* [PATCH nf] netfilter: expect: fix crash when putting uninited expectation
@ 2017-07-10 11:53 Florian Westphal
2017-07-11 0:40 ` 高峰
2017-07-17 15:08 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Florian Westphal @ 2017-07-10 11:53 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal, Gao Feng
We crash in __nf_ct_expect_check, it calls nf_ct_remove_expect on the
uninitialised expectation instead of existing one, so del_timer chokes
on random memory address.
Fixes: ec0e3f01114ad32711243 ("netfilter: nf_ct_expect: Add nf_ct_remove_expect()")
Reported-by: Sergey Kvachonok <ravenexp@gmail.com>
Tested-by: Sergey Kvachonok <ravenexp@gmail.com>
Cc: Gao Feng <fgao@ikuai8.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nf_conntrack_expect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e03d16ed550d..899c2c36da13 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
h = nf_ct_expect_dst_hash(net, &expect->tuple);
hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
if (expect_matches(i, expect)) {
- if (nf_ct_remove_expect(expect))
+ if (nf_ct_remove_expect(i))
break;
} else if (expect_clash(i, expect)) {
ret = -EBUSY;
--
2.13.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* RE: [PATCH nf] netfilter: expect: fix crash when putting uninited expectation
2017-07-10 11:53 [PATCH nf] netfilter: expect: fix crash when putting uninited expectation Florian Westphal
@ 2017-07-11 0:40 ` 高峰
2017-07-17 15:08 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: 高峰 @ 2017-07-11 0:40 UTC (permalink / raw)
To: 'Florian Westphal', netfilter-devel
> From: Florian Westphal [mailto:fw@strlen.de]
> Subject: [PATCH nf] netfilter: expect: fix crash when putting uninited
> expectation
>
> We crash in __nf_ct_expect_check, it calls nf_ct_remove_expect on the
> uninitialised expectation instead of existing one, so del_timer chokes on
> random memory address.
>
> Fixes: ec0e3f01114ad32711243 ("netfilter: nf_ct_expect: Add
> nf_ct_remove_expect()")
> Reported-by: Sergey Kvachonok <ravenexp@gmail.com>
> Tested-by: Sergey Kvachonok <ravenexp@gmail.com>
> Cc: Gao Feng <fgao@ikuai8.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/netfilter/nf_conntrack_expect.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nf_conntrack_expect.c
> b/net/netfilter/nf_conntrack_expect.c
> index e03d16ed550d..899c2c36da13 100644
> --- a/net/netfilter/nf_conntrack_expect.c
> +++ b/net/netfilter/nf_conntrack_expect.c
> @@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(struct
> nf_conntrack_expect *expect)
> h = nf_ct_expect_dst_hash(net, &expect->tuple);
> hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
> if (expect_matches(i, expect)) {
> - if (nf_ct_remove_expect(expect))
> + if (nf_ct_remove_expect(i))
Thanks your fix. It's a typo indeed.
Best Regards
Feng
> break;
> } else if (expect_clash(i, expect)) {
> ret = -EBUSY;
> --
> 2.13.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH nf] netfilter: expect: fix crash when putting uninited expectation
2017-07-10 11:53 [PATCH nf] netfilter: expect: fix crash when putting uninited expectation Florian Westphal
2017-07-11 0:40 ` 高峰
@ 2017-07-17 15:08 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-07-17 15:08 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel, Gao Feng
On Mon, Jul 10, 2017 at 01:53:53PM +0200, Florian Westphal wrote:
> We crash in __nf_ct_expect_check, it calls nf_ct_remove_expect on the
> uninitialised expectation instead of existing one, so del_timer chokes
> on random memory address.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-07-17 15:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-07-10 11:53 [PATCH nf] netfilter: expect: fix crash when putting uninited expectation Florian Westphal
2017-07-11 0:40 ` 高峰
2017-07-17 15:08 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).