diff options
author | Patrick McHardy <kaber@trash.net> | 2013-07-28 16:54:09 -0400 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-07-31 13:54:24 -0400 |
commit | 0658cdc8f3babb4a441f5a803a0b644fafcbf9ef (patch) | |
tree | 0f1b27ef787814b8f9124c72ecd658876de1580e /net | |
parent | 02982c27ba1e1bd9f9d4747214e19ca83aa88d0e (diff) |
netfilter: nf_nat: fix locking in nf_nat_seq_adjust()
nf_nat_seq_adjust() needs to grab nf_nat_seqofs_lock to protect against
concurrent changes to the sequence adjustment data.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r-- | net/netfilter/nf_nat_helper.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c index 85e20a919081..a7262ed055c6 100644 --- a/net/netfilter/nf_nat_helper.c +++ b/net/netfilter/nf_nat_helper.c | |||
@@ -373,6 +373,7 @@ nf_nat_seq_adjust(struct sk_buff *skb, | |||
373 | s16 seqoff, ackoff; | 373 | s16 seqoff, ackoff; |
374 | struct nf_conn_nat *nat = nfct_nat(ct); | 374 | struct nf_conn_nat *nat = nfct_nat(ct); |
375 | struct nf_nat_seq *this_way, *other_way; | 375 | struct nf_nat_seq *this_way, *other_way; |
376 | int res; | ||
376 | 377 | ||
377 | dir = CTINFO2DIR(ctinfo); | 378 | dir = CTINFO2DIR(ctinfo); |
378 | 379 | ||
@@ -383,6 +384,7 @@ nf_nat_seq_adjust(struct sk_buff *skb, | |||
383 | return 0; | 384 | return 0; |
384 | 385 | ||
385 | tcph = (void *)skb->data + protoff; | 386 | tcph = (void *)skb->data + protoff; |
387 | spin_lock_bh(&nf_nat_seqofs_lock); | ||
386 | if (after(ntohl(tcph->seq), this_way->correction_pos)) | 388 | if (after(ntohl(tcph->seq), this_way->correction_pos)) |
387 | seqoff = this_way->offset_after; | 389 | seqoff = this_way->offset_after; |
388 | else | 390 | else |
@@ -407,7 +409,10 @@ nf_nat_seq_adjust(struct sk_buff *skb, | |||
407 | tcph->seq = newseq; | 409 | tcph->seq = newseq; |
408 | tcph->ack_seq = newack; | 410 | tcph->ack_seq = newack; |
409 | 411 | ||
410 | return nf_nat_sack_adjust(skb, protoff, tcph, ct, ctinfo); | 412 | res = nf_nat_sack_adjust(skb, protoff, tcph, ct, ctinfo); |
413 | spin_unlock_bh(&nf_nat_seqofs_lock); | ||
414 | |||
415 | return res; | ||
411 | } | 416 | } |
412 | 417 | ||
413 | /* Setup NAT on this expected conntrack so it follows master. */ | 418 | /* Setup NAT on this expected conntrack so it follows master. */ |