On Tue, Apr 15, 2014 at 12:17:30AM +0200, Pablo Neira Ayuso wrote:
> From: Andrey Vagin <avagin@xxxxxxxxxx>
>
> upstream commit 223b02d923ecd7c84cf9780bb3686f455d279279.
>
Thank, I'll queue it for the 3.11 kernel as well.
Cheers,
--
Luís
> "len" contains sizeof(nf_ct_ext) and size of extensions. In a worst
> case it can contain all extensions. Bellow you can find sizes for all
> types of extensions. Their sum is definitely bigger than 256.
>
> nf_ct_ext_types[0]->len = 24
> nf_ct_ext_types[1]->len = 32
> nf_ct_ext_types[2]->len = 24
> nf_ct_ext_types[3]->len = 32
> nf_ct_ext_types[4]->len = 152
> nf_ct_ext_types[5]->len = 2
> nf_ct_ext_types[6]->len = 16
> nf_ct_ext_types[7]->len = 8
>
> I have seen "len" up to 280 and my host has crashes w/o this patch.
>
> The right way to fix this problem is reducing the size of the ecache
> extension (4) and Florian is going to do this, but these changes will
> be quite large to be appropriate for a stable tree.
>
> Fixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)
> Cc: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
> Cc: Patrick McHardy <kaber@xxxxxxxxx>
> Cc: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx>
> Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
> Signed-off-by: Andrey Vagin <avagin@xxxxxxxxxx>
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.14.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.13.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.12.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.10.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.4.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.2.x
> ---
> include/net/netfilter/nf_conntrack_extend.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
> index 956b175..55d1504 100644
> --- a/include/net/netfilter/nf_conntrack_extend.h
> +++ b/include/net/netfilter/nf_conntrack_extend.h
> @@ -47,8 +47,8 @@ enum nf_ct_ext_id {
> /* Extensions: optional stuff which isn't permanently in struct. */
> struct nf_ct_ext {
> struct rcu_head rcu;
> - u8 offset[NF_CT_EXT_NUM];
> - u8 len;
> + u16 offset[NF_CT_EXT_NUM];
> + u16 len;
> char data[0];
> };
>
> --
> 1.7.10.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html