lkml.org 
[lkml]   [2018]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 40/66] netfilter: ipv6: nf_defrag: drop skb dst before queueing
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Westphal <fw@strlen.de>

    commit 84379c9afe011020e797e3f50a662b08a6355dcf upstream.

    Eric Dumazet reports:
    Here is a reproducer of an annoying bug detected by syzkaller on our production kernel
    [..]
    ./b78305423 enable_conntrack
    Then :
    sleep 60
    dmesg | tail -10
    [ 171.599093] unregister_netdevice: waiting for lo to become free. Usage count = 2
    [ 181.631024] unregister_netdevice: waiting for lo to become free. Usage count = 2
    [ 191.687076] unregister_netdevice: waiting for lo to become free. Usage count = 2
    [ 201.703037] unregister_netdevice: waiting for lo to become free. Usage count = 2
    [ 211.711072] unregister_netdevice: waiting for lo to become free. Usage count = 2
    [ 221.959070] unregister_netdevice: waiting for lo to become free. Usage count = 2

    Reproducer sends ipv6 fragment that hits nfct defrag via LOCAL_OUT hook.
    skb gets queued until frag timer expiry -- 1 minute.

    Normally nf_conntrack_reasm gets called during prerouting, so skb has
    no dst yet which might explain why this wasn't spotted earlier.

    Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
    Reported-by: John Sperbeck <jsperbeck@google.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Tested-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/ipv6/netfilter/nf_conntrack_reasm.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
    +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
    @@ -618,6 +618,8 @@ int nf_ct_frag6_gather(struct net *net,
    fq->q.meat == fq->q.len &&
    nf_ct_frag6_reasm(fq, skb, dev))
    ret = 0;
    + else
    + skb_dst_drop(skb);

    out_unlock:
    spin_unlock_bh(&fq->q.lock);

    \
     
     \ /
      Last update: 2018-07-20 14:57    [W:4.705 / U:0.576 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site