9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
66 lines
2.2 KiB
Diff
66 lines
2.2 KiB
Diff
From 57807b90c78a36d8729fc8d8a04ce31bd4f3e4ff Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 20 May 2026 11:48:56 +0200
|
|
Subject: [PATCH] netfilter: nf_conntrack_helper: fix possible null deref
|
|
during error log
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit 1afc25ae7528
|
|
|
|
commit 1afc25ae75288b3ce59e9e5a4b448bd354c9e565
|
|
Author: Florian Westphal <fw@strlen.de>
|
|
Date: Sat May 9 10:27:06 2026 +0200
|
|
|
|
netfilter: nf_conntrack_helper: fix possible null deref during error log
|
|
|
|
Reported by sashiko: there is a small race window.
|
|
|
|
If a helper module is unloaded or a userspace-defined helper is
|
|
removed, nf_conntrack_helper_unregister() sets ->helper to NULL.
|
|
|
|
Handle this safely. This needs a second patch to close related
|
|
race during nf_conntrack_helper_unregister().
|
|
|
|
Fixes: b20ab9cc63ca ("netfilter: nf_ct_helper: better logging for dropped packets")
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
|
|
index b594cd2..17e971b 100644
|
|
--- a/net/netfilter/nf_conntrack_helper.c
|
|
+++ b/net/netfilter/nf_conntrack_helper.c
|
|
@@ -321,8 +321,8 @@ __printf(3, 4)
|
|
void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct,
|
|
const char *fmt, ...)
|
|
{
|
|
+ const char *helper_name = "(null)";
|
|
const struct nf_conn_help *help;
|
|
- const struct nf_conntrack_helper *helper;
|
|
struct va_format vaf;
|
|
va_list args;
|
|
|
|
@@ -331,14 +331,17 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct,
|
|
vaf.fmt = fmt;
|
|
vaf.va = &args;
|
|
|
|
- /* Called from the helper function, this call never fails */
|
|
help = nfct_help(ct);
|
|
+ if (help) {
|
|
+ const struct nf_conntrack_helper *helper;
|
|
|
|
- /* rcu_read_lock()ed by nf_hook_thresh */
|
|
- helper = rcu_dereference(help->helper);
|
|
+ helper = rcu_dereference(help->helper);
|
|
+ if (helper)
|
|
+ helper_name = helper->name;
|
|
+ }
|
|
|
|
nf_log_packet(nf_ct_net(ct), nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL,
|
|
- "nf_ct_%s: dropping packet: %pV ", helper->name, &vaf);
|
|
+ "helper %s dropping packet: %pV ", helper_name, &vaf);
|
|
|
|
va_end(args);
|
|
}
|