mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
92ceba94de6fb4cee2bf40b485979c342f44a492
linux/net/ipv4
History
Eric Dumazet 92ceba94de netfilter: nf_tables: prevent nf_skb_duplicated corruption 
syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write
per-cpu variable nf_skb_duplicated in an unsafe way [1].

Disabling preemption as hinted by the splat is not enough,
we have to disable soft interrupts as well.

[1]
BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316
 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87
CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
 <TASK>
  __dump_stack lib/dump_stack.c:93 [inline]
  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
  check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49
  nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87
  nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30
  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
  nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288
  nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23
  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
  nf_hook+0x2c4/0x450 include/linux/netfilter.h:269
  NF_HOOK_COND include/linux/netfilter.h:302 [inline]
  ip_output+0x185/0x230 net/ipv4/ip_output.c:433
  ip_local_out net/ipv4/ip_output.c:129 [inline]
  ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495
  udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981
  udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg+0x1a6/0x270 net/socket.c:745
  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597
  ___sys_sendmsg net/socket.c:2651 [inline]
  __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737
  __do_sys_sendmmsg net/socket.c:2766 [inline]
  __se_sys_sendmmsg net/socket.c:2763 [inline]
  __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4ce4f7def9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9
RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006
RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68
 </TASK>

Fixes: d877f07112 ("netfilter: nf_tables: add nft_dup expression")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2024-09-27 13:55:46 +02:00
..
netfilter
netfilter: nf_tables: prevent nf_skb_duplicated corruption
2024-09-27 13:55:46 +02:00
af_inet.c
net: gro: initialize network_offset in network layer
2024-05-27 16:46:59 -07:00
ah4.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00
arp.c
arp: Convert ioctl(SIOCGARP) to RCU.
2024-05-01 18:37:07 -07:00
bpf_tcp_ca.c
bpf: pass bpf_struct_ops_link to callbacks in bpf_struct_ops.
2024-05-30 15:34:13 -07:00
cipso_ipv4.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-06-20 13:49:59 -07:00
datagram.c
ipv4: Set the routing scope properly in ip_route_output_ports().
2024-02-12 17:33:05 -08:00
devinet.c
ipv4: delete redundant judgment statements
2024-08-23 14:27:45 +01:00
esp4_offload.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-07-15 13:19:17 -07:00
esp4.c
net: support non paged skb frags
2024-09-11 20:44:31 -07:00
fib_frontend.c
ipv4: Unmask upper DSCP bits in fib_compute_spec_dst()
2024-08-22 16:59:57 -07:00
fib_lookup.h
…
fib_notifier.c
…
fib_rules.c
ipv4: fib_rules: Add DSCP selector support
2024-09-13 21:15:44 -07:00
fib_semantics.c
ipv4: delete redundant judgment statements
2024-08-23 14:27:45 +01:00
fib_trie.c
ipv4: Centralize TOS matching
2024-08-20 14:57:08 +02:00
fou_bpf.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
fou_core.c
fou: fix initialization of grc
2024-09-09 17:21:47 -07:00
fou_nl.c
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
fou_nl.h
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
gre_demux.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
gre_offload.c
net: gro: rename skb_gro_header_hard()
2024-03-05 13:30:11 +01:00
icmp.c
ipv4: icmp: Unmask upper DSCP bits in icmp_reply()
2024-09-09 14:14:53 +01:00
igmp.c
ipv4: Set scope explicitly in ip_route_output().
