mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 23:58:05 +00:00
netfilter: xt_recent: Fix attempt to update deleted entry
[ Upstream commitb1bdde33b7
] When both --reap and --update flag are specified, there's a code path at which the entry to be updated is reaped beforehand, which then leads to kernel crash. Reap only entries which won't be updated. Fixes kernel bugzilla #207773. Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773 Reported-by: Reindl Harald <h.reindl@thelounge.net> Fixes:0079c5aee3
("netfilter: xt_recent: add an entry reaper") Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
7661073517
commit
c7559fe4df
1 changed files with 10 additions and 2 deletions
|
@ -155,7 +155,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
|
|||
/*
|
||||
* Drop entries with timestamps older then 'time'.
|
||||
*/
|
||||
static void recent_entry_reap(struct recent_table *t, unsigned long time)
|
||||
static void recent_entry_reap(struct recent_table *t, unsigned long time,
|
||||
struct recent_entry *working, bool update)
|
||||
{
|
||||
struct recent_entry *e;
|
||||
|
||||
|
@ -164,6 +165,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
|
|||
*/
|
||||
e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
|
||||
|
||||
/*
|
||||
* Do not reap the entry which are going to be updated.
|
||||
*/
|
||||
if (e == working && update)
|
||||
return;
|
||||
|
||||
/*
|
||||
* The last time stamp is the most recent.
|
||||
*/
|
||||
|
@ -306,7 +313,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
|||
|
||||
/* info->seconds must be non-zero */
|
||||
if (info->check_set & XT_RECENT_REAP)
|
||||
recent_entry_reap(t, time);
|
||||
recent_entry_reap(t, time, e,
|
||||
info->check_set & XT_RECENT_UPDATE && ret);
|
||||
}
|
||||
|
||||
if (info->check_set & XT_RECENT_SET ||
|
||||
|
|
Loading…
Reference in a new issue