lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: nf_conntrack: fix ct refcount leak in l4proto->error()

Browse Source 
This patch fixes a refcount leak of ct objects that may occur if
l4proto->error() assigns one conntrack object to one skbuff. In
that case, we have to skip further processing in nf_conntrack_in().

With this patch, we can also fix wrong return values (-NF_ACCEPT)
for special cases in ICMP[v6] that should not bump the invalid/error
statistic counters.

Reported-by: Zoltan Menyhart <Zoltan.Menyhart@bull.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2011-06-02 15:08:45 +02:00
parent d9be76f385
commit 88ed01d17b
3 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
View File

@@ -160,7 +160,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
/* Update skb to refer to this connection */ /* Update skb to refer to this connection */
skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general; skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
skb->nfctinfo = *ctinfo; skb->nfctinfo = *ctinfo;
return -NF_ACCEPT; return NF_ACCEPT;
} }
/* Small and modified version of icmp_rcv */ /* Small and modified version of icmp_rcv */

2
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View File

@@ -177,7 +177,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
/* Update skb to refer to this connection */ /* Update skb to refer to this connection */
skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general; skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
skb->nfctinfo = *ctinfo; skb->nfctinfo = *ctinfo;
return -NF_ACCEPT; return NF_ACCEPT;
} }
static int static int

3
net/netfilter/nf_conntrack_core.c
View File

@@ -922,6 +922,9 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
ret = -ret; ret = -ret;
goto out; goto out;
} }
/* ICMP[v6] protocol trackers may assign one conntrack. */
if (skb->nfct)
goto out;
} }
ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum, ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,