[NETFILTER -stable]: ipt_CLUSTERIP: fix oops in checkentry function

* [NETFILTER -stable]: ipt_CLUSTERIP: fix oops in checkentry function
@ 2007-04-10 12:47 Patrick McHardy
  2007-04-10 20:27 ` David Miller
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Patrick McHardy @ 2007-04-10 12:47 UTC (permalink / raw)
  To: stable; +Cc: Netfilter Development Mailinglist, David S. Miller

[-- Attachment #1: Type: text/plain, Size: 53 bytes --]

Fix netfilter crash in ipt_CLUSTERIP. Please apply.


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1432 bytes --]

[NETFILTER]: ipt_CLUSTERIP: fix oops in checkentry function

The clusterip_config_find_get() already increases entries reference
counter, so there is no reason to do it twice in checkentry() callback.

This causes the config to be freed before it is removed from the list,
resulting in a crash when adding the next rule.

Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 587ef6fd51ede13f0b3437910d5ecefb980461ed
tree df06064ff57ee2ddcd4b47d8a7450c7f797fa230
parent fea42a5760325392653d556b1087f8274adcfb2e
author Jaroslav Kysela <perex@suse.cz> Tue, 10 Apr 2007 14:42:29 +0200
committer Patrick McHardy <kaber@trash.net> Tue, 10 Apr 2007 14:42:29 +0200

 net/ipv4/netfilter/ipt_CLUSTERIP.c |    2 --
 1 files changed, 0 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e965b33..42b0802 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -411,12 +411,10 @@ checkentry(const char *tablename,
 				       "has invalid config pointer!\n");
 				return 0;
 			}
-			clusterip_config_entry_get(cipinfo->config);
 		} else {
 			/* Case B: This is a new rule referring to an existing
 			 * clusterip config. */
 			cipinfo->config = config;
-			clusterip_config_entry_get(cipinfo->config);
 		}
 	} else {
 		/* Case C: This is a completely new clusterip config */

^ permalink raw reply related	[flat|nested] 4+ messages in thread