Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd07df94 authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Greg Kroah-Hartman
Browse files

netfilter: xt_recent: Fix attempt to update deleted entry 

[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ]

When both --reap and --update flag are specified, there's a code
path at which the entry to be updated is reaped beforehand,
which then leads to kernel crash. Reap only entries which won't be
updated.

Fixes kernel bugzilla #207773.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773


Reported-by: default avatarReindl Harald <h.reindl@thelounge.net>
Fixes: 0079c5ae ("netfilter: xt_recent: add an entry reaper")
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 25315083

net/netfilter/xt_recent.c

+10 −2
Original line number Diff line number Diff line
@@ -155,7 +155,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e) 
/*

 * Drop entries with timestamps older then 'time'.

 */

static void recent_entry_reap(struct recent_table *t, unsigned long time)

static void recent_entry_reap(struct recent_table *t, unsigned long time,

			      struct recent_entry *working, bool update)

{

	struct recent_entry *e;
@@ -164,6 +165,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time) 
	 */

	e = list_entry(t->lru_list.next, struct recent_entry, lru_list);



	/*

	 * Do not reap the entry which are going to be updated.

	 */

	if (e == working && update)

		return;



	/*

	 * The last time stamp is the most recent.

	 */
@@ -306,7 +313,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par) 


		/* info->seconds must be non-zero */

		if (info->check_set & XT_RECENT_REAP)

			recent_entry_reap(t, time);

			recent_entry_reap(t, time, e,

				info->check_set & XT_RECENT_UPDATE && ret);

	}



	if (info->check_set & XT_RECENT_SET ||