2024-04-08 13:20:51 +01:00
inet_connection_sock.c
net/ipv4: fix macro definition sk_for_each_bound_bhash
2024-08-26 14:04:25 -07:00
inet_diag.c
tcp: remove volatile qualifier on tw_substate
2024-08-28 17:08:16 -07:00
inet_fragment.c
net: Rename mono_delivery_time to tstamp_type for scalabilty
2024-05-23 14:14:23 -07:00
inet_hashtables.c
inet: constify 'struct net' parameter of various lookup helpers
2024-08-05 16:22:45 -07:00
inet_timewait_sock.c
tcp: move inet_twsk_schedule helper out of header
2024-06-10 11:54:18 +01:00
inetpeer.c
net: ipv4: Simplify the allocation of slab caches in inet_initpeers
2024-01-31 16:39:42 -08:00
ip_forward.c
net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check
2023-10-13 09:58:45 -07:00
ip_fragment.c
net: Rename mono_delivery_time to tstamp_type for scalabilty
2024-05-23 14:14:23 -07:00
ip_gre.c
ipv4: ip_gre: Unmask upper DSCP bits in ipgre_open()
2024-09-09 14:14:52 +01:00
ip_input.c
net/ipv4: make use of the helper macro LIST_HEAD()
2024-09-06 18:10:21 -07:00
ip_options.c
…
ip_output.c
ipv4: Unmask upper DSCP bits in __ip_queue_xmit()
2024-09-04 16:57:11 -07:00
ip_sockglue.c
inet: Add getsockopt support for IP_ROUTER_ALERT and IPV6_ROUTER_ALERT
2024-03-06 12:37:06 +00:00
ip_tunnel_core.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
ip_tunnel.c
ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
2024-09-09 14:14:53 +01:00
ip_vti.c
netdev_features: convert NETIF_F_LLTX to dev->lltx
2024-09-03 11:36:43 +02:00
ipcomp.c
xfrm: ipcomp: add extack to ipcomp{4,6}_init_state
2022-09-29 07:18:00 +02:00
ipconfig.c
net: ipconfig: move ic_nameservers_fallback into #ifdef block
2023-05-22 11:17:55 +01:00
ipip.c
netdev_features: convert NETIF_F_LLTX to dev->lltx
2024-09-03 11:36:43 +02:00
ipmr_base.c
…
ipmr.c
ipv4: ipmr: Unmask upper DSCP bits in ipmr_queue_xmit()
2024-09-04 16:57:11 -07:00
Kconfig
net/tcp: Expand goo.gl link
2024-07-30 18:35:12 -07:00
Makefile
bpfilter: remove bpfilter
2024-01-04 10:23:10 -08:00
metrics.c
net: remove NULL-pointer net parameter in ip_metrics_convert
2024-06-05 10:06:00 +01:00
netfilter.c
ipv4: netfilter: Unmask upper DSCP bits in ip_route_me_harder()
2024-09-09 14:14:53 +01:00
netlink.c
…
nexthop.c
net: nexthop: delete redundant judgment statements
2024-08-23 14:27:45 +01:00
ping.c
ping: use sk_skb_reason_drop to free rx packets
2024-06-19 12:44:22 +01:00
proc.c
minmax: add a few more MIN_T/MAX_T users
2024-07-28 13:41:14 -07:00
protocol.c
…
raw_diag.c
inet_diag: add module pointer to "struct inet_diag_handler"
2024-01-23 15:13:54 +01:00
raw.c
net: raw: use sk_skb_reason_drop to free rx packets
2024-06-19 12:44:22 +01:00
route.c
ipv4: Unmask upper DSCP bits when building flow key
2024-08-31 17:44:51 +01:00
syncookies.c
tcp: use sk_skb_reason_drop to free rx packets
2024-06-19 12:44:22 +01:00
sysctl_net_ipv4.c
icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns
2024-08-30 11:14:06 -07:00
tcp_ao.c
net/tcp: Disable TCP-AO static key after RCU grace period
2024-08-04 13:21:50 +01:00
tcp_bbr.c
tcp: Add new args for cong_control in tcp_congestion_ops
2024-05-02 16:26:56 -07:00
