On 03.07.2017 15:34, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
We found that pulling below patch into stable trees without also pulling
commit 9c3f3794926a997b1cab6c42480ff300efa2d162
Author: Liping Zhang <zlpnobody@xxxxxxxxx>
Date: Sat Mar 25 16:35:29 2017 +0800
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
will result in a regression, at least in 4.4.y[1]. Stable maintainers who picked
up below patch might want to consider picking up above fix.
-Stefan
[1] http://bugs.launchpad.net/bugs/1709032
>
> ------------------
>
> From: Eric Leblond <eric@xxxxxxxxx>
>
> commit 87e94dbc210a720a34be5c1174faee5c84be963e upstream.
>
> This patch fixes the creation of connection tracking entry from
> netlink when synproxy is used. It was missing the addition of
> the synproxy extension.
>
> This was causing kernel crashes when a conntrack entry created by
> conntrackd was used after the switch of traffic from active node
> to the passive node.
>
> Signed-off-by: Eric Leblond <eric@xxxxxxxxx>
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
>
> ---
> net/netfilter/nf_conntrack_netlink.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -45,6 +45,8 @@
> #include <net/netfilter/nf_conntrack_zones.h>
> #include <net/netfilter/nf_conntrack_timestamp.h>
> #include <net/netfilter/nf_conntrack_labels.h>
> +#include <net/netfilter/nf_conntrack_seqadj.h>
> +#include <net/netfilter/nf_conntrack_synproxy.h>
> #ifdef CONFIG_NF_NAT_NEEDED
> #include <net/netfilter/nf_nat_core.h>
> #include <net/netfilter/nf_nat_l4proto.h>
> @@ -1798,6 +1800,8 @@ ctnetlink_create_conntrack(struct net *n
> nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
> nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
> nf_ct_labels_ext_add(ct);
> + nfct_seqadj_ext_add(ct);
> + nfct_synproxy_ext_add(ct);
>
> /* we must add conntrack extensions before confirmation. */
> ct->status |= IPS_CONFIRMED;
>
>
Attachment:
signature.asc
Description: OpenPGP digital signature