Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9fa2ddc1 authored by Cong Wang's avatar Cong Wang Committed by Greg Kroah-Hartman
Browse files

net_sched: fix a NULL pointer deref in ipt action 



[ Upstream commit 981471bd3abf4d572097645d765391533aac327d ]

The net pointer in struct xt_tgdtor_param is not explicitly
initialized therefore is still NULL when dereferencing it.
So we have to find a way to pass the correct net pointer to
ipt_destroy_target().

The best way I find is just saving the net pointer inside the per
netns struct tcf_idrinfo, which could make this patch smaller.

Fixes: 0c66dc1e ("netfilter: conntrack: register hooks in netns when needed by ruleset")
Reported-and-tested-by: default avatar <itugrok@yahoo.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e5c0bd16

include/net/act_api.h

+3 −1
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
struct tcf_idrinfo {

	spinlock_t	lock;

	struct idr	action_idr;

	struct net	*net;

};



struct tc_action_ops;
@@ -104,7 +105,7 @@ struct tc_action_net { 
};



static inline

int tc_action_net_init(struct tc_action_net *tn,

int tc_action_net_init(struct net *net, struct tc_action_net *tn,

		       const struct tc_action_ops *ops)

{

	int err = 0;
@@ -113,6 +114,7 @@ int tc_action_net_init(struct tc_action_net *tn, 
	if (!tn->idrinfo)

		return -ENOMEM;

	tn->ops = ops;

	tn->idrinfo->net = net;

	spin_lock_init(&tn->idrinfo->lock);

	idr_init(&tn->idrinfo->action_idr);

	return err;

net/sched/act_bpf.c

+1 −1
Original line number Diff line number Diff line
@@ -402,7 +402,7 @@ static __net_init int bpf_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, bpf_net_id);



	return tc_action_net_init(tn, &act_bpf_ops);

	return tc_action_net_init(net, tn, &act_bpf_ops);

}



static void __net_exit bpf_exit_net(struct net *net)

net/sched/act_connmark.c

+1 −1
Original line number Diff line number Diff line
@@ -206,7 +206,7 @@ static __net_init int connmark_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, connmark_net_id);



	return tc_action_net_init(tn, &act_connmark_ops);

	return tc_action_net_init(net, tn, &act_connmark_ops);

}



static void __net_exit connmark_exit_net(struct net *net)

net/sched/act_csum.c

+1 −1
Original line number Diff line number Diff line
@@ -632,7 +632,7 @@ static __net_init int csum_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, csum_net_id);



	return tc_action_net_init(tn, &act_csum_ops);

	return tc_action_net_init(net, tn, &act_csum_ops);

}



static void __net_exit csum_exit_net(struct net *net)

net/sched/act_gact.c

+1 −1
Original line number Diff line number Diff line
@@ -232,7 +232,7 @@ static __net_init int gact_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, gact_net_id);



	return tc_action_net_init(tn, &act_gact_ops);

	return tc_action_net_init(net, tn, &act_gact_ops);

}



static void __net_exit gact_exit_net(struct net *net)