Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64f3967c authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: acquire ct->lock before operating nf_ct_seqadj 



We should acquire the ct->lock before accessing or modifying the
nf_ct_seqadj, as another CPU may modify the nf_ct_seqadj at the same
time during its packet proccessing.

Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 53b56da8

net/netfilter/nf_conntrack_netlink.c

+15 −6
Original line number Diff line number Diff line
@@ -417,8 +417,7 @@ dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type) 
	return -1;

}



static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb,

				     const struct nf_conn *ct)

static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, struct nf_conn *ct)

{

	struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);

	struct nf_ct_seqadj *seq;
@@ -426,15 +425,20 @@ static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, 
	if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)

		return 0;



	spin_lock_bh(&ct->lock);

	seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];

	if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)

		return -1;

		goto err;



	seq = &seqadj->seq[IP_CT_DIR_REPLY];

	if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)

		return -1;

		goto err;



	spin_unlock_bh(&ct->lock);

	return 0;

err:

	spin_unlock_bh(&ct->lock);

	return -1;

}



static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
@@ -1637,11 +1641,12 @@ ctnetlink_change_seq_adj(struct nf_conn *ct, 
	if (!seqadj)

		return 0;



	spin_lock_bh(&ct->lock);

	if (cda[CTA_SEQ_ADJ_ORIG]) {

		ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL],

				     cda[CTA_SEQ_ADJ_ORIG]);

		if (ret < 0)

			return ret;

			goto err;



		set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);

	}
@@ -1650,12 +1655,16 @@ ctnetlink_change_seq_adj(struct nf_conn *ct, 
		ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY],

				     cda[CTA_SEQ_ADJ_REPLY]);

		if (ret < 0)

			return ret;

			goto err;



		set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);

	}



	spin_unlock_bh(&ct->lock);

	return 0;

err:

	spin_unlock_bh(&ct->lock);

	return ret;

}



static int