mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 04:47:05 +00:00
netfilter: conntrack: re-fetch conntrack after insertion
commit56b14ecec9
upstream. In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger. Reported-by: <syzbot+793a590957d9c1b96620@syzkaller.appspotmail.com> Fixes:71d8c47fc6
("netfilter: conntrack: introduce clash resolution on insertion race") Fixes:2ad9d7747c
("netfilter: conntrack: free extension area immediately") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
98e0c7c702
commit
e97222b785
1 changed files with 6 additions and 1 deletions
|
@ -67,8 +67,13 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
|
|||
int ret = NF_ACCEPT;
|
||||
|
||||
if (ct) {
|
||||
if (!nf_ct_is_confirmed(ct))
|
||||
if (!nf_ct_is_confirmed(ct)) {
|
||||
ret = __nf_conntrack_confirm(skb);
|
||||
|
||||
if (ret == NF_ACCEPT)
|
||||
ct = (struct nf_conn *)skb_nfct(skb);
|
||||
}
|
||||
|
||||
if (likely(ret == NF_ACCEPT))
|
||||
nf_ct_deliver_cached_events(ct);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue