rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use RCU safe kfree for conntrack (rhbz 1015989)

This commit is contained in:
Josh Boyer 2013-10-08 08:39:57 -04:00
parent 80224cd206
commit b7939eea68
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
kernel.spec
View File

@ -62,7 +62,7 @@ Summary: The Linux kernel
# For non-released -rc kernels, this will be appended after the rcX and
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
#
%global baserelease 200
%global baserelease 201
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
@ -763,6 +763,9 @@ Patch25118: bonding-driver-promisc.patch
#CVE-2013-4387 rhbz 1011927 1015166
Patch25121: ipv6-udp-packets-following-an-UFO-enqueued-packet-ne.patch
#rhbz 1015989
Patch25122: netfilter-nf_conntrack-use-RCU-safe-kfree-for-conntr.patch
# END OF PATCH DEFINITIONS
%endif
@ -1474,6 +1477,9 @@ ApplyPatch bonding-driver-promisc.patch
#CVE-2013-4387 rhbz 1011927 1015166
ApplyPatch ipv6-udp-packets-following-an-UFO-enqueued-packet-ne.patch
#rhbz 1015989
ApplyPatch netfilter-nf_conntrack-use-RCU-safe-kfree-for-conntr.patch
# END OF PATCH APPLICATIONS
%endif
@ -2286,6 +2292,9 @@ fi
# and build.
%changelog
* Tue Oct 08 2013 Josh Boyer <jwboyer@fedoraproject.org>
- Use RCU safe kfree for conntrack (rhbz 1015989)
* Mon Oct 7 2013 Justin M. Forbes <jforbes@fedoraproject.org>
- Linux v3.11.4

35
netfilter-nf_conntrack-use-RCU-safe-kfree-for-conntr.patch Normal file
View File

@ -0,0 +1,35 @@
From c13a84a830a208fb3443628773c8ca0557773cc7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20Kube=C4=8Dek?= <mkubecek@suse.cz>
Date: Wed, 11 Sep 2013 10:17:27 +0200
Subject: [PATCH] netfilter: nf_conntrack: use RCU safe kfree for conntrack
extensions
Commit 68b80f11 (netfilter: nf_nat: fix RCU races) introduced
RCU protection for freeing extension data when reallocation
moves them to a new location. We need the same protection when
freeing them in nf_ct_ext_free() in order to prevent a
use-after-free by other threads referencing a NAT extension data
via bysource list.
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_extend.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index ff95434..88a1d40 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -86,7 +86,7 @@ static inline void nf_ct_ext_destroy(struct nf_conn *ct)
static inline void nf_ct_ext_free(struct nf_conn *ct)
{
if (ct->ext)
- kfree(ct->ext);
+ kfree_rcu(ct->ext, rcu);
}
/* Add this type, returns pointer to data or NULL. */
--
1.8.3.1