Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c8ec910 authored by Patrick McHardy's avatar Patrick McHardy
Browse files

netfilter: nf_conntrack: fix confirmation race condition 



New connection tracking entries are inserted into the hash before they
are fully set up, namely the CONFIRMED bit is not set and the timer not
started yet. This can theoretically lead to a race with timer, which
would set the timeout value to a relative value, most likely already in
the past.

Perform hash insertion as the final step to fix this.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 8cc20198

net/netfilter/nf_conntrack_core.c

+8 −1
Original line number Diff line number Diff line
@@ -425,7 +425,6 @@ __nf_conntrack_confirm(struct sk_buff *skb) 
	/* Remove from unconfirmed list */

	hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);



	__nf_conntrack_hash_insert(ct, hash, repl_hash);

	/* Timer relative to confirmation time, not original

	   setting time, otherwise we'd get timer wrap in

	   weird delay cases. */
@@ -433,8 +432,16 @@ __nf_conntrack_confirm(struct sk_buff *skb) 
	add_timer(&ct->timeout);

	atomic_inc(&ct->ct_general.use);

	set_bit(IPS_CONFIRMED_BIT, &ct->status);



	/* Since the lookup is lockless, hash insertion must be done after

	 * starting the timer and setting the CONFIRMED bit. The RCU barriers

	 * guarantee that no other CPU can find the conntrack before the above

	 * stores are visible.

	 */

	__nf_conntrack_hash_insert(ct, hash, repl_hash);

	NF_CT_STAT_INC(net, insert);

	spin_unlock_bh(&nf_conntrack_lock);



	help = nfct_help(ct);

	if (help && help->helper)

		nf_conntrack_event_cache(IPCT_HELPER, ct);