(&ip_conntrack_lock);
-- 
-dirty

Re: [PATCH] [NETFILTER] Remove BUG_ON() in destroy_conntrack()

[Patrick McHardy]

Holger Eitzenberger wrote:
> Remove BUG_ON(list_empty(...)) check in destroy_conntrack because
> it is perfectly valid for conntracks to be in no list at all, e. g.
> if ct_sync is used.

This should stay in the ct_sync patchset until it is merged.