[Devel] [PATCH RHEL7 COMMIT] ms/netfilter: nf_nat: don't bug when mapping already exists

[Vasily Averin]

The commit is pushed to "branch-rh7-3.10.0-1160.11.1.vz7.172.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.11.1.vz7.172.11
------>
commit 130ec74bf606f33e501b1d38a55b3f1a4a544f3d
Author: Vasily Averin <vvs at virtuozzo.com>
Date:   Wed Feb 3 10:40:19 2021 +0300

    ms/netfilter: nf_nat: don't bug when mapping already exists
    
    It seems preferrable to limp along if we have a conflicting mapping,
    its certainly better than a BUG().
    
    Signed-off-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    (cherry picked from commit 75c2631468e8af554057246b2413e738dd96af3d)
    
    This patch fixes host crash during restart firewalld service
    https://jira.sw.ru/browse/PSBM-124668
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/netfilter/nf_nat_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 5a48480..790951c 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -402,7 +402,9 @@ nf_nat_setup_info(struct nf_conn *ct,
 
 	NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
 		     maniptype == NF_NAT_MANIP_DST);
-	BUG_ON(nf_nat_initialized(ct, maniptype));
+
+	if (WARN_ON(nf_nat_initialized(ct, maniptype)))
+		return NF_DROP;
 
 	/* What we've got will look like inverse of reply. Normally
 	 * this is what is in the conntrack, except for prior