145 lines
5.4 KiB
Diff
145 lines
5.4 KiB
Diff
From 7214a2db7b72aa16525b5583488ae15b790d20bc Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:16:20 +0200
|
|
Subject: [PATCH] netfilter: nf_conntrack_expect: use expect->helper
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit f01794106042
|
|
|
|
commit f01794106042ee27e54af6fdf5b319a2fe3df94d
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Wed Mar 25 14:11:03 2026 +0100
|
|
|
|
netfilter: nf_conntrack_expect: use expect->helper
|
|
|
|
Use expect->helper in ctnetlink and /proc to dump the helper name.
|
|
Using nfct_help() without holding a reference to the master conntrack
|
|
is unsafe.
|
|
|
|
Use exp->master->helper in ctnetlink path if userspace does not provide
|
|
an explicit helper when creating an expectation to retain the existing
|
|
behaviour. The ctnetlink expectation path holds the reference on the
|
|
master conntrack and nf_conntrack_expect lock and the nfnetlink glue
|
|
path refers to the master ct that is attached to the skb.
|
|
|
|
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
|
|
index de5e2ae..1cbe5f1 100644
|
|
--- a/net/netfilter/nf_conntrack_expect.c
|
|
+++ b/net/netfilter/nf_conntrack_expect.c
|
|
@@ -674,7 +674,7 @@ static int exp_seq_show(struct seq_file *s, void *v)
|
|
if (expect->flags & NF_CT_EXPECT_USERSPACE)
|
|
seq_printf(s, "%sUSERSPACE", delim);
|
|
|
|
- helper = rcu_dereference(nfct_help(expect->master)->helper);
|
|
+ helper = rcu_dereference(expect->helper);
|
|
if (helper) {
|
|
seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
|
|
if (helper->expect_policy[expect->class].name[0])
|
|
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
|
|
index a21c976..a715304 100644
|
|
--- a/net/netfilter/nf_conntrack_helper.c
|
|
+++ b/net/netfilter/nf_conntrack_helper.c
|
|
@@ -395,14 +395,10 @@ EXPORT_SYMBOL_GPL(nf_conntrack_helper_register);
|
|
|
|
static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data)
|
|
{
|
|
- struct nf_conn_help *help = nfct_help(exp->master);
|
|
const struct nf_conntrack_helper *me = data;
|
|
const struct nf_conntrack_helper *this;
|
|
|
|
- if (rcu_access_pointer(exp->helper) == me)
|
|
- return true;
|
|
-
|
|
- this = rcu_dereference_protected(help->helper,
|
|
+ this = rcu_dereference_protected(exp->helper,
|
|
lockdep_is_held(&nf_conntrack_expect_lock));
|
|
return this == me;
|
|
}
|
|
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
|
|
index 1da2757..479acad 100644
|
|
--- a/net/netfilter/nf_conntrack_netlink.c
|
|
+++ b/net/netfilter/nf_conntrack_netlink.c
|
|
@@ -3031,7 +3031,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
|
|
{
|
|
struct nf_conn *master = exp->master;
|
|
long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
|
|
- struct nf_conn_help *help;
|
|
+ struct nf_conntrack_helper *helper;
|
|
#if IS_ENABLED(CONFIG_NF_NAT)
|
|
struct nlattr *nest_parms;
|
|
struct nf_conntrack_tuple nat_tuple = {};
|
|
@@ -3076,15 +3076,12 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
|
|
nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
|
|
nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
|
|
goto nla_put_failure;
|
|
- help = nfct_help(master);
|
|
- if (help) {
|
|
- struct nf_conntrack_helper *helper;
|
|
|
|
- helper = rcu_dereference(help->helper);
|
|
- if (helper &&
|
|
- nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
|
|
- goto nla_put_failure;
|
|
- }
|
|
+ helper = rcu_dereference(exp->helper);
|
|
+ if (helper &&
|
|
+ nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
|
|
+ goto nla_put_failure;
|
|
+
|
|
expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);
|
|
if (expfn != NULL &&
|
|
nla_put_string(skb, CTA_EXPECT_FN, expfn->name))
|
|
@@ -3419,12 +3416,9 @@ static int ctnetlink_get_expect(struct sk_buff *skb,
|
|
static bool expect_iter_name(struct nf_conntrack_expect *exp, void *data)
|
|
{
|
|
struct nf_conntrack_helper *helper;
|
|
- const struct nf_conn_help *m_help;
|
|
const char *name = data;
|
|
|
|
- m_help = nfct_help(exp->master);
|
|
-
|
|
- helper = rcu_dereference(m_help->helper);
|
|
+ helper = rcu_dereference(exp->helper);
|
|
if (!helper)
|
|
return false;
|
|
|
|
@@ -3563,9 +3557,9 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
|
|
struct nf_conntrack_tuple *tuple,
|
|
struct nf_conntrack_tuple *mask)
|
|
{
|
|
- u_int32_t class = 0;
|
|
struct nf_conntrack_expect *exp;
|
|
struct nf_conn_help *help;
|
|
+ u32 class = 0;
|
|
int err;
|
|
|
|
help = nfct_help(ct);
|
|
@@ -3602,6 +3596,8 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
|
|
|
|
exp->class = class;
|
|
exp->master = ct;
|
|
+ if (!helper)
|
|
+ helper = rcu_dereference(help->helper);
|
|
rcu_assign_pointer(exp->helper, helper);
|
|
exp->tuple = *tuple;
|
|
exp->mask.src.u3 = mask->src.u3;
|
|
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
|
|
index 106b2f4..20e57cf 100644
|
|
--- a/net/netfilter/nf_conntrack_sip.c
|
|
+++ b/net/netfilter/nf_conntrack_sip.c
|
|
@@ -924,7 +924,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
|
|
exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
|
|
|
|
if (!exp || exp->master == ct ||
|
|
- nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
|
|
+ exp->helper != nfct_help(ct)->helper ||
|
|
exp->class != class)
|
|
break;
|
|
#if IS_ENABLED(CONFIG_NF_NAT)
|