aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorSergey Popovich <popovich_sergei@mail.ru>2013-12-06 03:57:19 -0500
committerPablo Neira Ayuso <pablo@netfilter.org>2013-12-07 16:46:51 -0500
commitb4ef4ce09308955d1aa54a289c0162607b3aa16c (patch)
tree9dc93718ecdfde404235cf1e1b94122b2374f992 /net
parentb49faea7655ec10ade15d7d007e4218ca578a513 (diff)
netfilter: xt_hashlimit: fix proc entry leak in netns destroy path
In (32263dd1b netfilter: xt_hashlimit: fix namespace destroy path) the hashlimit_net_exit() function is always called right before hashlimit_mt_destroy() to release netns data. If you use xt_hashlimit with IPv4 and IPv6 together, this produces the following splat via netconsole in the netns destroy path: Pid: 9499, comm: kworker/u:0 Tainted: G WC O 3.2.0-5-netctl-amd64-core2 Call Trace: [<ffffffff8104708d>] ? warn_slowpath_common+0x78/0x8c [<ffffffff81047139>] ? warn_slowpath_fmt+0x45/0x4a [<ffffffff81144a99>] ? remove_proc_entry+0xd8/0x22e [<ffffffff810ebbaa>] ? kfree+0x5b/0x6c [<ffffffffa043c501>] ? hashlimit_net_exit+0x45/0x8d [xt_hashlimit] [<ffffffff8128ab30>] ? ops_exit_list+0x1c/0x44 [<ffffffff8128b28e>] ? cleanup_net+0xf1/0x180 [<ffffffff810369fc>] ? should_resched+0x5/0x23 [<ffffffff8105b8f9>] ? process_one_work+0x161/0x269 [<ffffffff8105aea5>] ? cwq_activate_delayed_work+0x3c/0x48 [<ffffffff8105c8c2>] ? worker_thread+0xc2/0x145 [<ffffffff8105c800>] ? manage_workers.isra.25+0x15b/0x15b [<ffffffff8105fa01>] ? kthread+0x76/0x7e [<ffffffff813581f4>] ? kernel_thread_helper+0x4/0x10 [<ffffffff8105f98b>] ? kthread_worker_fn+0x139/0x139 [<ffffffff813581f0>] ? gs_change+0x13/0x13 ---[ end trace d8c3cc0ad163ef79 ]--- ------------[ cut here ]------------ WARNING: at /usr/src/linux-3.2.52/debian/build/source_netctl/fs/proc/generic.c:849 remove_proc_entry+0x217/0x22e() Hardware name: remove_proc_entry: removing non-empty directory 'net/ip6t_hashlimit', leaking at least 'IN-REJECT' This is due to lack of removal net/ip6t_hashlimit/* entries in hashlimit_proc_net_exit(), since only IPv4 entries are deleted. Fix it by always removing the IPv4 and IPv6 entries and their parent directories in the netns destroy path. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/xt_hashlimit.c25
1 files changed, 11 insertions, 14 deletions
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c71403..a3910fc2122b 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
325 add_timer(&ht->timer); 325 add_timer(&ht->timer);
326} 326}
327 327
328static void htable_destroy(struct xt_hashlimit_htable *hinfo) 328static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
329{ 329{
330 struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net); 330 struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
331 struct proc_dir_entry *parent; 331 struct proc_dir_entry *parent;
332 332
333 del_timer_sync(&hinfo->timer);
334
335 if (hinfo->family == NFPROTO_IPV4) 333 if (hinfo->family == NFPROTO_IPV4)
336 parent = hashlimit_net->ipt_hashlimit; 334 parent = hashlimit_net->ipt_hashlimit;
337 else 335 else
338 parent = hashlimit_net->ip6t_hashlimit; 336 parent = hashlimit_net->ip6t_hashlimit;
339 337
340 if(parent != NULL) 338 if (parent != NULL)
341 remove_proc_entry(hinfo->name, parent); 339 remove_proc_entry(hinfo->name, parent);
340}
342 341
342static void htable_destroy(struct xt_hashlimit_htable *hinfo)
343{
344 del_timer_sync(&hinfo->timer);
345 htable_remove_proc_entry(hinfo);
343 htable_selective_cleanup(hinfo, select_all); 346 htable_selective_cleanup(hinfo, select_all);
344 kfree(hinfo->name); 347 kfree(hinfo->name);
345 vfree(hinfo); 348 vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
883static void __net_exit hashlimit_proc_net_exit(struct net *net) 886static void __net_exit hashlimit_proc_net_exit(struct net *net)
884{ 887{
885 struct xt_hashlimit_htable *hinfo; 888 struct xt_hashlimit_htable *hinfo;
886 struct proc_dir_entry *pde;
887 struct hashlimit_net *hashlimit_net = hashlimit_pernet(net); 889 struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
888 890
889 /* recent_net_exit() is called before recent_mt_destroy(). Make sure 891 /* hashlimit_net_exit() is called before hashlimit_mt_destroy().
890 * that the parent xt_recent proc entry is is empty before trying to 892 * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
891 * remove it. 893 * entries is empty before trying to remove it.
892 */ 894 */
893 mutex_lock(&hashlimit_mutex); 895 mutex_lock(&hashlimit_mutex);
894 pde = hashlimit_net->ipt_hashlimit;
895 if (pde == NULL)
896 pde = hashlimit_net->ip6t_hashlimit;
897
898 hlist_for_each_entry(hinfo, &hashlimit_net->htables, node) 896 hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
899 remove_proc_entry(hinfo->name, pde); 897 htable_remove_proc_entry(hinfo);
900
901 hashlimit_net->ipt_hashlimit = NULL; 898 hashlimit_net->ipt_hashlimit = NULL;
902 hashlimit_net->ip6t_hashlimit = NULL; 899 hashlimit_net->ip6t_hashlimit = NULL;
903 mutex_unlock(&hashlimit_mutex); 900 mutex_unlock(&hashlimit_mutex);