Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43612d7c authored by Pablo Neira's avatar Pablo Neira Committed by David S. Miller
Browse files

Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse" 



This reverts commit 5195c14c.

If the conntrack clashes with an existing one, it is left out of
the unconfirmed list, thus, crashing when dropping the packet and
releasing the conntrack since golden rule is that conntracks are
always placed in any of the existing lists for traceability reasons.

Reported-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=88841


Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 814f7d11

net/netfilter/nf_conntrack_core.c

+6 −8
Original line number Original line Diff line number Diff line
@@ -611,16 +611,12 @@ __nf_conntrack_confirm(struct sk_buff *skb) 
	 */

	 */

	NF_CT_ASSERT(!nf_ct_is_confirmed(ct));

	NF_CT_ASSERT(!nf_ct_is_confirmed(ct));

	pr_debug("Confirming conntrack %p\n", ct);

	pr_debug("Confirming conntrack %p\n", ct);



	/* We have to check the DYING flag inside the lock to prevent

	/* We have to check the DYING flag after unlink to prevent

	   a race against nf_ct_get_next_corpse() possibly called from

	 * a race against nf_ct_get_next_corpse() possibly called from

	   user context, else we insert an already 'dead' hash, blocking

	 * user context, else we insert an already 'dead' hash, blocking

	   further use of that particular connection -JM */

	 * further use of that particular connection -JM.

	 */

	nf_ct_del_from_dying_or_unconfirmed_list(ct);





	if (unlikely(nf_ct_is_dying(ct))) {

	if (unlikely(nf_ct_is_dying(ct))) {

		nf_ct_add_to_dying_list(ct);

		nf_conntrack_double_unlock(hash, reply_hash);

		nf_conntrack_double_unlock(hash, reply_hash);

		local_bh_enable();

		local_bh_enable();

		return NF_ACCEPT;

		return NF_ACCEPT;
@@ -640,6 +636,8 @@ __nf_conntrack_confirm(struct sk_buff *skb) 
		    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))

		    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))

			goto out;

			goto out;





	nf_ct_del_from_dying_or_unconfirmed_list(ct);



	/* Timer relative to confirmation time, not original

	/* Timer relative to confirmation time, not original

	   setting time, otherwise we'd get timer wrap in

	   setting time, otherwise we'd get timer wrap in

	   weird delay cases. */

	   weird delay cases. */