Commit:     1f305323ff5b9ddc1a4346d36072bcdb58f3f68a
Parent:     0a06ea87185531705e4417e3a051f81b64f210c1
Author:     Evgeniy Polyakov <[EMAIL PROTECTED]>
AuthorDate: Tue Nov 20 04:27:35 2007 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Nov 20 04:27:35 2007 -0800

    [NETFILTER]: Fix kernel panic with REDIRECT target.
    When connection tracking entry (nf_conn) is about to copy itself it can
    have some of its extension users (like nat) as being already freed and
    thus not required to be copied.
    Actually looking at this function I suspect it was copied from
    nf_nat_setup_info() and thus bug was introduced.
    Report and testing from David <[EMAIL PROTECTED]>.
    [ Patrick McHardy states:
        I now understand whats happening:
        - new connection is allocated without helper
        - connection is REDIRECTed to localhost
        - nf_nat_setup_info adds NAT extension, but doesn't initialize it yet
        - nf_conntrack_alter_reply performs a helper lookup based on the
           new tuple, finds the SIP helper and allocates a helper extension,
           causing reallocation because of too little space
        - nf_nat_move_storage is called with the uninitialized nat extension
        So your fix is entirely correct, thanks a lot :)  ]
    Signed-off-by: Evgeniy Polyakov <[EMAIL PROTECTED]>
    Acked-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/ipv4/netfilter/nf_nat_core.c |    5 +----
 1 files changed, 1 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 70e7997..86b465b 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -607,13 +607,10 @@ static void nf_nat_move_storage(struct nf_conn 
*conntrack, void *old)
        struct nf_conn_nat *new_nat = nf_ct_ext_find(conntrack, NF_CT_EXT_NAT);
        struct nf_conn_nat *old_nat = (struct nf_conn_nat *)old;
        struct nf_conn *ct = old_nat->ct;
-       unsigned int srchash;
-       if (!(ct->status & IPS_NAT_DONE_MASK))
+       if (!ct || !(ct->status & IPS_NAT_DONE_MASK))
-       srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
        hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
        new_nat->ct = ct;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to