mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
![Pablo Neira Ayuso](/assets/img/avatar_default.png)
With this patch, the conntrack refcount is initially set to zero and it is bumped once it is added to any of the list, so we fulfill Eric's golden rule which is that all released objects always have a refcount that equals zero. Andrey Vagin reports that nf_conntrack_free can't be called for a conntrack with non-zero ref-counter, because it can race with nf_conntrack_find_get(). A conntrack slab is created with SLAB_DESTROY_BY_RCU. Non-zero ref-counter says that this conntrack is used. So when we release a conntrack with non-zero counter, we break this assumption. CPU1 CPU2 ____nf_conntrack_find() nf_ct_put() destroy_conntrack() ... init_conntrack __nf_conntrack_alloc (set use = 1) atomic_inc_not_zero(&ct->use) (use = 2) if (!l4proto->new(ct, skb, dataoff, timeouts)) nf_conntrack_free(ct); (use = 2 !!!) ... __nf_conntrack_alloc (set use = 1) if (!nf_ct_key_equal(h, tuple, zone)) nf_ct_put(ct); (use = 0) destroy_conntrack() /* continue to work with CT */ After applying the path "[PATCH] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get" another bug was triggered in destroy_conntrack(): <4>[67096.759334] ------------[ cut here ]------------ <2>[67096.759353] kernel BUG at net/netfilter/nf_conntrack_core.c:211! ... <4>[67096.759837] Pid: 498649, comm: atdd veid: 666 Tainted: G C --------------- 2.6.32-042stab084.18 #1 042stab084_18 /DQ45CB <4>[67096.759932] RIP: 0010:[<ffffffffa03d99ac>] [<ffffffffa03d99ac>] destroy_conntrack+0x15c/0x190 [nf_conntrack] <4>[67096.760255] Call Trace: <4>[67096.760255] [<ffffffff814844a7>] nf_conntrack_destroy+0x17/0x30 <4>[67096.760255] [<ffffffffa03d9bb5>] nf_conntrack_find_get+0x85/0x130 [nf_conntrack] <4>[67096.760255] [<ffffffffa03d9fb2>] nf_conntrack_in+0x352/0xb60 [nf_conntrack] <4>[67096.760255] [<ffffffffa048c771>] ipv4_conntrack_local+0x51/0x60 [nf_conntrack_ipv4] <4>[67096.760255] [<ffffffff81484419>] nf_iterate+0x69/0xb0 <4>[67096.760255] [<ffffffff814b5b00>] ? dst_output+0x0/0x20 <4>[67096.760255] [<ffffffff814845d4>] nf_hook_slow+0x74/0x110 <4>[67096.760255] [<ffffffff814b5b00>] ? dst_output+0x0/0x20 <4>[67096.760255] [<ffffffff814b66d5>] raw_sendmsg+0x775/0x910 <4>[67096.760255] [<ffffffff8104c5a8>] ? flush_tlb_others_ipi+0x128/0x130 <4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20 <4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20 <4>[67096.760255] [<ffffffff814c136a>] inet_sendmsg+0x4a/0xb0 <4>[67096.760255] [<ffffffff81444e93>] ? sock_sendmsg+0x13/0x140 <4>[67096.760255] [<ffffffff81444f97>] sock_sendmsg+0x117/0x140 <4>[67096.760255] [<ffffffff8102e299>] ? native_smp_send_reschedule+0x49/0x60 <4>[67096.760255] [<ffffffff81519beb>] ? _spin_unlock_bh+0x1b/0x20 <4>[67096.760255] [<ffffffff8109d930>] ? autoremove_wake_function+0x0/0x40 <4>[67096.760255] [<ffffffff814960f0>] ? do_ip_setsockopt+0x90/0xd80 <4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20 <4>[67096.760255] [<ffffffff8100bc4e>] ? apic_timer_interrupt+0xe/0x20 <4>[67096.760255] [<ffffffff814457c9>] sys_sendto+0x139/0x190 <4>[67096.760255] [<ffffffff810efa77>] ? audit_syscall_entry+0x1d7/0x200 <4>[67096.760255] [<ffffffff810ef7c5>] ? __audit_syscall_exit+0x265/0x290 <4>[67096.760255] [<ffffffff81474daf>] compat_sys_socketcall+0x13f/0x210 <4>[67096.760255] [<ffffffff8104dea3>] ia32_sysret+0x0/0x5 I have reused the original title for the RFC patch that Andrey posted and most of the original patch description. Cc: Eric Dumazet <edumazet@google.com> Cc: Andrew Vagin <avagin@parallels.com> Cc: Florian Westphal <fw@strlen.de> Reported-by: Andrew Vagin <avagin@parallels.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Andrew Vagin <avagin@parallels.com>
444 lines
10 KiB
C
444 lines
10 KiB
C
/*
|
|
* Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
#include <linux/module.h>
|
|
#include <linux/gfp.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/netfilter_ipv4/ip_tables.h>
|
|
#include <linux/netfilter_ipv6/ip6_tables.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
#include <linux/netfilter/xt_CT.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netfilter/nf_conntrack_l4proto.h>
|
|
#include <net/netfilter/nf_conntrack_helper.h>
|
|
#include <net/netfilter/nf_conntrack_ecache.h>
|
|
#include <net/netfilter/nf_conntrack_timeout.h>
|
|
#include <net/netfilter/nf_conntrack_zones.h>
|
|
|
|
static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
|
|
{
|
|
/* Previously seen (loopback)? Ignore. */
|
|
if (skb->nfct != NULL)
|
|
return XT_CONTINUE;
|
|
|
|
/* special case the untracked ct : we want the percpu object */
|
|
if (!ct)
|
|
ct = nf_ct_untracked_get();
|
|
atomic_inc(&ct->ct_general.use);
|
|
skb->nfct = &ct->ct_general;
|
|
skb->nfctinfo = IP_CT_NEW;
|
|
|
|
return XT_CONTINUE;
|
|
}
|
|
|
|
static unsigned int xt_ct_target_v0(struct sk_buff *skb,
|
|
const struct xt_action_param *par)
|
|
{
|
|
const struct xt_ct_target_info *info = par->targinfo;
|
|
struct nf_conn *ct = info->ct;
|
|
|
|
return xt_ct_target(skb, ct);
|
|
}
|
|
|
|
static unsigned int xt_ct_target_v1(struct sk_buff *skb,
|
|
const struct xt_action_param *par)
|
|
{
|
|
const struct xt_ct_target_info_v1 *info = par->targinfo;
|
|
struct nf_conn *ct = info->ct;
|
|
|
|
return xt_ct_target(skb, ct);
|
|
}
|
|
|
|
static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
|
|
{
|
|
if (par->family == NFPROTO_IPV4) {
|
|
const struct ipt_entry *e = par->entryinfo;
|
|
|
|
if (e->ip.invflags & IPT_INV_PROTO)
|
|
return 0;
|
|
return e->ip.proto;
|
|
} else if (par->family == NFPROTO_IPV6) {
|
|
const struct ip6t_entry *e = par->entryinfo;
|
|
|
|
if (e->ipv6.invflags & IP6T_INV_PROTO)
|
|
return 0;
|
|
return e->ipv6.proto;
|
|
} else
|
|
return 0;
|
|
}
|
|
|
|
static int
|
|
xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
|
|
const struct xt_tgchk_param *par)
|
|
{
|
|
struct nf_conntrack_helper *helper;
|
|
struct nf_conn_help *help;
|
|
u8 proto;
|
|
