Re: [NETFILTER 02/03]: ip_tables: fix compat related crash

[David Miller <davem@davemloft.net>]

From: Patrick McHardy <kaber@trash.net>
Date: Tue,  5 Jun 2007 15:35:11 +0200 (MEST)

> [NETFILTER]: ip_tables: fix compat related crash
> 
> check_compat_entry_size_and_hooks iterates over the matches and calls
> compat_check_calc_match, which loads the match and calculates the
> compat offsets, but unlike the non-compat version, doesn't call
> ->checkentry yet. On error however it calls cleanup_matches, which in
> turn calls ->destroy, which can result in crashes if the destroy
> function (validly) expects to only get called after the checkentry
> function.
> 
> Add a compat_release_match function that only drops the module reference
> on error and rename compat_check_calc_match to compat_find_calc_match to
> reflect the fact that it doesn't call the checkentry function.
> 
> Reported by Jan Engelhardt <jengelh@linux01.gwdg.de>
> 
> Signed-off-by: Dmitry Mishin <dim@openvz.org>
> Signed-off-by: Patrick McHardy <kaber@trash.net>

Applied.