Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88ed01d1 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_conntrack: fix ct refcount leak in l4proto->error() 



This patch fixes a refcount leak of ct objects that may occur if
l4proto->error() assigns one conntrack object to one skbuff. In
that case, we have to skip further processing in nf_conntrack_in().

With this patch, we can also fix wrong return values (-NF_ACCEPT)
for special cases in ICMP[v6] that should not bump the invalid/error
statistic counters.

Reported-by: default avatarZoltan Menyhart <Zoltan.Menyhart@bull.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d9be76f3

net/ipv4/netfilter/nf_conntrack_proto_icmp.c

+1 −1
Original line number Diff line number Diff line
@@ -160,7 +160,7 @@ icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, 
	/* Update skb to refer to this connection */

	skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;

	skb->nfctinfo = *ctinfo;

	return -NF_ACCEPT;

	return NF_ACCEPT;

}



/* Small and modified version of icmp_rcv */

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c

+1 −1
Original line number Diff line number Diff line
@@ -177,7 +177,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl, 
	/* Update skb to refer to this connection */

	skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;

	skb->nfctinfo = *ctinfo;

	return -NF_ACCEPT;

	return NF_ACCEPT;

}



static int

net/netfilter/nf_conntrack_core.c

+3 −0
Original line number Diff line number Diff line
@@ -922,6 +922,9 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum, 
			ret = -ret;

			goto out;

		}

		/* ICMP[v6] protocol trackers may assign one conntrack. */

		if (skb->nfct)

			goto out;

	}



	ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,