|
|
proto = xt_ct_find_proto(par);
|
|
if (!proto) {
|
|
pr_info("You must specify a L4 protocol, and not use "
|
|
"inversions on it.\n");
|
|
return -ENOENT;
|
|
}
|
|
|
|
helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
|
|
proto);
|
|
if (helper == NULL) {
|
|
pr_info("No such helper \"%s\"\n", helper_name);
|
|
return -ENOENT;
|
|
}
|
|
|
|
help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
|
|
if (help == NULL) {
|
|
module_put(helper->me);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
help->helper = helper;
|
|
return 0;
|
|
}
|
|
|
|
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
|
|
static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
|
|
{
|
|
typeof(nf_ct_timeout_put_hook) timeout_put;
|
|
|
|
timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
|
|
if (timeout_put)
|
|
timeout_put(timeout);
|
|
}
|
|
#endif
|
|
|
|
static int
|
|
xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
|
|
const char *timeout_name)
|
|
{
|
|
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
|
|
typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
|
|
struct ctnl_timeout *timeout;
|
|
struct nf_conn_timeout *timeout_ext;
|
|
struct nf_conntrack_l4proto *l4proto;
|
|
int ret = 0;
|
|
u8 proto;
|
|
|
|
rcu_read_lock();
|
|
timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
|
|
if (timeout_find_get == NULL) {
|
|
ret = -ENOENT;
|
|
pr_info("Timeout policy base is empty\n");
|
|
goto out;
|
|
}
|
|
|
|
proto = xt_ct_find_proto(par);
|
|
if (!proto) {
|
|
ret = -EINVAL;
|
|
pr_info("You must specify a L4 protocol, and not use "
|
|
"inversions on it.\n");
|
|
goto out;
|
|
}
|
|
|
|
timeout = timeout_find_get(timeout_name);
|
|
if (timeout == NULL) {
|
|
ret = -ENOENT;
|
|
pr_info("No such timeout policy \"%s\"\n", timeout_name);
|
|
goto out;
|
|
}
|
|
|
|
if (timeout->l3num != par->family) {
|
|
ret = -EINVAL;
|
|
pr_info("Timeout policy `%s' can only be used by L3 protocol "
|
|
"number %d\n", timeout_name, timeout->l3num);
|
|
goto err_put_timeout;
|
|
}
|
|
/* Make sure the timeout policy matches any existing protocol tracker,
|
|
* otherwise default to generic.
|
|
*/
|
|
l4proto = __nf_ct_l4proto_find(par->family, proto);
|
|
if (timeout->l4proto->l4proto != l4proto->l4proto) {
|
|
ret = -EINVAL;
|
|
pr_info("Timeout policy `%s' can only be used by L4 protocol "
|
|
"number %d\n",
|
|
timeout_name, timeout->l4proto->l4proto);
|
|
goto err_put_timeout;
|
|
}
|
|
timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
|
|
if (timeout_ext == NULL)
|
|
ret = -ENOMEM;
|
|
|
|
err_put_timeout:
|
|
__xt_ct_tg_timeout_put(timeout);
|
|
out:
|
|
rcu_read_unlock();
|
|
return ret;
|
|
#else
|
|
return -EOPNOTSUPP;
|
|
#endif
|
|
}
|
|
|
|
static int xt_ct_tg_check(const struct xt_tgchk_param *par,
|
|
struct xt_ct_target_info_v1 *info)
|
|
{
|
|
struct nf_conntrack_tuple t;
|
|
struct nf_conn *ct;
|
|
int ret = -EOPNOTSUPP;
|
|
|
|
if (info->flags & XT_CT_NOTRACK) {
|
|
ct = NULL;
|
|
goto out;
|
|
}
|
|
|
