netfilter: remove BUG_ON() after skb_header_pointer()

Several conntrack helpers and the TCP tracker assume that
skb_header_pointer() never fails based on upfront header validation.
Even if this should not ever happen, BUG_ON() is a too drastic measure,
remove them.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index b22801f97bcec9b96f5dfb17a311a0247f8c4b07..a414274338cff03efc477e28f2f43976b9adcd7b 100644 (file)
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -413,7 +413,10 @@ static int help(struct sk_buff *skb,
 
        spin_lock_bh(&nf_ftp_lock);
        fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer);
-       BUG_ON(fb_ptr == NULL);
+       if (!fb_ptr) {
+               spin_unlock_bh(&nf_ftp_lock);
+               return NF_ACCEPT;
+       }
 
        ends_in_nl = (fb_ptr[datalen - 1] == '\n');
        seq = ntohl(th->seq) + datalen;

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 8ba037b76ad3af51e953cb5c501749778f070336..aafaff00baf1bd42b71e98de51dc4567f3f244ea 100644 (file)
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -146,7 +146,8 @@ static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
                /* Get first TPKT pointer */
                tpkt = skb_header_pointer(skb, tcpdataoff, tcpdatalen,
                                          h323_buffer);
-               BUG_ON(tpkt == NULL);
+               if (!tpkt)
+                       goto clear_out;
 
                /* Validate TPKT identifier */
                if (tcpdatalen < 4 || tpkt[0] != 0x03 || tpkt[1] != 0) {

diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index e40988a2f22fbaad4cf14256ec5be0c6d4da2052..08ee4e760a3d2551ad689dfb4167555e82a99737 100644 (file)
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -143,7 +143,10 @@ static int help(struct sk_buff *skb, unsigned int protoff,
        spin_lock_bh(&irc_buffer_lock);
        ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
                                    irc_buffer);
-       BUG_ON(ib_ptr == NULL);
+       if (!ib_ptr) {
+               spin_unlock_bh(&irc_buffer_lock);
+               return NF_ACCEPT;
+       }
 
        data = ib_ptr;
        data_limit = ib_ptr + skb->len - dataoff;

diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 5105d4250012ceecacba98b008f8c768fcd28dfa..7d5708b92138ef29cfbf9c9f92618da15c8ade6b 100644 (file)
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -544,7 +544,9 @@ conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff,
 
        nexthdr_off = protoff;
        tcph = skb_header_pointer(skb, nexthdr_off, sizeof(_tcph), &_tcph);
-       BUG_ON(!tcph);
+       if (!tcph)
+               return NF_ACCEPT;
+
        nexthdr_off += tcph->doff * 4;
        datalen = tcplen - tcph->doff * 4;
 

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 318b8f72334914fa2e93462244a4ad5206d07ec1..34e22416a7212087b603ed9475ab4febb9fbd3d5 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -338,7 +338,8 @@ static void tcp_options(const struct sk_buff *skb,
 
        ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
                                 length, buff);
-       BUG_ON(ptr == NULL);
+       if (!ptr)
+               return;
 
        state->td_scale =
        state->flags = 0;
@@ -394,7 +395,8 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
 
        ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
                                 length, buff);
-       BUG_ON(ptr == NULL);
+       if (!ptr)
+               return;
 
        /* Fast path for timestamp-only option */
        if (length == TCPOLEN_TSTAMP_ALIGNED

diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index 1aebd6569d4efbeb0bd6763defcde1dec829b165..fcb33b1d5456dd4548c24770f7dfeb8df68d5f56 100644 (file)
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -95,7 +95,10 @@ static int help(struct sk_buff *skb,
 
        spin_lock_bh(&nf_sane_lock);
        sb_ptr = skb_header_pointer(skb, dataoff, datalen, sane_buffer);
-       BUG_ON(sb_ptr == NULL);
+       if (!sb_ptr) {
+               spin_unlock_bh(&nf_sane_lock);
+               return NF_ACCEPT;
+       }
 
        if (dir == IP_CT_DIR_ORIGINAL) {
                if (datalen != sizeof(struct sane_request))