hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

netfilter: xt_CT: missing rcu_read_lock section in timeout assignment 

Fix a dereference to pointer without rcu_read_lock held.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2012-03-22 23:58:41 +01:00
parent c1ebd7dff7
commit 1ac0bf9926
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
net/netfilter/xt_CT.c
View File

@ -218,6 +218,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
struct ctnl_timeout *timeout; struct ctnl_timeout *timeout;
struct nf_conn_timeout *timeout_ext; struct nf_conn_timeout *timeout_ext;
rcu_read_lock();
timeout_find_get = timeout_find_get =
rcu_dereference(nf_ct_timeout_find_get_hook); rcu_dereference(nf_ct_timeout_find_get_hook);
@ -228,21 +229,21 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
ret = -EINVAL; ret = -EINVAL;
pr_info("You cannot use inversion on " pr_info("You cannot use inversion on "
"L4 protocol\n"); "L4 protocol\n");
goto err3; goto err4;
} }
timeout = timeout_find_get(info->timeout); timeout = timeout_find_get(info->timeout);
if (timeout == NULL) { if (timeout == NULL) {
ret = -ENOENT; ret = -ENOENT;
pr_info("No such timeout policy \"%s\"\n", pr_info("No such timeout policy \"%s\"\n",
info->timeout); info->timeout);
goto err3; goto err4;
} }
if (timeout->l3num != par->family) { if (timeout->l3num != par->family) {
ret = -EINVAL; ret = -EINVAL;
pr_info("Timeout policy `%s' can only be " pr_info("Timeout policy `%s' can only be "
"used by L3 protocol number %d\n", "used by L3 protocol number %d\n",
info->timeout, timeout->l3num); info->timeout, timeout->l3num);
goto err3; goto err4;
} }
if (timeout->l4proto->l4proto != e->ip.proto) { if (timeout->l4proto->l4proto != e->ip.proto) {
ret = -EINVAL; ret = -EINVAL;
@ -250,19 +251,20 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
"used by L4 protocol number %d\n", "used by L4 protocol number %d\n",
info->timeout, info->timeout,
timeout->l4proto->l4proto); timeout->l4proto->l4proto);
goto err3; goto err4;
} }
timeout_ext = nf_ct_timeout_ext_add(ct, timeout, timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
GFP_KERNEL); GFP_KERNEL);
if (timeout_ext == NULL) { if (timeout_ext == NULL) {
ret = -ENOMEM; ret = -ENOMEM;
goto err3; goto err4;
} }
} else { } else {
ret = -ENOENT; ret = -ENOENT;
pr_info("Timeout policy base is empty\n"); pr_info("Timeout policy base is empty\n");
goto err3; goto err4;
} }
rcu_read_unlock();
} }
#endif #endif
@ -272,6 +274,8 @@ out:
info->ct = ct; info->ct = ct;
return 0; return 0;
err4:
rcu_read_unlock();
err3: err3:
nf_conntrack_free(ct); nf_conntrack_free(ct);
err2: err2:
@ -313,6 +317,7 @@ static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
nf_ct_l3proto_module_put(par->family); nf_ct_l3proto_module_put(par->family);
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
rcu_read_lock();
timeout_put = rcu_dereference(nf_ct_timeout_put_hook); timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
if (timeout_put) { if (timeout_put) {
@ -320,6 +325,7 @@ static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
if (timeout_ext) if (timeout_ext)
timeout_put(timeout_ext->timeout); timeout_put(timeout_ext->timeout);
} }
rcu_read_unlock();
#endif #endif
} }
nf_ct_put(info->ct); nf_ct_put(info->ct);