From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Rafal Fitt <rafalf@aplusc.com.pl>,
David Miller <davem@davemloft.net>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [ 23/37] netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation
Date: Thu, 18 Oct 2012 20:16:46 -0700 [thread overview]
Message-ID: <20121019031306.577236590@linuxfoundation.org> (raw)
In-Reply-To: <20121019031302.789593147@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 3f509c689a07a4aa989b426893d8491a7ffcc410 upstream.
We're hitting bug while trying to reinsert an already existing
expectation:
kernel BUG at kernel/timer.c:895!
invalid opcode: 0000 [#1] SMP
[...]
Call Trace:
<IRQ>
[<ffffffffa0069563>] nf_ct_expect_related_report+0x4a0/0x57a [nf_conntrack]
[<ffffffff812d423a>] ? in4_pton+0x72/0x131
[<ffffffffa00ca69e>] ip_nat_sdp_media+0xeb/0x185 [nf_nat_sip]
[<ffffffffa00b5b9b>] set_expected_rtp_rtcp+0x32d/0x39b [nf_conntrack_sip]
[<ffffffffa00b5f15>] process_sdp+0x30c/0x3ec [nf_conntrack_sip]
[<ffffffff8103f1eb>] ? irq_exit+0x9a/0x9c
[<ffffffffa00ca738>] ? ip_nat_sdp_media+0x185/0x185 [nf_nat_sip]
We have to remove the RTP expectation if the RTCP expectation hits EBUSY
since we keep trying with other ports until we succeed.
Reported-by: Rafal Fitt <rafalf@aplusc.com.pl>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/nf_nat_sip.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -501,7 +501,10 @@ static unsigned int ip_nat_sdp_media(str
ret = nf_ct_expect_related(rtcp_exp);
if (ret == 0)
break;
- else if (ret != -EBUSY) {
+ else if (ret == -EBUSY) {
+ nf_ct_unexpect_related(rtp_exp);
+ continue;
+ } else if (ret < 0) {
nf_ct_unexpect_related(rtp_exp);
port = 0;
break;
next prev parent reply other threads:[~2012-10-19 3:19 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-19 3:16 [ 00/37] 3.0.47-stable review Greg Kroah-Hartman
2012-10-19 3:16 ` [ 01/37] ARM: vfp: fix saving d16-d31 vfp registers on v6+ kernels Greg Kroah-Hartman
2012-10-19 3:16 ` [ 02/37] lockd: use rpc clients cl_nodename for id encoding Greg Kroah-Hartman
2012-10-19 23:15 ` Ben Hutchings
2012-10-21 16:26 ` Greg Kroah-Hartman
2012-10-22 17:02 ` Myklebust, Trond
2012-10-23 1:36 ` Ben Hutchings
2012-10-24 15:44 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 03/37] ACPI: EC: Make the GPE storm threshold a module parameter Greg Kroah-Hartman
2012-10-19 3:16 ` [ 04/37] ACPI: EC: Add a quirk for CLEVO M720T/M730T laptop Greg Kroah-Hartman
2012-10-19 3:16 ` [ 05/37] mips,kgdb: fix recursive page fault with CONFIG_KPROBES Greg Kroah-Hartman
2012-10-19 3:16 ` [ 06/37] tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking Greg Kroah-Hartman
2012-10-19 3:16 ` [ 07/37] ARM: 7541/1: Add ARM ERRATA 775420 workaround Greg Kroah-Hartman
2012-10-19 3:16 ` [ 08/37] firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel) Greg Kroah-Hartman
2012-10-19 3:16 ` [ 09/37] SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT Greg Kroah-Hartman
2012-10-19 3:16 ` [ 10/37] xen/bootup: allow {read|write}_cr8 pvops call Greg Kroah-Hartman
2012-10-19 3:16 ` [ 11/37] xen/bootup: allow read_tscp call for Xen PV guests Greg Kroah-Hartman
2012-10-19 3:16 ` [ 12/37] block: fix request_queue->flags initialization Greg Kroah-Hartman
2012-10-19 23:16 ` Ben Hutchings
2012-10-21 16:25 ` Greg Kroah-Hartman
2012-10-21 18:56 ` Tejun Heo
2012-10-22 15:36 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 13/37] autofs4 - fix reset pending flag on mount fail Greg Kroah-Hartman
2012-10-19 3:16 ` [ 14/37] module: taint kernel when lve module is loaded Greg Kroah-Hartman
2012-10-19 3:16 ` [ 15/37] video/udlfb: fix line counting in fb_write Greg Kroah-Hartman
2012-10-19 3:16 ` [ 16/37] viafb: dont touch clock state on OLPC XO-1.5 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 17/37] timers: Fix endless looping between cascade() and internal_add_timer() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 18/37] pktgen: fix crash when generating IPv6 packets Greg Kroah-Hartman
2012-10-19 3:16 ` [ 19/37] tg3: Apply short DMA frag workaround to 5906 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 20/37] ipvs: fix oops in ip_vs_dst_event on rmmod Greg Kroah-Hartman
2012-10-19 3:16 ` [ 21/37] netfilter: nf_conntrack: fix racy timer handling with reliable events Greg Kroah-Hartman
2012-10-19 3:16 ` [ 22/37] netfilter: nf_ct_ipv4: packets with wrong ihl are invalid Greg Kroah-Hartman
2012-10-19 3:16 ` Greg Kroah-Hartman [this message]
2012-10-19 3:16 ` [ 24/37] ipvs: fix oops on NAT reply in br_nf context Greg Kroah-Hartman
2012-10-19 3:16 ` [ 25/37] netfilter: nf_nat_sip: fix via header translation with multiple parameters Greg Kroah-Hartman
2012-10-19 3:16 ` [ 26/37] netfilter: nf_ct_expect: fix possible access to uninitialized timer Greg Kroah-Hartman
2012-10-19 3:16 ` [ 27/37] netfilter: limit, hashlimit: avoid duplicated inline Greg Kroah-Hartman
2012-10-19 3:16 ` [ 28/37] netfilter: xt_limit: have r->cost != 0 case work Greg Kroah-Hartman
2012-10-19 3:16 ` [ 29/37] Add CDC-ACM support for the CX93010-2x UCMxx USB Modem Greg Kroah-Hartman
2012-10-19 3:16 ` [ 30/37] drm/radeon: Dont destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 31/37] jbd: Fix assertion failure in commit code due to lacking transaction credits Greg Kroah-Hartman
2012-10-19 3:16 ` [ 32/37] x86, random: Architectural inlines to get random integers with RDRAND Greg Kroah-Hartman
2012-10-19 3:16 ` [ 33/37] x86, random: Verify RDRAND functionality and allow it to be disabled Greg Kroah-Hartman
2012-10-19 3:16 ` [ 34/37] tpm: Propagate error from tpm_transmit to fix a timeout hang Greg Kroah-Hartman
2012-10-19 3:16 ` [ 35/37] udf: fix retun value on error path in udf_load_logicalvol Greg Kroah-Hartman
2012-10-19 3:16 ` [ 36/37] ALSA: ac97 - Fix missing NULL check in snd_ac97_cvol_new() Greg Kroah-Hartman
2012-10-19 3:17 ` [ 37/37] ALSA: emu10k1: add chip details for E-mu 1010 PCIe card Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121019031306.577236590@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=rafalf@aplusc.com.pl \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).