Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8fc51cf authored by Gao feng's avatar Gao feng Committed by Pablo Neira Ayuso
Browse files

netfilter: ipt_ULOG: fix incorrect setting of ulog timer 



The parameter of setup_timer should be &ulog->nlgroup[i].
the incorrect parameter will cause kernel panic in
ulog_timer.

Bug introducted in commit 35543067
"netfilter: ipt_ULOG: add net namespace support for ipt_ULOG"

ebt_ULOG doesn't have this problem.

[ I have mangled this patch to fix nlgroup != 0 case, we were
  also crashing there --pablo ]

Tested-by: default avatarGeorge Spelvin <linux@horizon.com>
Reported-by: default avatarBorislav Petkov <bp@alien8.de>
Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 797a7d66

net/ipv4/netfilter/ipt_ULOG.c

+8 −4
Original line number Diff line number Diff line
@@ -125,15 +125,16 @@ static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum) 
/* timer function to flush queue in flushtimeout time */

static void ulog_timer(unsigned long data)

{

	unsigned int groupnum = *((unsigned int *)data);

	struct ulog_net *ulog = container_of((void *)data,

					     struct ulog_net,

					     nlgroup[*(unsigned int *)data]);

					     nlgroup[groupnum]);

	pr_debug("timer function called, calling ulog_send\n");



	/* lock to protect against somebody modifying our structure

	 * from ipt_ulog_target at the same time */

	spin_lock_bh(&ulog->lock);

	ulog_send(ulog, data);

	ulog_send(ulog, groupnum);

	spin_unlock_bh(&ulog->lock);

}
@@ -407,8 +408,11 @@ static int __net_init ulog_tg_net_init(struct net *net) 


	spin_lock_init(&ulog->lock);

	/* initialize ulog_buffers */

	for (i = 0; i < ULOG_MAXNLGROUPS; i++)

		setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i);

	for (i = 0; i < ULOG_MAXNLGROUPS; i++) {

		ulog->nlgroup[i] = i;

		setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,

			    (unsigned long)&ulog->nlgroup[i]);

	}



	ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);

	if (!ulog->nflognl)