summaryrefslogtreecommitdiffstats
path: root/MAINTAINERS
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2014-06-07 21:17:04 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-06-16 13:58:54 +0200
commit945b2b2d259d1a4364a2799e80e8ff32f8c6ee6f (patch)
tree343f4cc22a553038874f55deb3ee3eb578f3abb5 /MAINTAINERS
parentnetfilter: ctnetlink: add zone size to length (diff)
downloadlinux-945b2b2d259d1a4364a2799e80e8ff32f8c6ee6f.tar.xz
linux-945b2b2d259d1a4364a2799e80e8ff32f8c6ee6f.zip
netfilter: nf_nat: fix oops on netns removal
Quoting Samu Kallio: Basically what's happening is, during netns cleanup, nf_nat_net_exit gets called before ipv4_net_exit. As I understand it, nf_nat_net_exit is supposed to kill any conntrack entries which have NAT context (through nf_ct_iterate_cleanup), but for some reason this doesn't happen (perhaps something else is still holding refs to those entries?). When ipv4_net_exit is called, conntrack entries (including those with NAT context) are cleaned up, but the nat_bysource hashtable is long gone - freed in nf_nat_net_exit. The bug happens when attempting to free a conntrack entry whose NAT hash 'prev' field points to a slot in the freed hash table (head for that bin). We ignore conntracks with null nat bindings. But this is wrong, as these are in bysource hash table as well. Restore nat-cleaning for the netns-is-being-removed case. bug: https://bugzilla.kernel.org/show_bug.cgi?id=65191 Fixes: c2d421e1718 ('netfilter: nf_nat: fix race when unloading protocol modules') Reported-by: Samu Kallio <samu.kallio@aberdeencloud.com> Debugged-by: Samu Kallio <samu.kallio@aberdeencloud.com> Signed-off-by: Florian Westphal <fw@strlen.de> Tested-by: Samu Kallio <samu.kallio@aberdeencloud.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'MAINTAINERS')
0 files changed, 0 insertions, 0 deletions