renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-16 17:23:55 +08:00
Code

netfilter: conntrack: fix possible bug_on with enable_hooks=1

Browse Source 
I received a bug report (no reproducer so far) where we trip over

712         rcu_read_lock();
713         ct_hook = rcu_dereference(nf_ct_hook);
714         BUG_ON(ct_hook == NULL);  // here

In nf_conntrack_destroy().

First turn this BUG_ON into a WARN.  I think it was triggered
via enable_hooks=1 flag.

When this flag is turned on, the conntrack hooks are registered
before nf_ct_hook pointer gets assigned.
This opens a short window where packets enter the conntrack machinery,
can have skb->_nfct set up and a subsequent kfree_skb might occur
before nf_ct_hook is set.

Call nf_conntrack_init_end() to set nf_ct_hook before we register the
pernet ops.

Fixes: ba3fbe6636 ("netfilter: nf_conntrack: provide modparam to always register conntrack hooks")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2023-05-04 14:55:02 +02:00 committed by Pablo Neira Ayuso
parent dc1c9fd4a8
commit e72eeab542
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/netfilter/core.c
View File

@ -711,9 +711,11 @@ void nf_conntrack_destroy(struct nf_conntrack *nfct)
rcu_read_lock(); rcu_read_lock();
ct_hook = rcu_dereference(nf_ct_hook); ct_hook = rcu_dereference(nf_ct_hook);
BUG_ON(ct_hook == NULL); if (ct_hook)
ct_hook->destroy(nfct); ct_hook->destroy(nfct);
rcu_read_unlock(); rcu_read_unlock();
WARN_ON(!ct_hook);
} }
EXPORT_SYMBOL(nf_conntrack_destroy); EXPORT_SYMBOL(nf_conntrack_destroy);

3
net/netfilter/nf_conntrack_standalone.c
View File

@ -1218,11 +1218,12 @@ static int __init nf_conntrack_standalone_init(void)
nf_conntrack_htable_size_user = nf_conntrack_htable_size; nf_conntrack_htable_size_user = nf_conntrack_htable_size;
#endif #endif
nf_conntrack_init_end();
ret = register_pernet_subsys(&nf_conntrack_net_ops); ret = register_pernet_subsys(&nf_conntrack_net_ops);
if (ret < 0) if (ret < 0)
goto out_pernet; goto out_pernet;
nf_conntrack_init_end();
return 0; return 0;
out_pernet: out_pernet: