netfilter: xt_recent: Fix attempt to update deleted entry

[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ]

When both --reap and --update flag are specified, there's a code
path at which the entry to be updated is reaped beforehand,
which then leads to kernel crash. Reap only entries which won't be
updated.

Fixes kernel bugzilla #207773.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773
Reported-by: Reindl Harald <h.reindl@thelounge.net>
Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper")
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index cf96d230e5a3c3655ce11671295b056121f7163a..cafbddf844d62fd0039e5a2128a08ddca442d03f 100644 (file)
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -155,7 +155,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
 /*
  * Drop entries with timestamps older then 'time'.
  */
-static void recent_entry_reap(struct recent_table *t, unsigned long time)
+static void recent_entry_reap(struct recent_table *t, unsigned long time,
+                             struct recent_entry *working, bool update)
 {
        struct recent_entry *e;
 
@@ -164,6 +165,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
         */
        e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
 
+       /*
+        * Do not reap the entry which are going to be updated.
+        */
+       if (e == working && update)
+               return;
+
        /*
         * The last time stamp is the most recent.
         */
@@ -306,7 +313,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
 
                /* info->seconds must be non-zero */
                if (info->check_set & XT_RECENT_REAP)
-                       recent_entry_reap(t, time);
+                       recent_entry_reap(t, time, e,
+                               info->check_set & XT_RECENT_UPDATE && ret);
        }
 
        if (info->check_set & XT_RECENT_SET ||