p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

netfilter: make it safer during the inet6_dev->addr_list traversal 

inet6_dev->addr_list is protected by inet6_dev->lock, so only using
rcu_read_lock is not enough, we should acquire read_lock_bh(&idev->lock)
before the inet6_dev->addr_list traversal.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Liping Zhang 2017-04-02 17:27:53 +08:00 committed by Pablo Neira Ayuso
parent 3173d5b8c8
commit 0c7930e576
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/netfilter/nf_nat_redirect.c
View File

@ -101,11 +101,13 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
rcu_read_lock(); rcu_read_lock();
idev = __in6_dev_get(skb->dev); idev = __in6_dev_get(skb->dev);
if (idev != NULL) { if (idev != NULL) {
read_lock_bh(&idev->lock);
list_for_each_entry(ifa, &idev->addr_list, if_list) { list_for_each_entry(ifa, &idev->addr_list, if_list) {
newdst = ifa->addr; newdst = ifa->addr;
addr = true; addr = true;
break; break;
} }
read_unlock_bh(&idev->lock);
} }
rcu_read_unlock(); rcu_read_unlock();

5
net/netfilter/xt_TPROXY.c
View File

@ -393,7 +393,8 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
rcu_read_lock(); rcu_read_lock();
indev = __in6_dev_get(skb->dev); indev = __in6_dev_get(skb->dev);
if (indev) if (indev) {
read_lock_bh(&indev->lock);
list_for_each_entry(ifa, &indev->addr_list, if_list) { list_for_each_entry(ifa, &indev->addr_list, if_list) {
if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED)) if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
continue; continue;
@ -401,6 +402,8 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
laddr = &ifa->addr; laddr = &ifa->addr;
break; break;
} }
read_unlock_bh(&indev->lock);
}
rcu_read_unlock(); rcu_read_unlock();
return laddr ? laddr : daddr; return laddr ? laddr : daddr;