linux/net/netfilter
Florian Westphal 945b2b2d25 netfilter: nf_nat: fix oops on netns removal
Quoting Samu Kallio:

 Basically what's happening is, during netns cleanup,
 nf_nat_net_exit gets called before ipv4_net_exit. As I understand
 it, nf_nat_net_exit is supposed to kill any conntrack entries which
 have NAT context (through nf_ct_iterate_cleanup), but for some
 reason this doesn't happen (perhaps something else is still holding
 refs to those entries?).

 When ipv4_net_exit is called, conntrack entries (including those
 with NAT context) are cleaned up, but the
 nat_bysource hashtable is long gone - freed in nf_nat_net_exit. The
 bug happens when attempting to free a conntrack entry whose NAT hash
 'prev' field points to a slot in the freed hash table (head for that
 bin).

We ignore conntracks with null nat bindings.  But this is wrong,
as these are in bysource hash table as well.

Restore nat-cleaning for the netns-is-being-removed case.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=65191

Fixes: c2d421e171 ('netfilter: nf_nat: fix race when unloading protocol modules')
Reported-by: Samu Kallio <samu.kallio@aberdeencloud.com>
Debugged-by: Samu Kallio <samu.kallio@aberdeencloud.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Samu Kallio <samu.kallio@aberdeencloud.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-06-16 13:58:54 +02:00
..
ipset net: use the new API kvfree() 2014-06-05 00:49:51 -07:00
ipvs Merge branch 'ipvs' 2014-06-16 13:22:33 +02:00
core.c
Kconfig
Makefile
nf_conntrack_acct.c
nf_conntrack_amanda.c
nf_conntrack_broadcast.c
nf_conntrack_core.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
nf_conntrack_ecache.c
nf_conntrack_expect.c netfilter: conntrack: seperate expect locking from nf_conntrack_lock 2014-03-07 11:41:01 +01:00
nf_conntrack_extend.c
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c netfilter: conntrack: seperate expect locking from nf_conntrack_lock 2014-03-07 11:41:01 +01:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c netfilter: conntrack: remove central spinlock nf_conntrack_lock 2014-03-07 11:41:13 +01:00
nf_conntrack_irc.c
nf_conntrack_l3proto_generic.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c netfilter: ctnetlink: add zone size to length 2014-06-16 13:53:03 +02:00
nf_conntrack_pptp.c netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper 2014-04-08 10:56:12 +02:00
nf_conntrack_proto_dccp.c
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper 2014-04-08 10:56:12 +02:00
nf_conntrack_proto_sctp.c
nf_conntrack_proto_tcp.c
nf_conntrack_proto_udp.c
nf_conntrack_proto_udplite.c
nf_conntrack_proto.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c netfilter: conntrack: seperate expect locking from nf_conntrack_lock 2014-03-07 11:41:01 +01:00
nf_conntrack_snmp.c
nf_conntrack_standalone.c
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_internals.h
nf_log.c
nf_nat_amanda.c
nf_nat_core.c netfilter: nf_nat: fix oops on netns removal 2014-06-16 13:58:54 +02:00
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_proto_common.c
nf_nat_proto_dccp.c
nf_nat_proto_sctp.c
nf_nat_proto_tcp.c
nf_nat_proto_udp.c
nf_nat_proto_udplite.c
nf_nat_proto_unknown.c
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c
nf_sockopt.c
nf_synproxy_core.c
nf_tables_api.c netfilter: nf_tables: indicate family when dumping set elements 2014-06-16 13:08:09 +02:00
nf_tables_core.c netfilter: nf_tables: fix trace of matching non-terminal rule 2014-05-15 19:44:20 +02:00
nf_tables_inet.c
nfnetlink_acct.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-06-12 14:27:40 -07:00
nfnetlink_cthelper.c
nfnetlink_cttimeout.c
nfnetlink_log.c netfilter: nfnetlink_log: remove unused code 2014-02-25 11:30:01 +01:00
nfnetlink_queue_core.c core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors 2014-03-27 15:29:38 -04:00
nfnetlink_queue_ct.c
nfnetlink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-05-12 13:19:14 -04:00
nft_bitwise.c
nft_byteorder.c
nft_cmp.c netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4 2014-04-14 10:38:02 +02:00
nft_compat.c netfilter: nft_compat: call {target, match}->destroy() to cleanup entry 2014-06-16 13:08:04 +02:00
nft_counter.c
nft_ct.c netfilter: nft_ct: split nft_ct_init() into two functions for get/set 2014-04-02 21:29:45 +02:00
nft_expr_template.c
nft_exthdr.c
nft_hash.c net: use the new API kvfree() 2014-06-05 00:49:51 -07:00
nft_immediate.c netfilter: nf_tables: restore context for expression destructors 2014-03-08 12:35:17 +01:00
nft_limit.c
nft_log.c netfilter: nf_tables: restore context for expression destructors 2014-03-08 12:35:17 +01:00
nft_lookup.c netfilter: nf_tables: use new transaction infrastructure to handle sets 2014-05-19 12:06:10 +02:00
nft_meta.c netfilter: nf_tables: Make meta expression core functions public 2014-04-23 13:55:30 +02:00
nft_nat.c netfilter: nft_nat: don't dump port information if unset 2014-06-16 13:08:14 +02:00
nft_payload.c
nft_queue.c
nft_rbtree.c netfilter: nft_rbtree: introduce locking 2014-06-02 10:54:31 +02:00
nft_reject_inet.c
nft_reject.c
x_tables.c
xt_addrtype.c
xt_AUDIT.c netfilter: Convert uses of __constant_<foo> to <foo> 2014-03-13 14:13:19 +01:00
xt_bpf.c net: filter: let unattached filters use sock_fprog_kern 2014-05-23 16:48:05 -04:00
xt_cgroup.c netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks 2014-04-03 23:52:17 +02:00
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c
xt_comment.c
xt_connbytes.c
xt_connlabel.c
xt_connlimit.c netfilter: connlimit: move lock array out of struct connlimit_data 2014-04-03 23:52:13 +02:00
xt_connmark.c
xt_CONNSECMARK.c
xt_conntrack.c
xt_cpu.c
xt_CT.c
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c
xt_length.c
xt_limit.c
xt_LOG.c
xt_mac.c
xt_mark.c
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c netfilter: nfnetlink_acct: Adding quota support to accounting framework 2014-04-29 18:25:14 +02:00
xt_NFLOG.c
xt_NFQUEUE.c
xt_osf.c netfilter: Add {ipt,ip6t}_osf aliases for xt_osf 2014-04-03 23:52:22 +02:00
xt_owner.c
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c
xt_RATEEST.c
xt_realm.c
xt_recent.c net: use the new API kvfree() 2014-06-05 00:49:51 -07:00
xt_REDIRECT.c
xt_repldata.h net: netfilter: LLVMLinux: vlais-netfilter 2014-06-07 11:44:39 -07:00
xt_sctp.c
xt_SECMARK.c
xt_set.c
xt_socket.c
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_TCPMSS.c
xt_TCPOPTSTRIP.c
xt_tcpudp.c
xt_TEE.c
xt_time.c
xt_TPROXY.c
xt_TRACE.c
xt_u32.c