Commit b47aae70 authored May 04, 2023 by Florian Westphal Committed by Greg Kroah-Hartman May 30, 2023

netfilter: conntrack: fix possible bug_on with enable_hooks=1



[ Upstream commit e72eeab542dbf4f544e389e64fa13b82a1b6d003 ]

I received a bug report (no reproducer so far) where we trip over

712         rcu_read_lock();
713         ct_hook = rcu_dereference(nf_ct_hook);
714         BUG_ON(ct_hook == NULL);  // here

In nf_conntrack_destroy().

First turn this BUG_ON into a WARN.  I think it was triggered
via enable_hooks=1 flag.

When this flag is turned on, the conntrack hooks are registered
before nf_ct_hook pointer gets assigned.
This opens a short window where packets enter the conntrack machinery,
can have skb->_nfct set up and a subsequent kfree_skb might occur
before nf_ct_hook is set.

Call nf_conntrack_init_end() to set nf_ct_hook before we register the
pernet ops.

Fixes: ba3fbe66 ("netfilter: nf_conntrack: provide modparam to always register conntrack hooks")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent d7343f8d

net/netfilter/core.c

+4 −2

Original line number	Original line	Diff line number	Diff line
	@@ -577,9 +577,11 @@ void nf_conntrack_destroy(struct nf_conntrack *nfct)

	rcu_read_lock();		rcu_read_lock();
	ct_hook = rcu_dereference(nf_ct_hook);		ct_hook = rcu_dereference(nf_ct_hook);
	BUG_ON(ct_hook == NULL);		if (ct_hook)
	ct_hook->destroy(nfct);		ct_hook->destroy(nfct);
	rcu_read_unlock();		rcu_read_unlock();

			WARN_ON(!ct_hook);
	}		}
	EXPORT_SYMBOL(nf_conntrack_destroy);		EXPORT_SYMBOL(nf_conntrack_destroy);

net/netfilter/nf_conntrack_standalone.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1180,11 +1180,12 @@ static int __init nf_conntrack_standalone_init(void)
	nf_conntrack_htable_size_user = nf_conntrack_htable_size;		nf_conntrack_htable_size_user = nf_conntrack_htable_size;
	#endif		#endif

			nf_conntrack_init_end();

	ret = register_pernet_subsys(&nf_conntrack_net_ops);		ret = register_pernet_subsys(&nf_conntrack_net_ops);
	if (ret < 0)		if (ret < 0)
	goto out_pernet;		goto out_pernet;

	nf_conntrack_init_end();
	return 0;		return 0;

	out_pernet:		out_pernet: