linux-kernel - Re: OOPS in nf_ct_unlink_expect_report using Polycom RealPresence Mobile

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACVxJT-wtpbDuEsOpW32tck_wHKSuFkKmhHdhVvVNqFoEkdAbA@mail.gmail.com>
Date:	Fri, 31 Jan 2014 16:29:58 +0300
From:	Alexey Dobriyan <adobriyan@...il.com>
To:	astx@...-it.at
Cc:	Linux Kernel <linux-kernel@...r.kernel.org>,
	netfilter-devel <netfilter-devel@...r.kernel.org>
Subject: Re: OOPS in nf_ct_unlink_expect_report using Polycom RealPresence Mobile

> Disabling nf_nat_h323 and nf_conntrack_h323 avoids crash -
> but video conferencing software is no more usable.
>
> BUG: unable to handle kernel paging request at 00100104
> IP: [<f8214f07>] nf_ct_unlink_expect_report

This must be the same bug fixed in SIP module:
commit 3f509c689a07a4aa989b426893d8491a7ffcc410
netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation

Try attached patch (if this is mangled):

--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -229,7 +229,10 @@ static int nat_rtp_rtcp(struct sk_buff *skb,
struct nf_conn *ct,
  ret = nf_ct_expect_related(rtcp_exp);
  if (ret == 0)
  break;
- else if (ret != -EBUSY) {
+ else if (ret == -EBUSY) {
+ nf_ct_unexpect_related(rtp_exp);
+ continue;
+ } else if (ret < 0) {
  nf_ct_unexpect_related(rtp_exp);
  nated_port = 0;
  break;

View attachment "h323-expect.diff" of type "text/plain" (446 bytes)