| Date | Fri, 19 Feb 2010 08:29:41 -0800 | From | Greg KH <> | Subject | [48/93] netfilter: nf_conntrack: restrict runtime expect hashsize modifications |
| |
2.6.32-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alexey Dobriyan <adobriyan@gmail.com>
commit 13ccdfc2af03e09e60791f7d4bc4ccf53398af7c upstream.
Expectation hashtable size was simply glued to a variable with no code to rehash expectations, so it was a bug to allow writing to it. Make "expect_hashsize" readonly.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- net/netfilter/nf_conntrack_expect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -569,7 +569,7 @@ static void exp_proc_remove(struct net * #endif /* CONFIG_PROC_FS */ } -module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600); +module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400); int nf_conntrack_expect_init(struct net *net) {
|