Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43c25da4 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_queue: fix possible use-after-free 



commit c3873070247d9e3c7a6b0cf9bf9b45e8018427b1 upstream.

Eric Dumazet says:
  The sock_hold() side seems suspect, because there is no guarantee
  that sk_refcnt is not already 0.

On failure, we cannot queue the packet and need to indicate an
error.  The packet will be dropped by the caller.

v2: split skb prefetch hunk into separate change

Fixes: 271b72c7 ("udp: RCU handling for Unicast packets.")
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3c934f10

include/net/netfilter/nf_queue.h

+1 −1
Original line number Diff line number Diff line
@@ -34,7 +34,7 @@ void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *q 
void nf_unregister_queue_handler(struct net *net);

void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);



void nf_queue_entry_get_refs(struct nf_queue_entry *entry);

bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);

void nf_queue_entry_release_refs(struct nf_queue_entry *entry);



static inline void init_hashrandom(u32 *jhash_initval)

net/netfilter/nf_queue.c

+9 −4
Original line number Diff line number Diff line
@@ -108,18 +108,20 @@ static void nf_queue_entry_get_br_nf_refs(struct sk_buff *skb) 
}



/* Bump dev refs so they don't vanish while packet is out */

void nf_queue_entry_get_refs(struct nf_queue_entry *entry)

bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)

{

	struct nf_hook_state *state = &entry->state;



	if (state->sk && !refcount_inc_not_zero(&state->sk->sk_refcnt))

		return false;



	if (state->in)

		dev_hold(state->in);

	if (state->out)

		dev_hold(state->out);

	if (state->sk)

		sock_hold(state->sk);



	nf_queue_entry_get_br_nf_refs(entry->skb);

	return true;

}

EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
@@ -210,7 +212,10 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, 
		.size	= sizeof(*entry) + route_key_size,

	};



	nf_queue_entry_get_refs(entry);

	if (!nf_queue_entry_get_refs(entry)) {

		kfree(entry);

		return -ENOTCONN;

	}



	switch (entry->state.pf) {

	case AF_INET:

net/netfilter/nfnetlink_queue.c

+9 −3
Original line number Diff line number Diff line
@@ -712,9 +712,15 @@ static struct nf_queue_entry * 
nf_queue_entry_dup(struct nf_queue_entry *e)

{

	struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);

	if (entry)

		nf_queue_entry_get_refs(entry);



	if (!entry)

		return NULL;



	if (nf_queue_entry_get_refs(entry))

		return entry;



	kfree(entry);

	return NULL;

}



#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)