* [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments
[not found] <CANP3RGeX5=c=Lb+Pkg89zD7zQ_Z1T8oPJRCkorNCdghmofYXxg@mail.gmail.com>
@ 2018-10-23 14:47 ` Florian Westphal
2018-10-23 14:54 ` Eric Dumazet
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Florian Westphal @ 2018-10-23 14:47 UTC (permalink / raw)
To: netfilter-devel
Cc: lorenzo, zenczykowski, edumazet, netdev, maze, Florian Westphal
Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
not save/restore skb->dst.
This causes oops when handling locally generated ipv6 fragments, as
output path needs a valid dst.
Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Fixes: 84379c9afe01 ("netfilter: ipv6: nf_defrag: drop skb dst before queueing")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 8f68a518d9db..f76bd4d15704 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
*/
ret = -EINPROGRESS;
if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
- fq->q.meat == fq->q.len &&
- nf_ct_frag6_reasm(fq, skb, dev))
- ret = 0;
- else
+ fq->q.meat == fq->q.len) {
+ unsigned long orefdst = skb->_skb_refdst;
+
+ skb->_skb_refdst = 0UL;
+ if (nf_ct_frag6_reasm(fq, skb, dev))
+ ret = 0;
+ skb->_skb_refdst = orefdst;
+ } else {
skb_dst_drop(skb);
+ }
out_unlock:
spin_unlock_bh(&fq->q.lock);
--
2.18.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments
2018-10-23 14:47 ` [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments Florian Westphal
@ 2018-10-23 14:54 ` Eric Dumazet
2018-10-23 21:04 ` Maciej Żenczykowski
2018-10-25 8:18 ` Pablo Neira Ayuso
2 siblings, 0 replies; 5+ messages in thread
From: Eric Dumazet @ 2018-10-23 14:54 UTC (permalink / raw)
To: Florian Westphal
Cc: netfilter-devel, Lorenzo Colitti, zenczykowski, netdev,
Maciej Żenczykowski
On Tue, Oct 23, 2018 at 7:48 AM Florian Westphal <fw@strlen.de> wrote:
>
> Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
> not save/restore skb->dst.
>
> This causes oops when handling locally generated ipv6 fragments, as
> output path needs a valid dst.
>
> Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
> Fixes: 84379c9afe01 ("netfilter: ipv6: nf_defrag: drop skb dst before queueing")
> Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments
2018-10-23 14:47 ` [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments Florian Westphal
2018-10-23 14:54 ` Eric Dumazet
@ 2018-10-23 21:04 ` Maciej Żenczykowski
2018-10-23 22:04 ` Florian Westphal
2018-10-25 8:18 ` Pablo Neira Ayuso
2 siblings, 1 reply; 5+ messages in thread
From: Maciej Żenczykowski @ 2018-10-23 21:04 UTC (permalink / raw)
To: Florian Westphal
Cc: netfilter-devel, Lorenzo Colitti, Eric Dumazet, Linux NetDev
On Tue, Oct 23, 2018 at 7:47 AM, Florian Westphal <fw@strlen.de> wrote:
> Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
> not save/restore skb->dst.
>
> This causes oops when handling locally generated ipv6 fragments, as
> output path needs a valid dst.
>
> Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
> Fixes: 84379c9afe01 ("netfilter: ipv6: nf_defrag: drop skb dst before queueing")
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/ipv6/netfilter/nf_conntrack_reasm.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
> index 8f68a518d9db..f76bd4d15704 100644
> --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
> +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
> @@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
> */
> ret = -EINPROGRESS;
> if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> - fq->q.meat == fq->q.len &&
> - nf_ct_frag6_reasm(fq, skb, dev))
> - ret = 0;
> - else
> + fq->q.meat == fq->q.len) {
> + unsigned long orefdst = skb->_skb_refdst;
> +
> + skb->_skb_refdst = 0UL;
> + if (nf_ct_frag6_reasm(fq, skb, dev))
> + ret = 0;
> + skb->_skb_refdst = orefdst;
> + } else {
> skb_dst_drop(skb);
> + }
>
> out_unlock:
> spin_unlock_bh(&fq->q.lock);
> --
> 2.18.1
>
I don't quite follow how this fixes things, but I'll trust you on it.
(nor do I understand why only 4.9 LTS appears to crash with a null ptr deref)
Thanks for the fix.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments
2018-10-23 21:04 ` Maciej Żenczykowski
@ 2018-10-23 22:04 ` Florian Westphal
0 siblings, 0 replies; 5+ messages in thread
From: Florian Westphal @ 2018-10-23 22:04 UTC (permalink / raw)
To: Maciej Żenczykowski
Cc: Florian Westphal, netfilter-devel, Lorenzo Colitti, Eric Dumazet,
Linux NetDev
Maciej Żenczykowski <maze@google.com> wrote:
> > ret = -EINPROGRESS;
> > if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> > - fq->q.meat == fq->q.len &&
> > - nf_ct_frag6_reasm(fq, skb, dev))
> > - ret = 0;
> > - else
> > + fq->q.meat == fq->q.len) {
> > + unsigned long orefdst = skb->_skb_refdst;
> > +
> > + skb->_skb_refdst = 0UL;
> > + if (nf_ct_frag6_reasm(fq, skb, dev))
> > + ret = 0;
> > + skb->_skb_refdst = orefdst;
> > + } else {
> > skb_dst_drop(skb);
> > + }
> >
> > out_unlock:
> > spin_unlock_bh(&fq->q.lock);
> > --
> > 2.18.1
> >
>
> I don't quite follow how this fixes things, but I'll trust you on it.
The problematic spot is skb_morph() in nf_ct_frag6_reasm(), when we hit
this code path we take dst from a dst-less skb that got queued earlier.
> (nor do I understand why only 4.9 LTS appears to crash with a null ptr deref)
Newer kernels need nft or iptables rule that enables defrag, such as
"ip6tables -A INPUT -m conntrack --ctstate NEW"; 4.9 still enables it by
default.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments
2018-10-23 14:47 ` [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments Florian Westphal
2018-10-23 14:54 ` Eric Dumazet
2018-10-23 21:04 ` Maciej Żenczykowski
@ 2018-10-25 8:18 ` Pablo Neira Ayuso
2 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2018-10-25 8:18 UTC (permalink / raw)
To: Florian Westphal
Cc: netfilter-devel, lorenzo, zenczykowski, edumazet, netdev, maze
On Tue, Oct 23, 2018 at 04:47:16PM +0200, Florian Westphal wrote:
> Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
> not save/restore skb->dst.
>
> This causes oops when handling locally generated ipv6 fragments, as
> output path needs a valid dst.
Applied, thanks!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-10-25 8:18 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CANP3RGeX5=c=Lb+Pkg89zD7zQ_Z1T8oPJRCkorNCdghmofYXxg@mail.gmail.com>
2018-10-23 14:47 ` [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments Florian Westphal
2018-10-23 14:54 ` Eric Dumazet
2018-10-23 21:04 ` Maciej Żenczykowski
2018-10-23 22:04 ` Florian Westphal
2018-10-25 8:18 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).