diff mbox

netfilter: Fix potential crash in nft_hash walker

Message ID 20150312235214.GA26546@gondor.apana.org.au
State Awaiting Upstream, archived
Delegated to: David Miller
Headers show

Commit Message

Herbert Xu March 12, 2015, 11:52 p.m. UTC
When we get back an EAGAIN from rhashtable_walk_next we were
treating it as a valid object which obviously doesn't work too
well.
    
Luckily this is hard to trigger so it seems nobody has run into
it yet.
    
This patch fixes it by redoing the next call when we get an EAGAIN.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Comments

David Miller March 13, 2015, 3:05 a.m. UTC | #1
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 13 Mar 2015 10:52:14 +1100

> When we get back an EAGAIN from rhashtable_walk_next we were
> treating it as a valid object which obviously doesn't work too
> well.
>     
> Luckily this is hard to trigger so it seems nobody has run into
> it yet.
>     
> This patch fixes it by redoing the next call when we get an EAGAIN.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Pablo, you got this one?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso March 13, 2015, 10:50 a.m. UTC | #2
On Fri, Mar 13, 2015 at 10:52:14AM +1100, Herbert Xu wrote:
> When we get back an EAGAIN from rhashtable_walk_next we were
> treating it as a valid object which obviously doesn't work too
> well.
>     
> Luckily this is hard to trigger so it seems nobody has run into
> it yet.
>     
> This patch fixes it by redoing the next call when we get an EAGAIN.

I'll enqueue this for nf, thanks Herbert.

> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> 
> diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
> index c82df0a..37c15e6 100644
> --- a/net/netfilter/nft_hash.c
> +++ b/net/netfilter/nft_hash.c
> @@ -153,6 +153,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
>  				iter->err = err;
>  				goto out;
>  			}
> +
> +			continue;
>  		}
>  
>  		if (iter->count < iter->skip)
> -- 
> Email: Herbert Xu <herbert@gondor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c82df0a..37c15e6 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -153,6 +153,8 @@  static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
 				iter->err = err;
 				goto out;
 			}
+
+			continue;
 		}
 
 		if (iter->count < iter->skip)