|
#ifndef CONFIG_NF_CONNTRACK_ZONES
|
|
if (info->zone)
|
|
goto err1;
|
|
#endif
|
|
|
|
ret = nf_ct_l3proto_try_module_get(par->family);
|
|
if (ret < 0)
|
|
goto err1;
|
|
|
|
memset(&t, 0, sizeof(t));
|
|
ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
|
|
ret = PTR_ERR(ct);
|
|
if (IS_ERR(ct))
|
|
goto err2;
|
|
|
|
ret = 0;
|
|
if ((info->ct_events || info->exp_events) &&
|
|
!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
|
|
GFP_KERNEL)) {
|
|
ret = -EINVAL;
|
|
goto err3;
|
|
}
|
|
|
|
if (info->helper[0]) {
|
|
ret = xt_ct_set_helper(ct, info->helper, par);
|
|
if (ret < 0)
|
|
goto err3;
|
|
}
|
|
|
|
if (info->timeout[0]) {
|
|
ret = xt_ct_set_timeout(ct, par, info->timeout);
|
|
if (ret < 0)
|
|
goto err3;
|
|
}
|
|
|
|
nf_conntrack_tmpl_insert(par->net, ct);
|
|
out:
|
|
info->ct = ct;
|
|
return 0;
|
|
|
|
err3:
|
|
nf_conntrack_free(ct);
|
|
err2:
|
|
nf_ct_l3proto_module_put(par->family);
|
|
err1:
|
|
return ret;
|
|
}
|
|
|
|
static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
|
|
{
|
|
struct xt_ct_target_info *info = par->targinfo;
|
|
struct xt_ct_target_info_v1 info_v1 = {
|
|
.flags = info->flags,
|
|
.zone = info->zone,
|
|
.ct_events = info->ct_events,
|
|
.exp_events = info->exp_events,
|
|
};
|
|
int ret;
|
|
|
|
if (info->flags & ~XT_CT_NOTRACK)
|
|
return -EINVAL;
|
|
|
|
memcpy(info_v1.helper, info->helper, sizeof(info->helper));
|
|
|
|
ret = xt_ct_tg_check(par, &info_v1);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
info->ct = info_v1.ct;
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
|
|
{
|
|
struct xt_ct_target_info_v1 *info = par->targinfo;
|
|
|
|
if (info->flags & ~XT_CT_NOTRACK)
|
|
return -EINVAL;
|
|
|
|
return xt_ct_tg_check(par, par->targinfo);
|
|
}
|
|
|
|
static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
|
|
{
|
|
struct xt_ct_target_info_v1 *info = par->targinfo;
|
|
|
|
if (info->flags & ~XT_CT_MASK)
|
|
return -EINVAL;
|
|
|
|
return xt_ct_tg_check(par, par->targinfo);
|
|
}
|
|
|
|
static void xt_ct_destroy_timeout(struct nf_conn *ct)
|
|
{
|
|
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
|
|
struct nf_conn_timeout *timeout_ext;
|
|
typeof(nf_ct_timeout_put_hook) timeout_put;
|
|
|
|
rcu_read_lock();
|
|
timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
|
|
|
|
if (timeout_put) {
|
|
timeout_ext = nf_ct_timeout_find(ct);
|
|
if (timeout_ext)
|
|
timeout_put(timeout_ext->timeout);
|
|
}
|
|
rcu_read_unlock();
|
|
#endif
|
|
}
|
|
|
|
static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
|
|
struct xt_ct_target_info_v1 *info)
|
|
{
|
|
struct nf_conn *ct = info->ct;
|
|
struct nf_conn_help *help;
|
|
|
|
if (ct && !nf_ct_is_untracked(ct)) {
|
|
help = nfct_help(ct);
|
|
if (help)
|
|
module_put(help->helper->me);
|
|
|
|
nf_ct_l3proto_module_put(par->family);
|
|
|
|
xt_ct_destroy_timeout(ct);
|
|
nf_ct_put(info->ct);
|
|
}
|
|
}
|
|
|
|
static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
|
|
{
|
|
struct xt_ct_target_info *info = par->targinfo;
