mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-23 07:27:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp

Browse Source 
For GRE flows, validate that the ct master helper (if any) is pptp
before calling nf_ct_gre_keymap_destroy(), so the helper data area
can be accessed safely. Note that only the pptp helper provides a
.destroy callback.

Fixes: e56894356f ("netfilter: conntrack: remove l4proto destroy hook")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2026-06-04 08:21:13 +02:00
parent 35e21a4dcc
commit b0f02608fb
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
net/netfilter/nf_conntrack_core.c
View File

@@ -562,9 +562,23 @@ static void destroy_gre_conntrack(struct nf_conn *ct)
{
#ifdef CONFIG_NF_CT_PROTO_GRE
struct nf_conn *master = ct->master;
struct nf_conn_help *help;
if (master)
nf_ct_gre_keymap_destroy(master);
if (!master)
return;
help = nfct_help(master);
if (help) {
struct nf_conntrack_helper *helper;
rcu_read_lock();
helper = rcu_dereference(help->helper);
/* Only pptp helper has a destroy callback. */
if (helper && helper->destroy)
nf_ct_gre_keymap_destroy(master);
rcu_read_unlock();
}
#endif
}