From 4acdbdbe5089c06d5e0c7e96783fcc4414ded00a Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Thu, 21 Jul 2005 13:14:46 -0700 Subject: [NETFILTER]: ip_conntrack_expect_related must not free expectation If a connection tracking helper tells us to expect a connection, and we're already expecting that connection, we simply free the one they gave us and return success. The problem is that NAT helpers (eg. FTP) have to allocate the expectation first (to see what port is available) then rewrite the packet. If that rewrite fails, they try to remove the expectation, but it was freed in ip_conntrack_expect_related. This is one example of a larger problem: having registered the expectation, the pointer is no longer ours to use. Reference counting is needed for ctnetlink anyway, so introduce it now. To have a single "put" path, we need to grab the reference to the connection on creation, rather than open-coding it in the caller. Signed-off-by: Rusty Russell Signed-off-by: David S. Miller --- net/ipv4/netfilter/ip_conntrack_amanda.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'net/ipv4/netfilter/ip_conntrack_amanda.c') diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c index a78a320eee0..01e1b58322a 100644 --- a/net/ipv4/netfilter/ip_conntrack_amanda.c +++ b/net/ipv4/netfilter/ip_conntrack_amanda.c @@ -101,14 +101,13 @@ static int help(struct sk_buff **pskb, if (port == 0 || len > 5) break; - exp = ip_conntrack_expect_alloc(); + exp = ip_conntrack_expect_alloc(ct); if (exp == NULL) { ret = NF_DROP; goto out; } exp->expectfn = NULL; - exp->master = ct; exp->tuple.src.ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip; exp->tuple.src.u.tcp.port = 0; @@ -126,10 +125,9 @@ static int help(struct sk_buff **pskb, ret = ip_nat_amanda_hook(pskb, ctinfo, tmp - amanda_buffer, len, exp); - else if (ip_conntrack_expect_related(exp) != 0) { - ip_conntrack_expect_free(exp); + else if (ip_conntrack_expect_related(exp) != 0) ret = NF_DROP; - } + ip_conntrack_expect_put(exp); } out: -- cgit v1.2.3