From patchwork Fri Apr 14 01:13:40 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao Feng X-Patchwork-Id: 750680 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3w407L6xytz9sN7 for ; Fri, 14 Apr 2017 11:14:38 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=foxmail.com header.i=@foxmail.com header.b="KASMVYub"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751332AbdDNBOi (ORCPT ); Thu, 13 Apr 2017 21:14:38 -0400 Received: from smtpbgau2.qq.com ([54.206.34.216]:53086 "EHLO smtpbgau2.qq.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750764AbdDNBOh (ORCPT ); Thu, 13 Apr 2017 21:14:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foxmail.com; s=s201512; t=1492132473; bh=8ZT1ZmuNZSndhqa1P+1QETGuHZOvM1NC5oCixmmOfbg=; h=From:To:Cc:Subject:Date:Message-Id; b=KASMVYubcME0A5zvzXF7XULsu7D5sYdztDZWGfvZIbEpkfJpEDuqjVzSj60cJ+Sfh Ejkb9C/mImQBrkPW0Dvjm1Sz332Pp+rteFMcBm5J25FLsJ8ueSeEDxyv0XwpxD7fRe uHs5bwydiOsdxBWotbWjTqCO97Cj5fItoViicpNs= X-QQ-mid: esmtp20t1492132471tqo3022n5 Received: from ikuai8.com (unknown [114.242.17.232]) by esmtp4.qq.com (ESMTP) with id ; Fri, 14 Apr 2017 09:14:19 +0800 (CST) X-QQ-SSF: 01000000000000F0FG600F00000000Q X-QQ-FEAT: bwgMLqpyqeIcTke5h36NhqRseOv5iM/9wVOWIXFTQ5qaSxxGR5ju+HIyQel1z F757AAqv4naHB3hxdC4XdL7hdn3Js9Mkw5YhhwgR2bdU1wZv5LdfGWslJqfj9kswqTDErQ0 Gr1UgBoZubktcWDMwYB4l+rCsQkP1bk5UD5aFdcW7YUnLm/yYiPKuoJU/jGW3cFU11OCstn f0i7+FQ880HtylZe9ObLHYD0oaBgm4S1rXoRCGENifK9YrT5nwnZyMeCwBR1LZUgIUlzmhk x6VbWANu/DsLAA X-QQ-GoodBg: 0 From: gfree.wind@foxmail.com To: pablo@netfilter.org, netfilter-devel@vger.kernel.org Cc: Gao Feng Subject: [PATCH nf v2] netfilter: cttimeout: Fix one possible use-after-free issue Date: Fri, 14 Apr 2017 09:13:40 +0800 Message-Id: <1492132420-70400-1-git-send-email-gfree.wind@foxmail.com> X-Mailer: git-send-email 1.9.1 X-QQ-SENDSIZE: 520 Feedback-ID: esmtp:foxmail.com:bgforeign:bgforeign3 X-QQ-Bgrelay: 1 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Gao Feng The function ctnl_untimeout is used to untimeout every conntrack which is using the timeout. But it is necessary to add one barrier synchronize_rcu because of racing. Maybe one conntrack has already owned this timeout, but it is not inserted into unconfirmed list or the hash list, when ctnl_untimeout untimeout the conntracks Let me describe it with a call path CPU1 CPU2 alloc new conn add timeout ext ctnl_timeout_try_del untimeout all conns in list kfree_rcu. conn is confirmed. As the show above, when cpu2 untimeout all conns in list and the new conn of cpu1 is not confirmed, the new conn still owns the timeout pointer. After the timeout mem is freed really, it points to one invalid mem. Signed-off-by: Gao Feng --- v2: Add the call path in the comment v1: initial version net/netfilter/nfnetlink_cttimeout.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c index 47d6656..af0cc87 100644 --- a/net/netfilter/nfnetlink_cttimeout.c +++ b/net/netfilter/nfnetlink_cttimeout.c @@ -304,6 +304,11 @@ static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout) spinlock_t *lock; int i, cpu; + /* Make sure the conntrack using the timeout already in the unconfirmed + * list or in the hash table. + */ + synchronize_rcu(); + for_each_possible_cpu(cpu) { struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);