Skip to content

Commit

Permalink
netfilter: xt_CT: missing rcu_read_lock section in timeout assignment
Browse files Browse the repository at this point in the history
Fix a dereference to pointer without rcu_read_lock held.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Pablo Neira Ayuso committed Mar 22, 2012
1 parent c1ebd7d commit 1ac0bf9
Showing 1 changed file with 12 additions and 6 deletions.
18 changes: 12 additions & 6 deletions net/netfilter/xt_CT.c
Original file line number Diff line number Diff line change
Expand Up @@ -218,6 +218,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
struct ctnl_timeout *timeout;
struct nf_conn_timeout *timeout_ext;

rcu_read_lock();
timeout_find_get =
rcu_dereference(nf_ct_timeout_find_get_hook);

Expand All @@ -228,41 +229,42 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
ret = -EINVAL;
pr_info("You cannot use inversion on "
"L4 protocol\n");
goto err3;
goto err4;
}
timeout = timeout_find_get(info->timeout);
if (timeout == NULL) {
ret = -ENOENT;
pr_info("No such timeout policy \"%s\"\n",
info->timeout);
goto err3;
goto err4;
}
if (timeout->l3num != par->family) {
ret = -EINVAL;
pr_info("Timeout policy `%s' can only be "
"used by L3 protocol number %d\n",
info->timeout, timeout->l3num);
goto err3;
goto err4;
}
if (timeout->l4proto->l4proto != e->ip.proto) {
ret = -EINVAL;
pr_info("Timeout policy `%s' can only be "
"used by L4 protocol number %d\n",
info->timeout,
timeout->l4proto->l4proto);
goto err3;
goto err4;
}
timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
GFP_KERNEL);
if (timeout_ext == NULL) {
ret = -ENOMEM;
goto err3;
goto err4;
}
} else {
ret = -ENOENT;
pr_info("Timeout policy base is empty\n");
goto err3;
goto err4;
}
rcu_read_unlock();
}
#endif

Expand All @@ -272,6 +274,8 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
info->ct = ct;
return 0;

err4:
rcu_read_unlock();
err3:
nf_conntrack_free(ct);
err2:
Expand Down Expand Up @@ -313,13 +317,15 @@ static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
nf_ct_l3proto_module_put(par->family);

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
rcu_read_lock();
timeout_put = rcu_dereference(nf_ct_timeout_put_hook);

if (timeout_put) {
timeout_ext = nf_ct_timeout_find(ct);
if (timeout_ext)
timeout_put(timeout_ext->timeout);
}
rcu_read_unlock();
#endif
}
nf_ct_put(info->ct);
Expand Down

0 comments on commit 1ac0bf9

Please sign in to comment.