From: pablo@netfilter.org
To: netfilter-devel@vger.kernel.org
Cc: kaber@trash.net
Subject: [PATCH 1/2] netfilter: nf_ct_expect: fix re-insertion in expect list if timer refresh fails
Date: Fri, 10 Aug 2012 01:02:11 +0200 [thread overview]
Message-ID: <1344553332-8536-2-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1344553332-8536-1-git-send-email-pablo@netfilter.org>
From: Pablo Neira Ayuso <pablo@netfilter.org>
This patch fixes __nf_ct_expect_check to return 0 in case that the
expectation timer refresh fails. If the expectation is dying, we have
to make sure that we don't re-insert it again in the list.
This problem becomes more noticeable with permanent expectations, used
by the conntrack SIP helper.
RIP: 0010:[<ffffffffa00b6ce2>] [<ffffffffa00b6ce2>] flush_expectations.clone.15+0x72/0x9b
[nf_conntrack_sip]
RSP: 0018:ffff88013fc03970 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dead000000100100 RCX: ffff88011aaced68
RDX: 0000000000000000 RSI: ffff88013fc03950 RDI: ffff88009a411f78
RBP: ffff88013fc03990 R08: dead000000200200 R09: dead000000100100
R10: dead000000200200 R11: ffff88013fc03950 R12: ffff88013fc03a01
R13: 0000000000000001 R14: dead000000100100 R15: 0000000000000157
[...]
[<ffffffffa00b6e6a>] process_invite_response+0x66/0x6b [nf_conntrack_sip]
[<ffffffffa00b65a1>] process_sip_msg.clone.11+0x1db/0x236 [nf_conntrack_sip]
[<ffffffffa00b6e04>] ? process_update_response+0x6b/0x6b [nf_conntrack_sip]
[<ffffffffa00b68a6>] sip_help_udp+0x8c/0x97 [nf_conntrack_sip]
[<ffffffffa007aa15>] ipv4_confirm+0xab/0x19f [nf_conntrack_ipv4]
[<ffffffff812e54bc>] nf_iterate+0x43/0x78
Reported-by: Rafal Fitt <rafalf@aplusc.com.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_expect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 45cf602..ec8bb0d 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -398,7 +398,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
if (expect_matches(i, expect)) {
/* Refresh timer: if it's dying, ignore.. */
- if (refresh_timer(i)) {
+ if (!refresh_timer(i)) {
ret = 0;
goto out;
}
--
1.7.10.4
next prev parent reply other threads:[~2012-08-09 23:03 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-09 23:02 [PATCH 0/2] fixes for conntrack expectation pablo
2012-08-09 23:02 ` pablo [this message]
2012-08-10 0:00 ` [PATCH 1/2] netfilter: nf_ct_expect: fix re-insertion in expect list if timer refresh fails Patrick McHardy
2012-08-10 9:04 ` Pablo Neira Ayuso
2012-08-10 9:18 ` Pablo Neira Ayuso
2012-08-09 23:02 ` [PATCH 2/2] netfilter: nf_ct_expect: fix possible invalid dereference while event reporting pablo
2012-08-09 23:34 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1344553332-8536-2-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).