mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-30 16:07:39 +00:00
Code Issues Releases Wiki Activity

netfilter: ipt_ULOG: fix incorrect setting of ulog timer

Browse source 
The parameter of setup_timer should be &ulog->nlgroup[i].
the incorrect parameter will cause kernel panic in
ulog_timer.

Bug introducted in commit 355430671a
"netfilter: ipt_ULOG: add net namespace support for ipt_ULOG"

ebt_ULOG doesn't have this problem.

[ I have mangled this patch to fix nlgroup != 0 case, we were
  also crashing there --pablo ]

Tested-by: George Spelvin <linux@horizon.com>
Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Gao feng 2013-06-24 17:04:02 +08:00 committed by Pablo Neira Ayuso
parent 797a7d66d2
commit c8fc51cfa7
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
net/ipv4/netfilter/ipt_ULOG.c
View file

@ -125,15 +125,16 @@ static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum)
/* timer function to flush queue in flushtimeout time */ /* timer function to flush queue in flushtimeout time */
static void ulog_timer(unsigned long data) static void ulog_timer(unsigned long data)
{ {
unsigned int groupnum = *((unsigned int *)data);
struct ulog_net *ulog = container_of((void *)data, struct ulog_net *ulog = container_of((void *)data,
struct ulog_net, struct ulog_net,
nlgroup[*(unsigned int *)data]); nlgroup[groupnum]);
pr_debug("timer function called, calling ulog_send\n"); pr_debug("timer function called, calling ulog_send\n");
/* lock to protect against somebody modifying our structure /* lock to protect against somebody modifying our structure
* from ipt_ulog_target at the same time */ * from ipt_ulog_target at the same time */
spin_lock_bh(&ulog->lock); spin_lock_bh(&ulog->lock);
ulog_send(ulog, data); ulog_send(ulog, groupnum);
spin_unlock_bh(&ulog->lock); spin_unlock_bh(&ulog->lock);
} }
@ -407,8 +408,11 @@ static int __net_init ulog_tg_net_init(struct net *net)
spin_lock_init(&ulog->lock); spin_lock_init(&ulog->lock);
/* initialize ulog_buffers */ /* initialize ulog_buffers */
for (i = 0; i < ULOG_MAXNLGROUPS; i++) for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i); ulog->nlgroup[i] = i;
setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,
(unsigned long)&ulog->nlgroup[i]);
}
ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg); ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
if (!ulog->nflognl) if (!ulog->nflognl)