From: Sergei Shtylyov <sergei.shtylyov@cogentembedded•com>
To: Florian Westphal <fw@strlen•de>, netdev@vger•kernel.org
Cc: stephen@networkplumber•org, Felix Fietkau <nbd@openwrt•org>,
Zefir Kurtisi <zefir.kurtisi@neratec•com>
Subject: Re: [PATCH -next] bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict
Date: Sat, 12 Mar 2016 22:20:08 +0300 [thread overview]
Message-ID: <56E46BE8.7070403@cogentembedded.com> (raw)
In-Reply-To: <1457777682-24689-1-git-send-email-fw@strlen.de>
Hello.
On 03/12/2016 01:14 PM, Florian Westphal wrote:
> Zefir Kurtisi reported kernel panic with an openwrt specific patch.
> However, it turns out that mainline has a similar bug waiting to happen.
>
> Once NF_HOOK() returns the skb is in undefined state and must not be
> used. Moreover, the okfn must consume the skb to support async
> processing (NF_QUEUE).
>
> Current okfn in this spot doesn't consume it and caller assumes that
> NF_HOOK return value tells us if skb was freed or not, but thats wrong.
That's.
> It "works" because no in-tree user registers a NFPROTO_BRIDGE hook at
> LOCAL_IN that returns STOLEN or NF_QUEUE verdicts.
>
> Once we add NF_QUEUE support for nftables bridge this will break --
> NF_QUEUE holds the skb for async processing, caller will erronoulsy
Erroneously.
> return RX_HANDLER_PASS and on reinject netfilter will access free'd skb.
>
> Fix this by pushing skb up the stack in the okfn instead.
>
> NB: It also seems dubious to use LOCAL_IN while bypassing PRE_ROUTING
> completely in this case but this is how its been forever so it seems
> preferable to not change this.
>
> Cc: Felix Fietkau <nbd@openwrt•org>
> Cc: Zefir Kurtisi <zefir.kurtisi@neratec•com>
> Signed-off-by: Florian Westphal <fw@strlen•de>
[...]
MBR, Sergei
next prev parent reply other threads:[~2016-03-12 19:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-12 10:14 [PATCH -next] bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict Florian Westphal
2016-03-12 19:20 ` Sergei Shtylyov [this message]
2016-03-14 15:28 ` Zefir Kurtisi
2016-03-14 19:47 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56E46BE8.7070403@cogentembedded.com \
--to=sergei.shtylyov@cogentembedded$(echo .)com \
--cc=fw@strlen$(echo .)de \
--cc=nbd@openwrt$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=stephen@networkplumber$(echo .)org \
--cc=zefir.kurtisi@neratec$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox