[PATCH 1/2 nf] netfilter: seqadj: Fix some possible panics of seqadj when mem is exhausted
flat view
STALE3681d
From: <hidden>
Date: 2016-09-02 01:48:56
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Gao Feng <redacted> When memory is exhausted, nfct_seqadj_ext_add may fail to add the seqadj extension. But these interface functions nf_ct_seqadj_init and nf_ct_seq_adjust don't check if they get the valid seqadj pointer by the nfct_seqadj, while nf_ct_seqadj_set and nf_ct_seq_offset perform that check. So the system would be panic when nfct_seqadj_ext_add failed. Signed-off-by: Gao Feng <redacted> --- net/netfilter/nf_conntrack_seqadj.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index dff0f0c..2a2fd0e 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c@@ -16,9 +16,14 @@ int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo, if (off == 0) return 0; + seqadj = nfct_seqadj(ct); + if (unlikely(!seqadj)) { + WARN_ONCE(1, "Missing nfct_seqadj_ext_add() setup call\n"); + return 0; + } + set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); - seqadj = nfct_seqadj(ct); this_way = &seqadj->seq[dir]; this_way->offset_before = off; this_way->offset_after = off;
@@ -171,6 +176,11 @@ int nf_ct_seq_adjust(struct sk_buff *skb, struct nf_ct_seqadj *this_way, *other_way; int res; + if (unlikely(!seqadj)) { + WARN_ONCE(1, "Missing nfct_seqadj_ext_add() setup call\n"); + return 0; + } + this_way = &seqadj->seq[dir]; other_way = &seqadj->seq[!dir];
@@ -218,8 +228,10 @@ s32 nf_ct_seq_offset(const struct nf_conn *ct, struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); struct nf_ct_seqadj *this_way; - if (!seqadj) + if (unlikely(!seqadj)) { + WARN_ONCE(1, "Missing nfct_seqadj_ext_add() setup call\n"); return 0; + } this_way = &seqadj->seq[dir]; return after(seq, this_way->correction_pos) ?
--
1.9.1