129 lines
4.7 KiB
Diff
129 lines
4.7 KiB
Diff
From 979c13114c0bb6ab9135e2c93e00c79c412aef09 Mon Sep 17 00:00:00 2001
|
|
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Mon, 22 Jun 2026 21:35:14 +0200
|
|
Subject: [PATCH] netfilter: nf_conntrack_expect: store master_tuple in
|
|
expectation
|
|
|
|
Store master conntrack tuple in the expectation since exp->master might
|
|
refer to a different conntrack when accessed from rcu read side lock
|
|
area due to typesafe rcu rules.
|
|
|
|
Fixes: 02a3231b6d82 ("netfilter: nf_conntrack_expect: store netns and zone in expectation")
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
|
|
index 80f50fd..ec4dd61 100644
|
|
--- a/include/net/netfilter/nf_conntrack_expect.h
|
|
+++ b/include/net/netfilter/nf_conntrack_expect.h
|
|
@@ -22,16 +22,10 @@ struct nf_conntrack_expect {
|
|
/* Hash member */
|
|
struct hlist_node hnode;
|
|
|
|
- /* Network namespace */
|
|
- possible_net_t net;
|
|
-
|
|
/* We expect this tuple, with the following mask */
|
|
struct nf_conntrack_tuple tuple;
|
|
struct nf_conntrack_tuple_mask mask;
|
|
|
|
-#ifdef CONFIG_NF_CONNTRACK_ZONES
|
|
- struct nf_conntrack_zone zone;
|
|
-#endif
|
|
/* Usage count. */
|
|
refcount_t use;
|
|
|
|
@@ -48,9 +42,6 @@ struct nf_conntrack_expect {
|
|
/* Helper that created this expectation */
|
|
struct nf_conntrack_helper __rcu *helper;
|
|
|
|
- /* Helper to assign to new connection */
|
|
- struct nf_conntrack_helper __rcu *assign_helper;
|
|
-
|
|
/* The conntrack of the master connection */
|
|
struct nf_conn *master;
|
|
|
|
@@ -67,6 +58,15 @@ struct nf_conntrack_expect {
|
|
#endif
|
|
|
|
struct rcu_head rcu;
|
|
+
|
|
+/* Network namespace */
|
|
+ RH_KABI_EXTEND(possible_net_t net)
|
|
+#ifdef CONFIG_NF_CONNTRACK_ZONES
|
|
+ RH_KABI_EXTEND(struct nf_conntrack_zone zone)
|
|
+#endif
|
|
+ /* Helper to assign to new connection */
|
|
+ RH_KABI_EXTEND(struct nf_conntrack_helper __rcu *assign_helper)
|
|
+ RH_KABI_EXTEND(struct nf_conntrack_tuple master_tuple)
|
|
};
|
|
|
|
static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
|
|
diff --git a/net/netfilter/nf_conntrack_broadcast.c b/net/netfilter/nf_conntrack_broadcast.c
|
|
index 75e53fd..46218c7 100644
|
|
--- a/net/netfilter/nf_conntrack_broadcast.c
|
|
+++ b/net/netfilter/nf_conntrack_broadcast.c
|
|
@@ -59,6 +59,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb,
|
|
if (exp == NULL)
|
|
goto out;
|
|
|
|
+ exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
|
|
exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
|
|
|
|
helper = rcu_dereference(help->helper);
|
|
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
|
|
index 1bb5bf8..9f74935 100644
|
|
--- a/net/netfilter/nf_conntrack_expect.c
|
|
+++ b/net/netfilter/nf_conntrack_expect.c
|
|
@@ -352,6 +352,8 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
|
|
exp->tuple.src.l3num = family;
|
|
exp->tuple.dst.protonum = proto;
|
|
|
|
+ exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
|
|
+
|
|
if (saddr) {
|
|
memcpy(&exp->tuple.src.u3, saddr, len);
|
|
if (sizeof(exp->tuple.src.u3) > len)
|
|
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
|
|
index b375374..8d69397 100644
|
|
--- a/net/netfilter/nf_conntrack_netlink.c
|
|
+++ b/net/netfilter/nf_conntrack_netlink.c
|
|
@@ -3027,7 +3027,6 @@ static int
|
|
ctnetlink_exp_dump_expect(struct sk_buff *skb,
|
|
const struct nf_conntrack_expect *exp)
|
|
{
|
|
- struct nf_conn *master = exp->master;
|
|
long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
|
|
struct nf_conntrack_helper *helper;
|
|
#if IS_ENABLED(CONFIG_NF_NAT)
|
|
@@ -3043,9 +3042,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
|
|
goto nla_put_failure;
|
|
if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
|
|
goto nla_put_failure;
|
|
- if (ctnetlink_exp_dump_tuple(skb,
|
|
- &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
|
|
- CTA_EXPECT_MASTER) < 0)
|
|
+ if (ctnetlink_exp_dump_tuple(skb, &exp->master_tuple, CTA_EXPECT_MASTER) < 0)
|
|
goto nla_put_failure;
|
|
|
|
#if IS_ENABLED(CONFIG_NF_NAT)
|
|
@@ -3058,9 +3055,9 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
|
|
if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
|
|
goto nla_put_failure;
|
|
|
|
- nat_tuple.src.l3num = nf_ct_l3num(master);
|
|
+ nat_tuple.src.l3num = exp->master_tuple.src.l3num;
|
|
nat_tuple.src.u3 = exp->saved_addr;
|
|
- nat_tuple.dst.protonum = nf_ct_protonum(master);
|
|
+ nat_tuple.dst.protonum = exp->master_tuple.dst.protonum;
|
|
nat_tuple.src.u = exp->saved_proto;
|
|
|
|
if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
|
|
@@ -3606,6 +3603,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
|
|
#endif
|
|
rcu_assign_pointer(exp->helper, helper);
|
|
rcu_assign_pointer(exp->assign_helper, assign_helper);
|
|
+ exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
|
|
exp->tuple = *tuple;
|
|
exp->mask.src.u3 = mask->src.u3;
|
|
exp->mask.src.u.all = mask->src.u.all;
|