diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-03 13:53:22 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-11 01:31:10 +0200 |
| commit | 99e25d071fca91eb90ffa2f51240547a69137bde (patch) | |
| tree | 0715c30db8197db3471ab7fc85ffc36cc76baf3d /net/netfilter/nfnetlink_cttimeout.c | |
| parent | netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT (diff) | |
| download | linux-dev-99e25d071fca91eb90ffa2f51240547a69137bde.tar.xz linux-dev-99e25d071fca91eb90ffa2f51240547a69137bde.zip | |
netfilter: cttimeout: ctnl_timeout_find_get() returns incorrect pointer to type
Compiler did not catch incorrect typing in the rcu hook assignment.
% nfct add timeout test-tcp inet tcp established 100 close 10 close_wait 10
% iptables -I OUTPUT -t raw -p tcp -j CT --timeout test-tcp
dmesg - xt_CT: Timeout policy `test-tcp' can only be used by L3 protocol number 25000
The CT target bails out with incorrect layer 3 protocol number.
Fixes: 6c1fd7dc489d ("netfilter: cttimeout: decouple timeout policy from nfnetlink_cttimeout object")
Reported-by: Harsha Sharma <harshasharmaiitr@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nfnetlink_cttimeout.c')
| -rw-r--r-- | net/netfilter/nfnetlink_cttimeout.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c index d46a236cdf31..a30f8ba4b89a 100644 --- a/net/netfilter/nfnetlink_cttimeout.c +++ b/net/netfilter/nfnetlink_cttimeout.c @@ -489,8 +489,8 @@ err: return err; } -static struct ctnl_timeout * -ctnl_timeout_find_get(struct net *net, const char *name) +static struct nf_ct_timeout *ctnl_timeout_find_get(struct net *net, + const char *name) { struct ctnl_timeout *timeout, *matching = NULL; @@ -509,7 +509,7 @@ ctnl_timeout_find_get(struct net *net, const char *name) break; } err: - return matching; + return matching ? &matching->timeout : NULL; } static void ctnl_timeout_put(struct nf_ct_timeout *t) |