tcp_bic.c
…
tcp_bpf.c
Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2024-09-12 20:22:44 -07:00
tcp_cdg.c
Merge tag 'random-6.1-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random
2022-10-16 15:27:07 -07:00
tcp_cong.c
tcp: Replace strncpy() with strscpy()
2024-07-16 07:52:15 -07:00
tcp_cubic.c
bpf: Remove CONFIG_X86 and CONFIG_DYNAMIC_FTRACE guard from the tcp-cc kfuncs
2024-03-28 18:31:40 -07:00
tcp_dctcp.c
tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
2024-05-21 13:34:50 +02:00
tcp_dctcp.h
…
tcp_diag.c
inet_diag: add module pointer to "struct inet_diag_handler"
2024-01-23 15:13:54 +01:00
tcp_fastopen.c
net: use unrcu_pointer() helper
2024-06-06 11:52:52 +02:00
tcp_highspeed.c
…
tcp_htcp.c
tcp: Use clamp() in htcp_alpha_update()
2024-08-06 12:16:25 -07:00
tcp_hybla.c
…
tcp_illinois.c
…
tcp_input.c
net: add support for skbs with unreadable frags
2024-09-11 20:44:31 -07:00
tcp_ipv4.c
tcp: RX path for devmem TCP
2024-09-11 20:44:32 -07:00
tcp_lp.c
tcp: rename tcp_time_stamp() to tcp_time_stamp_ts()
2023-10-23 09:35:01 +01:00
tcp_metrics.c
tcp_metrics: use netlink policy for IPv6 addr len validation
2024-08-19 17:42:57 -07:00
tcp_minisocks.c
tcp: RX path for devmem TCP
2024-09-11 20:44:32 -07:00
tcp_nv.c
…
tcp_offload.c
net: drop bad gso csum_start and offset in virtio_net_hdr
2024-07-30 18:34:13 -07:00
tcp_output.c
net: add support for skbs with unreadable frags
2024-09-11 20:44:31 -07:00
tcp_plb.c
prandom: remove prandom_u32_max()
2022-12-20 03:13:45 +01:00
tcp_rate.c
…
tcp_recovery.c
tcp: fix excessive TLP and RACK timeouts from HZ rounding
2023-10-17 17:25:42 -07:00
tcp_scalable.c
…
tcp_sigpool.c
net/tcp_sigpool: Use nested-BH locking for sigpool_scratch.
2024-06-24 16:41:22 -07:00
tcp_timer.c
mptcp: fallback to TCP after SYN+MPC drops
2024-09-11 15:57:50 -07:00
tcp_ulp.c
net/ulp: use consistent error code when blocking ULP
2023-01-19 09:26:16 -08:00
tcp_vegas.c
…
tcp_vegas.h
…
tcp_veno.c
…
tcp_westwood.c
…
tcp_yeah.c
…
tcp.c
tcp: RX path for devmem TCP
2024-09-11 20:44:32 -07:00
tunnel4.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00
udp_bpf.c
bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
2023-03-03 17:25:15 +01:00
udp_diag.c
inet_diag: add module pointer to "struct inet_diag_handler"
2024-01-23 15:13:54 +01:00
udp_impl.h
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
udp_offload.c
udp: fix receiving fraglist GSO packets
2024-08-21 17:15:05 -07:00
udp_tunnel_core.c
ipv4: udp_tunnel: Unmask upper DSCP bits in udp_tunnel_dst_lookup()
2024-09-09 14:14:53 +01:00
udp_tunnel_nic.c
udp_tunnel: Use flex array to simplify code
2023-10-03 11:39:34 +02:00
udp_tunnel_stub.c
…
udp.c
ipv4: udp: Unmask upper DSCP bits during early demux
2024-08-22 16:59:58 -07:00
udplite.c
udplite: remove UDPLITE_BIT
2023-09-14 16:16:36 +02:00
xfrm4_input.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-09 10:01:01 -07:00
xfrm4_output.c
…
xfrm4_policy.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
xfrm4_protocol.c
…
xfrm4_state.c
…
xfrm4_tunnel.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00