From: Pablo Neira Ayuso Date: Thu, 6 Jan 2011 19:25:00 +0000 (-0800) Subject: netfilter: fix export secctx error handling X-Git-Tag: v2.6.37.5~75 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=71c36cc2a9ef5622024b1ca84a000ecd76e5cc13;p=pandora-kernel.git netfilter: fix export secctx error handling commit cba85b532e4aabdb97f44c18987d45141fd93faa upstream. In 1ae4de0cdf855305765592647025bde55e85e451, the secctx was exported via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces instead of the secmark. That patch introduced the use of security_secid_to_secctx() which may return a non-zero value on error. In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no security modules. Thus, security_secid_to_secctx() returns a negative value that results in the breakage of the /proc and `conntrack -L' outputs. To fix this, we skip the inclusion of secctx if the aforementioned function fails. This patch also fixes the dynamic netlink message size calculation if security_secid_to_secctx() returns an error, since its logic is also wrong. This problem exists in Linux kernel >= 2.6.37. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed