linux-kernel - Re: 4.12 nf_conntrack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <12e1fdf4-2936-d2a7-e537-1038fbf5b7a3@suse.cz>
Date:   Mon, 17 Jul 2017 16:54:43 +0200
From:   Jiri Slaby <jslaby@...e.cz>
To:     Pablo Neira Ayuso <pablo@...filter.org>, fgao@...ai8.com
Cc:     kadlec@...ckhole.kfki.hu, Florian Westphal <fw@...len.de>,
        netfilter-devel@...r.kernel.org, coreteam@...filter.org,
        Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: 4.12 nf_conntrack_expect crash

On 07/17/2017, 04:49 PM, Jiri Slaby wrote:
> Hi,
> 
> on my system, I see a crash in del_timer invoked in nf_conntrack_expect.
> See the attached picture.
> 
> I somehow suspect this commit:
> 
> commit ec0e3f01114ad327112432a4da8840eb22fed577
> Author: Gao Feng <fgao@...ai8.com>
> Date:   Mon Mar 27 10:31:26 2017 +0800
> 
>     netfilter: nf_ct_expect: Add nf_ct_remove_expect()
> 
> 
> I am going to play with it (debug, try to revert, etc.) if you have no
> better idea...

This?

--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(struct
nf_conntrack_expect *expect)
        h = nf_ct_expect_dst_hash(net, &expect->tuple);
        hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
                if (expect_matches(i, expect)) {
-                       if (nf_ct_remove_expect(expect))
+                       if (nf_ct_remove_expect(i))
                                break;
                } else if (expect_clash(i, expect)) {
                        ret = -EBUSY;



> 
> thanks,
> 


-- 
js
suse labs