netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions
When memory is exhausted, nfct_seqadj_ext_add may fail to add the synproxy and seqadj extensions. The function nf_ct_seqadj_init doesn't check if get valid seqadj pointer by the nfct_seqadj. Now drop the packet directly when fail to add seqadj extension to avoid dereference NULL pointer in nf_ct_seqadj_init from init_conntrack(). Signed-off-by: Gao Feng <fgao@ikuai8.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
ecfcdfec7e
commit
4440a2ab3b
|
@ -27,6 +27,20 @@ static inline struct nf_conn_synproxy *nfct_synproxy_ext_add(struct nf_conn *ct)
|
|||
#endif
|
||||
}
|
||||
|
||||
static inline bool nf_ct_add_synproxy(struct nf_conn *ct,
|
||||
const struct nf_conn *tmpl)
|
||||
{
|
||||
if (tmpl && nfct_synproxy(tmpl)) {
|
||||
if (!nfct_seqadj_ext_add(ct))
|
||||
return false;
|
||||
|
||||
if (!nfct_synproxy_ext_add(ct))
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
struct synproxy_stats {
|
||||
unsigned int syn_received;
|
||||
unsigned int cookie_invalid;
|
||||
|
|
|
@ -1035,9 +1035,9 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
|
|||
if (IS_ERR(ct))
|
||||
return (struct nf_conntrack_tuple_hash *)ct;
|
||||
|
||||
if (tmpl && nfct_synproxy(tmpl)) {
|
||||
nfct_seqadj_ext_add(ct);
|
||||
nfct_synproxy_ext_add(ct);
|
||||
if (!nf_ct_add_synproxy(ct, tmpl)) {
|
||||
nf_conntrack_free(ct);
|
||||
return ERR_PTR(-ENOMEM);
|
||||
}
|
||||
|
||||
timeout_ext = tmpl ? nf_ct_timeout_find(tmpl) : NULL;
|
||||
|
|
|
@ -441,7 +441,8 @@ nf_nat_setup_info(struct nf_conn *ct,
|
|||
ct->status |= IPS_DST_NAT;
|
||||
|
||||
if (nfct_help(ct))
|
||||
nfct_seqadj_ext_add(ct);
|
||||
if (!nfct_seqadj_ext_add(ct))
|
||||
return NF_DROP;
|
||||
}
|
||||
|
||||
if (maniptype == NF_NAT_MANIP_SRC) {
|
||||
|
|
Loading…
Reference in a new issue