openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge branch 'master' of git://1984.lsi.us.es/nf-next 

Pablo Neira Ayuso says:

====================
The following patchset contains four Netfilter updates, mostly targeting
to fix issues added with IPv6 NAT, and one little IPVS update for net-next:

* Remove unneeded conditional free of skb in nfnetlink_queue, from
  Wei Yongjun.

* One semantic path from coccinelle detected the use of list_del +
  INIT_LIST_HEAD, instead of list_del_init, again from Wei Yongjun.

* Fix out-of-bound memory access in the NAT address selection, from
  Florian Westphal. This was introduced with the IPv6 NAT patches.

* Two fixes for crashes that were introduced in the recently merged
  IPv6 NAT support, from myself.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2012-09-13 14:24:31 -04:00
parent 280050cc81 c7cbb9173d
commit b0e61d98c6
5 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/netfilter/Makefile
View File

@ -47,7 +47,6 @@ nf_nat-y := nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \
nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o
obj-$(CONFIG_NF_NAT) += nf_nat.o obj-$(CONFIG_NF_NAT) += nf_nat.o
obj-$(CONFIG_NF_NAT) += xt_nat.o
# NAT protocols (nf_nat) # NAT protocols (nf_nat)
obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
@ -71,6 +70,7 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o
obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o
obj-$(CONFIG_NETFILTER_XT_SET) += xt_set.o obj-$(CONFIG_NETFILTER_XT_SET) += xt_set.o
obj-$(CONFIG_NF_NAT) += xt_nat.o
# targets # targets
obj-$(CONFIG_NETFILTER_XT_TARGET_AUDIT) += xt_AUDIT.o obj-$(CONFIG_NETFILTER_XT_TARGET_AUDIT) += xt_AUDIT.o

3
net/netfilter/ipvs/ip_vs_ctl.c
View File

@ -539,8 +539,7 @@ static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
* Remove it from the rs_table table. * Remove it from the rs_table table.
*/ */
if (!list_empty(&dest->d_list)) { if (!list_empty(&dest->d_list)) {
list_del(&dest->d_list); list_del_init(&dest->d_list);
INIT_LIST_HEAD(&dest->d_list);
} }
return 1; return 1;

3
net/netfilter/nf_conntrack_netlink.c
View File

@ -1120,16 +1120,13 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
if (err == -EAGAIN) { if (err == -EAGAIN) {
#ifdef CONFIG_MODULES #ifdef CONFIG_MODULES
rcu_read_unlock(); rcu_read_unlock();
spin_unlock_bh(&nf_conntrack_lock);
nfnl_unlock(); nfnl_unlock();
if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) { if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {
nfnl_lock(); nfnl_lock();
spin_lock_bh(&nf_conntrack_lock);
rcu_read_lock(); rcu_read_lock();
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
nfnl_lock(); nfnl_lock();
spin_lock_bh(&nf_conntrack_lock);
rcu_read_lock(); rcu_read_lock();
#else #else
err = -EOPNOTSUPP; err = -EOPNOTSUPP;

2
net/netfilter/nf_nat_core.c
View File

@ -255,7 +255,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
* client coming from the same IP (some Internet Banking sites * client coming from the same IP (some Internet Banking sites
* like this), even across reboots. * like this), even across reboots.
*/ */
j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3), j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3) / sizeof(u32),
range->flags & NF_NAT_RANGE_PERSISTENT ? range->flags & NF_NAT_RANGE_PERSISTENT ?
0 : (__force u32)tuple->dst.u3.all[max] ^ zone); 0 : (__force u32)tuple->dst.u3.all[max] ^ zone);

3
net/netfilter/nfnetlink_queue_core.c
View File

@ -406,8 +406,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
return skb; return skb;
nla_put_failure: nla_put_failure:
if (skb) kfree_skb(skb);
kfree_skb(skb);
net_err_ratelimited("nf_queue: error creating packet message\n"); net_err_ratelimited("nf_queue: error creating packet message\n");
return NULL; return NULL;
} }