Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0ff90b6c authored by Felix Fietkau's avatar Felix Fietkau Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_flow_offload: fix use-after-free and a resource leak 



flow_offload_del frees the flow, so all associated resource must be
freed before.

Since the ct entry in struct flow_offload_entry was allocated by
flow_offload_alloc, it should be freed by flow_offload_free to take care
of the error handling path when flow_offload_add fails.

While at it, make flow_offload_del static, since it should never be
called directly, only from the gc step

Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d8ed9600

include/net/netfilter/nf_flow_table.h

+0 −1
Original line number Diff line number Diff line
@@ -90,7 +90,6 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct, 
void flow_offload_free(struct flow_offload *flow);



int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);

void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow);

struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,

						     struct flow_offload_tuple *tuple);

int nf_flow_table_iterate(struct nf_flowtable *flow_table,

net/netfilter/nf_flow_table.c

+7 −20
Original line number Diff line number Diff line
@@ -125,7 +125,9 @@ void flow_offload_free(struct flow_offload *flow) 
	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);

	dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);

	e = container_of(flow, struct flow_offload_entry, flow);

	kfree(e);

	nf_ct_delete(e->ct, 0, 0);

	nf_ct_put(e->ct);

	kfree_rcu(e, rcu_head);

}

EXPORT_SYMBOL_GPL(flow_offload_free);
@@ -149,11 +151,9 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) 
}

EXPORT_SYMBOL_GPL(flow_offload_add);



void flow_offload_del(struct nf_flowtable *flow_table,

static void flow_offload_del(struct nf_flowtable *flow_table,

			     struct flow_offload *flow)

{

	struct flow_offload_entry *e;



	rhashtable_remove_fast(&flow_table->rhashtable,

			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,

			       *flow_table->type->params);
@@ -161,10 +161,8 @@ void flow_offload_del(struct nf_flowtable *flow_table, 
			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,

			       *flow_table->type->params);



	e = container_of(flow, struct flow_offload_entry, flow);

	kfree_rcu(e, rcu_head);

	flow_offload_free(flow);

}

EXPORT_SYMBOL_GPL(flow_offload_del);



struct flow_offload_tuple_rhash *

flow_offload_lookup(struct nf_flowtable *flow_table,
@@ -175,15 +173,6 @@ flow_offload_lookup(struct nf_flowtable *flow_table, 
}

EXPORT_SYMBOL_GPL(flow_offload_lookup);



static void nf_flow_release_ct(const struct flow_offload *flow)

{

	struct flow_offload_entry *e;



	e = container_of(flow, struct flow_offload_entry, flow);

	nf_ct_delete(e->ct, 0, 0);

	nf_ct_put(e->ct);

}



int nf_flow_table_iterate(struct nf_flowtable *flow_table,

			  void (*iter)(struct flow_offload *flow, void *data),

			  void *data)
@@ -259,10 +248,8 @@ static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table) 
		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);



		if (nf_flow_has_expired(flow) ||

		    nf_flow_is_dying(flow)) {

		    nf_flow_is_dying(flow))

			flow_offload_del(flow_table, flow);

			nf_flow_release_ct(flow);

		}

	}

out:

	rhashtable_walk_stop(&hti);