aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2008-06-17 18:52:32 -0400
committerDavid S. Miller <davem@davemloft.net>2008-06-17 18:52:32 -0400
commita56b8f81580761c65e4d8d0c04ac1cb7a788bdf1 (patch)
tree4757959413d9988ddf1cad9c9e28aead5f222276
parent8a548868db62422113104ebc658065e3fe976951 (diff)
netfilter: nf_conntrack_h323: fix module unload crash
The H.245 helper is not registered/unregistered, but assigned to connections manually from the Q.931 helper. This means on unload existing expectations and connections using the helper are not cleaned up, leading to the following oops on module unload: CPU 0 Unable to handle kernel paging request at virtual address c00a6828, epc == 802224dc, ra == 801d4e7c Oops[#1]: Cpu 0 $ 0 : 00000000 00000000 00000004 c00a67f0 $ 4 : 802a5ad0 81657e00 00000000 00000000 $ 8 : 00000008 801461c8 00000000 80570050 $12 : 819b0280 819b04b0 00000006 00000000 $16 : 802a5a60 80000000 80b46000 80321010 $20 : 00000000 00000004 802a5ad0 00000001 $24 : 00000000 802257a8 $28 : 802a4000 802a59e8 00000004 801d4e7c Hi : 0000000b Lo : 00506320 epc : 802224dc ip_conntrack_help+0x38/0x74 Tainted: P ra : 801d4e7c nf_iterate+0xbc/0x130 Status: 1000f403 KERNEL EXL IE Cause : 00800008 BadVA : c00a6828 PrId : 00019374 Modules linked in: ip_nat_pptp ip_conntrack_pptp ath_pktlog wlan_acl wlan_wep wlan_tkip wlan_ccmp wlan_xauth ath_pci ath_dev ath_dfs ath_rate_atheros wlan ath_hal ip_nat_tftp ip_conntrack_tftp ip_nat_ftp ip_conntrack_ftp pppoe ppp_async ppp_deflate ppp_mppe pppox ppp_generic slhc Process swapper (pid: 0, threadinfo=802a4000, task=802a6000) Stack : 801e7d98 00000004 802a5a60 80000000 801d4e7c 801d4e7c 802a5ad0 00000004 00000000 00000000 801e7d98 00000000 00000004 802a5ad0 00000000 00000010 801e7d98 80b46000 802a5a60 80320000 80000000 801d4f8c 802a5b00 00000002 80063834 00000000 80b46000 802a5a60 801e7d98 80000000 802ba854 00000000 81a02180 80b7e260 81a021b0 819b0000 819b0000 80570056 00000000 00000001 ... Call Trace: [<801e7d98>] ip_finish_output+0x0/0x23c [<801d4e7c>] nf_iterate+0xbc/0x130 [<801d4e7c>] nf_iterate+0xbc/0x130 [<801e7d98>] ip_finish_output+0x0/0x23c [<801e7d98>] ip_finish_output+0x0/0x23c [<801d4f8c>] nf_hook_slow+0x9c/0x1a4 One way to fix this would be to split helper cleanup from the unregistration function and invoke it for the H.245 helper, but since ctnetlink needs to be able to find the helper for synchonization purposes, a better fix is to register it normally and make sure its not assigned to connections during helper lookup. The missing l3num initialization is enough for this, this patch changes it to use AF_UNSPEC to make it more explicit though. Reported-by: liannan <liannan@twsz.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/netfilter/nf_conntrack_h323_main.c21
1 files changed, 14 insertions, 7 deletions
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 99e385d5b707..2f83c158934d 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -619,6 +619,7 @@ static const struct nf_conntrack_expect_policy h245_exp_policy = {
619static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = { 619static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
620 .name = "H.245", 620 .name = "H.245",
621 .me = THIS_MODULE, 621 .me = THIS_MODULE,
622 .tuple.src.l3num = AF_UNSPEC,
622 .tuple.dst.protonum = IPPROTO_UDP, 623 .tuple.dst.protonum = IPPROTO_UDP,
623 .help = h245_help, 624 .help = h245_help,
624 .expect_policy = &h245_exp_policy, 625 .expect_policy = &h245_exp_policy,
@@ -1765,6 +1766,7 @@ static void __exit nf_conntrack_h323_fini(void)
1765 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]); 1766 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
1766 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]); 1767 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
1767 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]); 1768 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
1769 nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
1768 kfree(h323_buffer); 1770 kfree(h323_buffer);
1769 pr_debug("nf_ct_h323: fini\n"); 1771 pr_debug("nf_ct_h323: fini\n");
1770} 1772}
@@ -1777,27 +1779,32 @@ static int __init nf_conntrack_h323_init(void)
1777 h323_buffer = kmalloc(65536, GFP_KERNEL); 1779 h323_buffer = kmalloc(65536, GFP_KERNEL);
1778 if (!h323_buffer) 1780 if (!h323_buffer)
1779 return -ENOMEM; 1781 return -ENOMEM;
1780 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]); 1782 ret = nf_conntrack_helper_register(&nf_conntrack_helper_h245);
1781 if (ret < 0) 1783 if (ret < 0)
1782 goto err1; 1784 goto err1;
1783 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]); 1785 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
1784 if (ret < 0) 1786 if (ret < 0)
1785 goto err2; 1787 goto err2;
1786 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]); 1788 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
1787 if (ret < 0) 1789 if (ret < 0)
1788 goto err3; 1790 goto err3;
1789 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]); 1791 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
1790 if (ret < 0) 1792 if (ret < 0)
1791 goto err4; 1793 goto err4;
1794 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
1795 if (ret < 0)
1796 goto err5;
1792 pr_debug("nf_ct_h323: init success\n"); 1797 pr_debug("nf_ct_h323: init success\n");
1793 return 0; 1798 return 0;
1794 1799
1795err4: 1800err5:
1796 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]); 1801 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
1797err3: 1802err4:
1798 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]); 1803 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
1799err2: 1804err3:
1800 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]); 1805 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
1806err2:
1807 nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
1801err1: 1808err1:
1802 kfree(h323_buffer); 1809 kfree(h323_buffer);
1803 return ret; 1810 return ret;