Gao Feng 4440a2ab3b netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions ...

When memory is exhausted, nfct_seqadj_ext_add may fail to add the
synproxy and seqadj extensions. The function nf_ct_seqadj_init doesn't
check if get valid seqadj pointer by the nfct_seqadj.

Now drop the packet directly when fail to add seqadj extension to
avoid dereference NULL pointer in nf_ct_seqadj_init from
init_conntrack().

Signed-off-by: Gao Feng <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

2016-09-13 10:50:56 +02:00

..

ipv4

ipv4: Push struct net down into nf_send_reset

2015-09-29 20:21:31 +02:00

ipv6

netfilter: ipv6: avoid nf_iterate recursion

2015-11-23 17:54:45 +01:00

br_netfilter.h

bridge: Pass net into br_validate_ipv4 and br_validate_ipv6

2015-09-29 20:21:32 +02:00

nf_conntrack_acct.h

…

nf_conntrack_core.h

netfilter: conntrack: fix race between nf_conntrack proc read and hash resize

2016-07-11 11:38:57 +02:00

nf_conntrack_ecache.h

netfilter: conntrack: move expectation event helper to ecache.c

2016-04-12 23:01:57 +02:00

nf_conntrack_expect.h

netfilter: conntrack: use a single expectation table for all namespaces

2016-05-06 11:50:01 +02:00

nf_conntrack_extend.h

netfilter: move nat hlist_head to nf_conn

2016-07-11 11:47:50 +02:00

nf_conntrack_helper.h

netfilter: Add helper array register/unregister functions

2016-07-21 02:31:53 +02:00

nf_conntrack_l3proto.h

netfilter: Convert print_tuple functions to return void

2014-11-05 14:10:33 -05:00

nf_conntrack_l4proto.h

netfilter: conntrack: introduce clash resolution on insertion race

2016-05-05 16:39:50 +02:00

nf_conntrack_labels.h

netfilter: connlabels: move set helper to xt_connlabel

2016-07-22 17:05:10 +02:00

nf_conntrack_seqadj.h

…

nf_conntrack_synproxy.h

netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions

2016-09-13 10:50:56 +02:00

nf_conntrack_timeout.h

netfilter: cttimeout: add netns support

2015-12-14 12:48:58 +01:00

nf_conntrack_timestamp.h

…

nf_conntrack_tuple.h

…

nf_conntrack_zones.h

netfilter: move zone info into struct nf_conn

2016-06-23 13:33:12 +02:00

nf_conntrack.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2016-07-24 22:02:36 -07:00

nf_dup_netdev.h

netfilter: nf_tables: add packet duplication to the netdev family

2016-01-03 21:04:23 +01:00

nf_log.h

netfilter: xt_NFLOG: nflog-range does not truncate packets

2016-06-24 11:03:23 +02:00

nf_nat_core.h

netfilter: Pass net into nf_xfrm_me_harder

2015-09-18 22:00:22 +02:00

nf_nat_helper.h

…

nf_nat_l3proto.h

netfilter: Pass priv instead of nf_hook_ops to netfilter hooks

2015-09-18 22:00:16 +02:00

nf_nat_l4proto.h

…

nf_nat_redirect.h

netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one module

2014-11-27 13:08:42 +01:00

nf_nat.h

netfilter: nat: convert nat bysrc hash to rhashtable

2016-07-11 12:07:57 +02:00

nf_queue.h

netfilter: nf_queue: Make the queue_handler pernet

2016-05-25 11:54:22 +02:00

nf_tables_bridge.h

netfilter: nf_tables_bridge: export nft_reject_ip*hdr_validate functions

2014-11-27 12:58:05 +01:00

nf_tables_core.h

netfilter: nf_tables: wrap tracing with a static key

2015-12-09 13:23:13 +01:00

nf_tables_ipv4.h

netfilter: nf_tables: kill nft_pktinfo.ops

2015-09-18 21:58:01 +02:00

nf_tables_ipv6.h

netfilter: nf_tables: kill nft_pktinfo.ops

2015-09-18 21:58:01 +02:00

nf_tables.h

netfilter: nf_tables: get rid of possible_net_t from set and basechain

2016-07-11 12:16:04 +02:00

nfnetlink_log.h

…

nft_dup.h

netfilter: nf_tables: add nft_dup expression

2015-08-07 11:49:49 +02:00

nft_masq.h

netfilter: nft_masq: support port range

2016-03-02 20:05:27 +01:00

nft_meta.h

netfilter: nft_meta: improve the validity check of pkttype set expr

2016-08-25 13:12:03 +02:00

nft_redir.h

netfilter: nf_tables: add new expression nft_redir

2014-10-27 22:49:39 +01:00

nft_reject.h

netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT

2016-08-25 12:55:34 +02:00

xt_rateest.h

…