From: Jesper Dangaard Brouer <brouer@redhat.com>
To: Simon Horman <horms@verge.net.au>, Julian Anastasov <ja@ssi.bg>,
lvs-devel@vger.kernel.org
Cc: Jesper Dangaard Brouer <brouer@redhat.com>,
Pablo Neira Ayuso <pablo@netfilter.org>,
"David S. Miller" <davem@davemloft.net>,
netdev@vger.kernel.org, "Patrick McHardy" <kaber@trash.net>
Subject: [PATCH] ipvs: avoid oops in nf_ct_seqadj_set when called from ip_vs_ftp helper
Date: Fri, 13 Dec 2013 22:37:48 +0100 [thread overview]
Message-ID: <20131213214023.14478.74738.stgit@dragon> (raw)
The IPVS FTP helper ip_vs_ftp can trigger an OOPS in nf_ct_seqadj_set,
after commit 41d73ec053d2 (netfilter: nf_conntrack: make sequence
number adjustments usuable without NAT).
We can avoid the oops in nf_ct_seqadj_set() by in ip_vs_ftp_out()
instead of calling nf_nat_mangle_tcp_packet() we simply call
__nf_nat_mangle_tcp_packet() with a "false" last parameter, which
indicate not invoking the seqadj code.
After this fix, I've tested that FTP over IPVS, with module ip_vs_ftp
loaded, works for both passive and active FTP.
Fixes: 41d73ec053d2 (netfilter: nf_conntrack: make sequence number adjustments usuable without NAT)
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
---
I'm uncertain if this is the correct fix. Perhaps the ip_vs_ftp
helper need to allocate/init the seqadj extension instead?
net/netfilter/ipvs/ip_vs_ftp.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 77c1732..b8f9573 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -268,10 +268,10 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
* packet.
*/
rcu_read_lock();
- ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+ ret = __nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
iph->ihl * 4,
start-data, end-start,
- buf, buf_len);
+ buf, buf_len, false);
rcu_read_unlock();
if (ret) {
ip_vs_nfct_expect_related(skb, ct, n_cp,
next reply other threads:[~2013-12-13 21:38 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-13 21:37 Jesper Dangaard Brouer [this message]
2013-12-14 22:25 ` [PATCH] ipvs: avoid oops in nf_ct_seqadj_set when called from ip_vs_ftp helper Julian Anastasov
2013-12-15 16:10 ` Julian Anastasov
2013-12-16 14:57 ` Jesper Dangaard Brouer
2013-12-16 21:05 ` Julian Anastasov
2013-12-16 16:09 ` [net PATCH 0/2] Fixing OOPSes in seqadj code Jesper Dangaard Brouer
2013-12-16 16:09 ` [net PATCH 1/2] netfilter: WARN about wrong usage of sequence number adjustments Jesper Dangaard Brouer
2013-12-16 16:09 ` [net PATCH 2/2] ipvs: correct usage/allocation of seqadj ext in ipvs Jesper Dangaard Brouer
2013-12-16 21:11 ` [net PATCH 0/2] Fixing OOPSes in seqadj code Julian Anastasov
2013-12-17 1:36 ` Simon Horman
2013-12-27 3:23 ` Simon Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131213214023.14478.74738.stgit@dragon \
--to=brouer@redhat.com \
--cc=davem@davemloft.net \
--cc=horms@verge.net.au \
--cc=ja@ssi.bg \
--cc=kaber@trash.net \
--cc=lvs-devel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).