From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0330CC4332D for ; Thu, 19 Mar 2020 16:41:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CB7562070A for ; Thu, 19 Mar 2020 16:41:06 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="M5htu4nf" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727928AbgCSQlF (ORCPT ); Thu, 19 Mar 2020 12:41:05 -0400 Received: from mail-pl1-f194.google.com ([209.85.214.194]:44113 "EHLO mail-pl1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727877AbgCSQlE (ORCPT ); Thu, 19 Mar 2020 12:41:04 -0400 Received: by mail-pl1-f194.google.com with SMTP id h11so1275735plr.11; Thu, 19 Mar 2020 09:41:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=N+kUskOEAztsUSeY3dZT12vj2Ojdgoxn5lGNikj9z1U=; b=M5htu4nft5Wl6IcM9YkoOY+berCLoHv2KhBl4yrj1LNzgifwMLJSrdni4h36LM/3lz GpAJ5ITg6czoojg096Uk2x+lYbOv5TXYJB7cJ2e2r5YrBenRBz4ffpmtZW7bhsnnnOu8 aTLLEiWr0fX2lRMHNEiflHuRhpMHBLZ+tmh5iGsVTcnv1JupoQ3UeDx6uVi2lUKv03ey KUQ3+6RG+3/hWTsXmjzqKyLi/Yv+qwOJJjNHxwWI7flOzjDo8meaPSU9Tv4HMbEvq47j +R/0JATKjdKC4FeQh92+4OnQce9B5jw3jO2fjWVNvqxWQ0WjX9nawSf0u8ZisB92IE76 Zpmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=N+kUskOEAztsUSeY3dZT12vj2Ojdgoxn5lGNikj9z1U=; b=qYPwbxd1NetK822UJY+37f9H4qTQzkwfB+TPZfsnIS6zkrkZBwDmv6CbW/Muxk3EEg idiOHfD3EQJP4zr3k7M1foUmgwzwz56HDyaIl3bwPUsCerQqbfhKO7we1x13Y/NISsr/ CHF2vhUb7iIuSi1A70Yx6qoeo28E4H5VSi4bHtNb6Y92rOnJHqcrV9t/rX6OvKB3Gjcn bhEEPzUfBExvGrcCV4FwqQjovCOwR3Jdv2zgH5jdXJD6MoaEthsFBCq7K2CoyV4Bdm9f j7qOO72R1p7qbMDtfaZbbcCcJeQdKBQzaY/ZxOwGMuGEkSJanGkKikNUYnE02Xr9W8Ks Ca2g== X-Gm-Message-State: ANhLgQ2AwT+KMokiDRxX8FOREn2iPK4zOFJj15yioubzRRCW+88GAc4r RNOse8DtDGzbEZuJCqQp21mw1z+f X-Google-Smtp-Source: ADFU+vuFp5ZNwIXfJTevssPDNf3T8CH3AaNlm9oYHgHSdzLv5seXgCry8wf8JOaObTMCI+Lt2p3iyA== X-Received: by 2002:a17:902:eb49:: with SMTP id i9mr4148743pli.91.1584636063110; Thu, 19 Mar 2020 09:41:03 -0700 (PDT) Received: from [192.168.86.235] (c-73-241-150-58.hsd1.ca.comcast.net. [73.241.150.58]) by smtp.gmail.com with ESMTPSA id y18sm3008136pge.73.2020.03.19.09.41.00 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 19 Mar 2020 09:41:02 -0700 (PDT) Subject: Re: Bug URGENT Report with new kernel 5.5.10-5.6-rc6 To: Florian Westphal , Pablo Neira Ayuso Cc: Martin Zaharinov , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org References: <20200319003823.3b709ad8@elisabeth> <20200319103438.GO979@breakpoint.cc> <20200319104750.x2zz7negjbm6lwch@salvia> <20200319105248.GP979@breakpoint.cc> From: Eric Dumazet Message-ID: Date: Thu, 19 Mar 2020 09:40:59 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0 MIME-Version: 1.0 In-Reply-To: <20200319105248.GP979@breakpoint.cc> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org On 3/19/20 3:52 AM, Florian Westphal wrote: > Pablo Neira Ayuso wrote: >> On Thu, Mar 19, 2020 at 11:34:38AM +0100, Florian Westphal wrote: >>> Martin Zaharinov wrote: >>> >>> [ trimming CC ] >>> >>> Please revert >>> >>> commit 28f8bfd1ac948403ebd5c8070ae1e25421560059 >>> netfilter: Support iif matches in POSTROUTING >> >> Please, specify a short description to append to the revert. > > TCP makes use of the rb_node in sk_buff for its retransmit queue, > amongst others. Only for master skbs kept in TCP internal queues (rtx rb tree) However the packets leaving TCP stack are clones. skb->dev aliases to this storage, i.e., passing > skb->dev as the input interface in postrouting may point to another > sk_buff instead. > This will cause crashes and data corruption with nf_queue, as we will > attempt to increment a random pcpu variable when calling dev_hold(). > > Also, the memory address may also be free'd, which gives UAF splat. > This seems to suggest clones skb->dev should be cleared before leaving TCP stack, if some layer is confused because skb->dev has not yet been set by IP layer ? Untested patch : diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 306e25d743e8de1bfe23d6e3b3a9fb0f23664912..c40fb3880307aa3156d01a8b49f1296657346cfd 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1228,6 +1228,7 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, /* Cleanup our debris for IP stacks */ memset(skb->cb, 0, max(sizeof(struct inet_skb_parm), sizeof(struct inet6_skb_parm))); + skb->dev = NULL; tcp_add_tx_delay(skb, tp);