netfilter: ctnetlink: fix NULL dereference while trying to change helper
The patch 1afc56794e03: "netfilter: nf_ct_helper: implement variable length helper private data" from Jun 7, 2012, leads to the following Smatch complaint: net/netfilter/nf_conntrack_netlink.c:1231 ctnetlink_change_helper() error: we previously assumed 'help->helper' could be null (see line 1228) This NULL dereference can be triggered with the following sequence: 1) attach the helper for first time when the conntrack is created. 2) remove the helper module or detach the helper from the conntrack via ctnetlink. 3) attach helper again (the same or different one, no matter) to the that existing conntrack again via ctnetlink. This patch fixes the problem by removing the use case that allows you to re-assign again a helper for one conntrack entry via ctnetlink since I cannot find any practical use for it. Change-Id: I67a0a67f6a21f76f869f2f35d3d20225a78dc76e Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
parent
09be4f7a7a
commit
ab2638119f
|
@ -1213,19 +1213,12 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
|
|||
if (helper->from_nlattr && helpinfo)
|
||||
helper->from_nlattr(helpinfo, ct);
|
||||
return 0;
|
||||
}
|
||||
if (help->helper)
|
||||
} else
|
||||
return -EBUSY;
|
||||
/* need to zero data of old helper */
|
||||
memset(help->data, 0, help->helper->data_len);
|
||||
} else {
|
||||
/* we cannot set a helper for an existing conntrack */
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
rcu_assign_pointer(help->helper, helper);
|
||||
|
||||
return 0;
|
||||
/* we cannot set a helper for an existing conntrack */
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
static inline int
|
||||
|
|
Loading…
Reference in New Issue