From: Evgeniy Polyakov Date: Tue, 20 Nov 2007 12:27:35 +0000 (-0800) Subject: [NETFILTER]: Fix kernel panic with REDIRECT target. X-Git-Tag: v2.6.24-rc4~90^2~20 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1f305323ff5b9ddc1a4346d36072bcdb58f3f68a;p=pandora-kernel.git [NETFILTER]: Fix kernel panic with REDIRECT target. When connection tracking entry (nf_conn) is about to copy itself it can have some of its extension users (like nat) as being already freed and thus not required to be copied. Actually looking at this function I suspect it was copied from nf_nat_setup_info() and thus bug was introduced. Report and testing from David . [ Patrick McHardy states: I now understand whats happening: - new connection is allocated without helper - connection is REDIRECTed to localhost - nf_nat_setup_info adds NAT extension, but doesn't initialize it yet - nf_conntrack_alter_reply performs a helper lookup based on the new tuple, finds the SIP helper and allocates a helper extension, causing reallocation because of too little space - nf_nat_move_storage is called with the uninitialized nat extension So your fix is entirely correct, thanks a lot :) ] Signed-off-by: Evgeniy Polyakov Acked-by: Patrick McHardy Signed-off-by: David S. Miller --- Reading git-diff-tree failed