diff options
| author |   Pekka Enberg <penberg@cs.helsinki.fi> | 2008-07-26 17:49:33 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2008-07-26 17:49:33 -0700 |
| commit | 93bc4e89c260d91576840c4881d1066d84ccd422 (patch) | |
| tree | 456176a054fc9a3fed18ac6ce50c7a34a86c5808 /net | |
| parent | netfilter: arptables in netns for real (diff) | |
| download | linux-dev-93bc4e89c260d91576840c4881d1066d84ccd422.tar.xz linux-dev-93bc4e89c260d91576840c4881d1066d84ccd422.zip | |
netfilter: fix double-free and use-after free
As suggested by Patrick McHardy, introduce a __krealloc() that doesn't
free the original buffer to fix a double-free and use-after-free bug
introduced by me in netfilter that uses RCU.
Reported-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Tested-by: Dieter Ries <clip2@gmx.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_conntrack_extend.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c index 3469bc71a385..c956ef7eeecb 100644 --- a/net/netfilter/nf_conntrack_extend.c +++ b/net/netfilter/nf_conntrack_extend.c @@ -95,7 +95,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp) newlen = newoff + t->len; rcu_read_unlock(); - new = krealloc(ct->ext, newlen, gfp); + new = __krealloc(ct->ext, newlen, gfp); if (!new) return NULL; |