|
|
struct xt_ct_target_info_v1 info_v1 = {
|
|
.flags = info->flags,
|
|
.zone = info->zone,
|
|
.ct_events = info->ct_events,
|
|
.exp_events = info->exp_events,
|
|
.ct = info->ct,
|
|
};
|
|
memcpy(info_v1.helper, info->helper, sizeof(info->helper));
|
|
|
|
xt_ct_tg_destroy(par, &info_v1);
|
|
}
|
|
|
|
static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
|
|
{
|
|
xt_ct_tg_destroy(par, par->targinfo);
|
|
}
|
|
|
|
static struct xt_target xt_ct_tg_reg[] __read_mostly = {
|
|
{
|
|
.name = "CT",
|
|
.family = NFPROTO_UNSPEC,
|
|
.targetsize = sizeof(struct xt_ct_target_info),
|
|
.checkentry = xt_ct_tg_check_v0,
|
|
.destroy = xt_ct_tg_destroy_v0,
|
|
.target = xt_ct_target_v0,
|
|
.table = "raw",
|
|
.me = THIS_MODULE,
|
|
},
|
|
{
|
|
.name = "CT",
|
|
.family = NFPROTO_UNSPEC,
|
|
.revision = 1,
|
|
.targetsize = sizeof(struct xt_ct_target_info_v1),
|
|
.checkentry = xt_ct_tg_check_v1,
|
|
.destroy = xt_ct_tg_destroy_v1,
|
|
.target = xt_ct_target_v1,
|
|
.table = "raw",
|
|
.me = THIS_MODULE,
|
|
},
|
|
{
|
|
.name = "CT",
|
|
.family = NFPROTO_UNSPEC,
|
|
.revision = 2,
|
|
.targetsize = sizeof(struct xt_ct_target_info_v1),
|
|
.checkentry = xt_ct_tg_check_v2,
|
|
.destroy = xt_ct_tg_destroy_v1,
|
|
.target = xt_ct_target_v1,
|
|
.table = "raw",
|
|
.me = THIS_MODULE,
|
|
},
|
|
};
|
|
|
|
static unsigned int
|
|
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|
{
|
|
/* Previously seen (loopback)? Ignore. */
|
|
if (skb->nfct != NULL)
|
|
return XT_CONTINUE;
|
|
|
|
skb->nfct = &nf_ct_untracked_get()->ct_general;
|
|
skb->nfctinfo = IP_CT_NEW;
|
|
nf_conntrack_get(skb->nfct);
|
|
|
|
return XT_CONTINUE;
|
|
}
|
|
|
|
static int notrack_chk(const struct xt_tgchk_param *par)
|
|
{
|
|
if (!par->net->xt.notrack_deprecated_warning) {
|
|
pr_info("netfilter: NOTRACK target is deprecated, "
|
|
"use CT instead or upgrade iptables\n");
|
|
par->net->xt.notrack_deprecated_warning = true;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static struct xt_target notrack_tg_reg __read_mostly = {
|
|
.name = "NOTRACK",
|
|
.revision = 0,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = notrack_chk,
|
|
.target = notrack_tg,
|
|
.table = "raw",
|
|
.me = THIS_MODULE,
|
|
};
|
|
|
|
static int __init xt_ct_tg_init(void)
|
|
{
|
|
int ret;
|
|
|
|
ret = xt_register_target(¬rack_tg_reg);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
|
|
if (ret < 0) {
|
|
xt_unregister_target(¬rack_tg_reg);
|
|
return ret;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static void __exit xt_ct_tg_exit(void)
|
|
{
|
|
xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
|
|
xt_unregister_target(¬rack_tg_reg);
|
|
}
|
|
|
|
module_init(xt_ct_tg_init);
|
|
module_exit(xt_ct_tg_exit);
|
|
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_DESCRIPTION("Xtables: connection tracking target");
|
|
MODULE_ALIAS("ipt_CT");
|
|
MODULE_ALIAS("ip6t_CT");
|
|
MODULE_ALIAS("ipt_NOTRACK");
|
|
MODULE_ALIAS("ip6t_NOTRACK");
|