From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 05/18] netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report()
Date: Fri, 7 Feb 2014 18:41:31 +0100 [thread overview]
Message-ID: <1391794904-4017-6-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1391794904-4017-1-git-send-email-pablo@netfilter.org>
From: Alexey Dobriyan <adobriyan@gmail.com>
Similar bug fixed in SIP module in 3f509c6 ("netfilter: nf_nat_sip: fix
incorrect handling of EBUSY for RTCP expectation").
BUG: unable to handle kernel paging request at 00100104
IP: [<f8214f07>] nf_ct_unlink_expect_report+0x57/0xf0 [nf_conntrack]
...
Call Trace:
[<c0244bd8>] ? del_timer+0x48/0x70
[<f8215687>] nf_ct_remove_expectations+0x47/0x60 [nf_conntrack]
[<f8211c99>] nf_ct_delete_from_lists+0x59/0x90 [nf_conntrack]
[<f8212e5e>] death_by_timeout+0x14e/0x1c0 [nf_conntrack]
[<f8212d10>] ? nf_conntrack_set_hashsize+0x190/0x190 [nf_conntrack]
[<c024442d>] call_timer_fn+0x1d/0x80
[<c024461e>] run_timer_softirq+0x18e/0x1a0
[<f8212d10>] ? nf_conntrack_set_hashsize+0x190/0x190 [nf_conntrack]
[<c023e6f3>] __do_softirq+0xa3/0x170
[<c023e650>] ? __local_bh_enable+0x70/0x70
<IRQ>
[<c023e587>] ? irq_exit+0x67/0xa0
[<c0202af6>] ? do_IRQ+0x46/0xb0
[<c027ad05>] ? clockevents_notify+0x35/0x110
[<c066ac6c>] ? common_interrupt+0x2c/0x40
[<c056e3c1>] ? cpuidle_enter_state+0x41/0xf0
[<c056e6fb>] ? cpuidle_idle_call+0x8b/0x100
[<c02085f8>] ? arch_cpu_idle+0x8/0x30
[<c027314b>] ? cpu_idle_loop+0x4b/0x140
[<c0273258>] ? cpu_startup_entry+0x18/0x20
[<c066056d>] ? rest_init+0x5d/0x70
[<c0813ac8>] ? start_kernel+0x2ec/0x2f2
[<c081364f>] ? repair_env_string+0x5b/0x5b
[<c0813269>] ? i386_start_kernel+0x33/0x35
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/nf_nat_h323.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 9eea059d..574f7eb 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -229,7 +229,10 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
ret = nf_ct_expect_related(rtcp_exp);
if (ret == 0)
break;
- else if (ret != -EBUSY) {
+ else if (ret == -EBUSY) {
+ nf_ct_unexpect_related(rtp_exp);
+ continue;
+ } else if (ret < 0) {
nf_ct_unexpect_related(rtp_exp);
nated_port = 0;
break;
--
1.7.10.4
next prev parent reply other threads:[~2014-02-07 17:42 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-07 17:41 [PATCH 00/18] Netfilter/nftables/IPVS fixes for net Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 01/18] ipvs: fix AF assignment in ip_vs_conn_new() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 02/18] netfilter: nft_ct: fix unconditional dump of 'dir' attr Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 03/18] netfilter: nf_tables: fix oops when deleting a chain with references Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 04/18] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get Pablo Neira Ayuso
2014-02-07 17:41 ` Pablo Neira Ayuso [this message]
2014-02-07 17:41 ` [PATCH 06/18] netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 07/18] netfilter: nf_tables: fix overrun in nf_tables_set_alloc_name() Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 08/18] netfilter: nf_tables: fix potential oops when dumping sets Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 09/18] netfilter: nft_ct: fix missing NFT_CT_L3PROTOCOL key in validity checks Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 10/18] netfilter: nf_tables: add AF specific expression support Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 11/18] netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 12/18] netfilter: nf_tables: add reject module for NFPROTO_INET Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 13/18] netfilter: nf_tables: fix log/queue expressions " Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 14/18] netfilter: nf_tables: fix racy rule deletion Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 15/18] netfilter: nf_tables: do not allow NFT_SET_ELEM_INTERVAL_END flag and data Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 16/18] netfilter: nft_rbtree: fix data handling of end interval elements Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 17/18] netfilter: nf_tables: fix loop checking with " Pablo Neira Ayuso
2014-02-07 17:41 ` [PATCH 18/18] netfilter: nf_tables: unininline nft_trace_packet() Pablo Neira Ayuso
2014-02-09 22:20 ` [PATCH 00/18] Netfilter/nftables/IPVS fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1391794904-4017-6-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).