summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGao feng <gaofeng@cn.fujitsu.com>2013-06-24 17:04:02 +0800
committerPablo Neira Ayuso <pablo@netfilter.org>2013-06-24 17:10:44 +0200
commitc8fc51cfa758be945c6113a4b446e0159070f768 (patch)
tree7fe9bb354958c4453a7fa03dcbe5ffe9b4696594
parent797a7d66d2048fe8a4ac1ba58c5d4752d64b1ac4 (diff)
downloadlinux-3.10-c8fc51cfa758be945c6113a4b446e0159070f768.tar.gz
linux-3.10-c8fc51cfa758be945c6113a4b446e0159070f768.tar.bz2
linux-3.10-c8fc51cfa758be945c6113a4b446e0159070f768.zip
netfilter: ipt_ULOG: fix incorrect setting of ulog timer
The parameter of setup_timer should be &ulog->nlgroup[i]. the incorrect parameter will cause kernel panic in ulog_timer. Bug introducted in commit 355430671ad93546b34b4e91bdf720f3a704efa4 "netfilter: ipt_ULOG: add net namespace support for ipt_ULOG" ebt_ULOG doesn't have this problem. [ I have mangled this patch to fix nlgroup != 0 case, we were also crashing there --pablo ] Tested-by: George Spelvin <linux@horizon.com> Reported-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--net/ipv4/netfilter/ipt_ULOG.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index ff4b781b105..32b0e978c8e 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -125,15 +125,16 @@ static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum)
/* timer function to flush queue in flushtimeout time */
static void ulog_timer(unsigned long data)
{
+ unsigned int groupnum = *((unsigned int *)data);
struct ulog_net *ulog = container_of((void *)data,
struct ulog_net,
- nlgroup[*(unsigned int *)data]);
+ nlgroup[groupnum]);
pr_debug("timer function called, calling ulog_send\n");
/* lock to protect against somebody modifying our structure
* from ipt_ulog_target at the same time */
spin_lock_bh(&ulog->lock);
- ulog_send(ulog, data);
+ ulog_send(ulog, groupnum);
spin_unlock_bh(&ulog->lock);
}
@@ -407,8 +408,11 @@ static int __net_init ulog_tg_net_init(struct net *net)
spin_lock_init(&ulog->lock);
/* initialize ulog_buffers */
- for (i = 0; i < ULOG_MAXNLGROUPS; i++)
- setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i);
+ for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
+ ulog->nlgroup[i] = i;
+ setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,
+ (unsigned long)&ulog->nlgroup[i]);
+ }
ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
if (!ulog->nflognl)