diff options
author | Florian Westphal <fw@strlen.de> | 2016-11-23 03:11:03 +0300 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-11-24 16:43:35 +0300 |
commit | 5173bc679dec881120df109a6a2b39143235382c (patch) | |
tree | f646792fa521b2cb536f5e9ea1bf17d889e8a412 /net/ipv6/netfilter | |
parent | 49cdc4c74918a5576cb93b679629714d8a9ef399 (diff) | |
download | linux-5173bc679dec881120df109a6a2b39143235382c.tar.xz |
netfilter: nat: fix crash when conntrack entry is re-used
Stas Nichiporovich reports oops in nf_nat_bysource_cmp(), trying to
access nf_conn struct at address 0xffffffffffffff50.
This is the result of fetching a null rhash list (struct embedded at
offset 176; 0 - 176 gets us ...fff50).
The problem is that conntrack entries are allocated from a
SLAB_DESTROY_BY_RCU cache, i.e. entries can be free'd and reused
on another cpu while nf nat bysource hash access the same conntrack entry.
Freeing is fine (we hold rcu read lock); zeroing rhlist_head isn't.
-> Move the rhlist struct outside of the memset()-inited area.
Fixes: 7c9664351980aaa6a ("netfilter: move nat hlist_head to nf_conn")
Reported-by: Stas Nichiporovich <stasn77@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6/netfilter')
0 files changed, 0 insertions, 0 deletions