57 lines
2.1 KiB
Diff
57 lines
2.1 KiB
Diff
From f2a8d75fdf87f1a3075b27c58f10f0ac902475bc Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:24:37 +0200
|
|
Subject: [PATCH] netfilter: nf_conntrack_sip: get helper before allocating
|
|
expectation
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit eb6317739b1e
|
|
|
|
commit eb6317739b1ea3ab28791e1f91b24781905fa815
|
|
Author: Li Xiasong <lixiasong1@huawei.com>
|
|
Date: Thu May 7 22:04:22 2026 +0800
|
|
|
|
netfilter: nf_conntrack_sip: get helper before allocating expectation
|
|
|
|
process_register_request() allocates an expectation and then checks
|
|
whether a conntrack helper is available. If helper lookup fails, the
|
|
function returns early and the allocated expectation is left behind.
|
|
|
|
Reorder the code to fetch and validate helper before calling
|
|
nf_ct_expect_alloc(). This keeps the logic simpler and removes the leak
|
|
path while preserving existing behavior.
|
|
|
|
Fixes: e14575fa7529 ("netfilter: nf_conntrack: use rcu accessors where needed")
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
|
|
index 25ab92e..d5bc99b 100644
|
|
--- a/net/netfilter/nf_conntrack_sip.c
|
|
+++ b/net/netfilter/nf_conntrack_sip.c
|
|
@@ -1361,6 +1361,10 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,
|
|
goto store_cseq;
|
|
}
|
|
|
|
+ helper = rcu_dereference(nfct_help(ct)->helper);
|
|
+ if (!helper)
|
|
+ return NF_DROP;
|
|
+
|
|
exp = nf_ct_expect_alloc(ct);
|
|
if (!exp) {
|
|
nf_ct_helper_log(skb, ct, "cannot alloc expectation");
|
|
@@ -1371,10 +1375,6 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,
|
|
if (sip_direct_signalling)
|
|
saddr = &ct->tuplehash[!dir].tuple.src.u3;
|
|
|
|
- helper = rcu_dereference(nfct_help(ct)->helper);
|
|
- if (!helper)
|
|
- return NF_DROP;
|
|
-
|
|
nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
|
|
saddr, &daddr, proto, NULL, &port);
|
|
exp->timeout.expires = sip_timeout * HZ;
|