Ilya Maximets <[email protected]> writes: > While calling the helpers, a raw pointer to the extensions area is > wired into expectations list: > > -> nf_ct_helper() > -> helper->help() > -> nf_ct_expect_related_report() > -> nf_ct_expect_insert() > -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) > > In case the connection is not confirmed yet, more extensions can be > added afterwards with *_ext_add() calls reallocating the extension > space and leaving the now invalid pointer in the expectations list > that is later accessed while removing the expectation. > > Make sure that helpers are called at the end after all the other > extensions are already added. > > Note that the helper rejection now leaves the mark and labels set, > but that's not different from how the NAT was handled before or how > the mark and the labels were handled on confirmation failure. And > there are no atomicity guarantees provided by the API anyway. > > Fixes: a21b06e73191 ("net: sched: add helper support in act_ct") > Cc: [email protected] > Reported-by: Axel Mierczuk <[email protected]> > Signed-off-by: Ilya Maximets <[email protected]> > ---
Reviewed-by: Aaron Conole <[email protected]> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
