Skip to content

Commit

Permalink
netfilter: make it safer during the inet6_dev->addr_list traversal
Browse files Browse the repository at this point in the history
inet6_dev->addr_list is protected by inet6_dev->lock, so only using
rcu_read_lock is not enough, we should acquire read_lock_bh(&idev->lock)
before the inet6_dev->addr_list traversal.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Liping Zhang authored and Pablo Neira Ayuso committed Apr 8, 2017
1 parent 3173d5b commit 0c7930e
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 1 deletion.
2 changes: 2 additions & 0 deletions net/netfilter/nf_nat_redirect.c
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,13 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
rcu_read_lock();
idev = __in6_dev_get(skb->dev);
if (idev != NULL) {
read_lock_bh(&idev->lock);
list_for_each_entry(ifa, &idev->addr_list, if_list) {
newdst = ifa->addr;
addr = true;
break;
}
read_unlock_bh(&idev->lock);
}
rcu_read_unlock();

Expand Down
5 changes: 4 additions & 1 deletion net/netfilter/xt_TPROXY.c
Original file line number Diff line number Diff line change
Expand Up @@ -393,14 +393,17 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,

rcu_read_lock();
indev = __in6_dev_get(skb->dev);
if (indev)
if (indev) {
read_lock_bh(&indev->lock);
list_for_each_entry(ifa, &indev->addr_list, if_list) {
if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
continue;

laddr = &ifa->addr;
break;
}
read_unlock_bh(&indev->lock);
}
rcu_read_unlock();

return laddr ? laddr : daddr;
Expand Down

0 comments on commit 0c7930e

Please sign in to comment.