summaryrefslogtreecommitdiff
path: root/net/decnet/netfilter
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2017-07-26 01:02:34 +0300
committerPablo Neira Ayuso <pablo@netfilter.org>2017-07-31 20:09:39 +0300
commit5da773a3e81e6093c4346ee8cd356fc214d7c76c (patch)
treeabe10a96daae1bd4a58e045771a9ebb74714c0f1 /net/decnet/netfilter
parente2a750070aeec7af3818065b39d61cb38627ce64 (diff)
downloadlinux-5da773a3e81e6093c4346ee8cd356fc214d7c76c.tar.xz
netfilter: nfnetlink_queue: don't queue dying conntracks to userspace
When skb is queued to userspace it leaves softirq/rcu protection. skb->nfct (via conntrack extensions such as helper) could then reference modules that no longer exist if the conntrack was not yet confirmed. nf_ct_iterate_destroy() will set the DYING bit for unconfirmed conntracks, we therefore solve this race as follows: 1. take the queue spinlock. 2. check if the conntrack is unconfirmed and has dying bit set. In this case, we must discard skb while we're still inside rcu read-side section. 3. If nf_ct_iterate_destroy() is called right after the packet is queued to userspace, it will be removed from the queue via nf_ct_iterate_destroy -> nf_queue_nf_hook_drop. When userspace sends the verdict (nfnetlink takes rcu read lock), there are two cases to consider: 1. nf_ct_iterate_destroy() was called while packet was out. In this case, skb will have been removed from the queue already and no reinject takes place as we won't find a matching entry for the packet id. 2. nf_ct_iterate_destroy() gets called right after verdict callback found and removed the skb from queue list. In this case, skb->nfct is marked as dying but it is still valid. The skb will be dropped either in nf_conntrack_confirm (we don't insert DYING conntracks into hash table) or when we try to queue the skb again, but either events don't occur before the rcu read lock is dropped. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/decnet/netfilter')
0 files changed, 0 insertions, 0 deletions