Commit 5173bc67 authored Nov 23, 2016 by Florian Westphal Committed by Pablo Neira Ayuso Nov 24, 2016

netfilter: nat: fix crash when conntrack entry is re-used



Stas Nichiporovich reports oops in nf_nat_bysource_cmp(), trying to
access nf_conn struct at address 0xffffffffffffff50.

This is the result of fetching a null rhash list (struct embedded at
offset 176; 0 - 176 gets us ...fff50).

The problem is that conntrack entries are allocated from a
SLAB_DESTROY_BY_RCU cache, i.e. entries can be free'd and reused
on another cpu while nf nat bysource hash access the same conntrack entry.

Freeing is fine (we hold rcu read lock); zeroing rhlist_head isn't.

-> Move the rhlist struct outside of the memset()-inited area.

Fixes: 7c966435 ("netfilter: move nat hlist_head to nf_conn")
Reported-by: Stas Nichiporovich <stasn77@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 49cdc4c7

include/net/netfilter/nf_conntrack.h

+3 −3

Original line number	Diff line number	Diff line
		@@ -100,6 +100,9 @@ struct nf_conn {

		possible_net_t ct_net;

		#if IS_ENABLED(CONFIG_NF_NAT)
		struct rhlist_head nat_bysource;
		#endif
		/* all members below initialized via memset */
		u8 __nfct_init_offset[0];

		@@ -117,9 +120,6 @@ struct nf_conn {
		/* Extensions */
		struct nf_ct_ext *ext;

		#if IS_ENABLED(CONFIG_NF_NAT)
		struct rhlist_head nat_bysource;
		#endif
		/* Storage reserved for other modules, must be the last member */
		union nf_conntrack_proto proto;
		};