[NETFILTER 00/04]: Netfilter fixes

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following are a few small netfilter fixes for 2.6.19, fixing multiple
refcount leaks and a nf_conntrack helper assignment race which can
lead to use-after-free.

Please apply, thanks.


 net/ipv4/netfilter/ip_conntrack_core.c    |    6 +++---
 net/ipv4/netfilter/ip_conntrack_netlink.c |    1 +
 net/netfilter/nf_conntrack_core.c         |   19 +++++++++----------
 net/netfilter/nf_conntrack_netlink.c      |    9 +++++++++
 4 files changed, 22 insertions(+), 13 deletions(-)

Patrick McHardy:
      [NETFILTER]: ctnetlink: fix reference count leak

Yasuyuki Kozakai:
      [NETFILTER]: nfctnetlink: assign helper to newly created conntrack
      [NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack
      [NETFILTER]: conntrack: fix refcount leak when finding expectation

[NETFILTER 01/04]: nfctnetlink: assign helper to newly created conntrack

[Patrick McHardy]

[NETFILTER]: nfctnetlink: assign helper to newly created conntrack

This fixes the bug which doesn't assign helper to newly created
conntrack via nf_conntrack_netlink.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit cbf15ed58d4934fe480fc1760a5ea71d35eafcf7
tree ce0afad3be2d1944b321c5e135f3cee84281f29e
parent a07a4f6c88cef7a5cbe0950229913dd087434f88
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Mon, 27 Nov 2006 18:56:24 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:44 +0100

 net/netfilter/nf_conntrack_netlink.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bd0156a..77a46ee 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -949,6 +949,7 @@ ctnetlink_create_conntrack(struct nfattr
 {
 	struct nf_conn *ct;
 	int err = -EINVAL;
+	struct nf_conn_help *help;
 
 	ct = nf_conntrack_alloc(otuple, rtuple);
 	if (ct == NULL || IS_ERR(ct))
@@ -976,9 +977,16 @@ #if defined(CONFIG_NF_CONNTRACK_MARK)
 		ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
+	help = nfct_help(ct);
+	if (help)
+		help->helper = nf_ct_helper_find_get(rtuple);
+
 	add_timer(&ct->timeout);
 	nf_conntrack_hash_insert(ct);
 
+	if (help && help->helper)
+		nf_ct_helper_put(help->helper);
+
 	return 0;
 
 err:	

[NETFILTER 02/04]: nf_conntrack: fix the race on assign helper to new conntrack

[Patrick McHardy]

[NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack

The found helper cannot be assigned to conntrack after unlocking
nf_conntrack_lock. This tries to find helper to assign again.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit a88ad2f562c2c108f76adfda4d5ee954e09e6d98
tree c0b7259465e28021e6c7a2c3892e742876f45bbf
parent cbf15ed58d4934fe480fc1760a5ea71d35eafcf7
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Mon, 27 Nov 2006 18:56:25 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:44 +0100

 net/netfilter/nf_conntrack_core.c |   13 ++++++-------
 1 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 836541e..0f58307 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -893,12 +893,6 @@ __nf_conntrack_alloc(const struct nf_con
 
 	memset(conntrack, 0, nf_ct_cache[features].size);
 	conntrack->features = features;
-	if (helper) {
-		struct nf_conn_help *help = nfct_help(conntrack);
-		NF_CT_ASSERT(help);
-		help->helper = helper;
-	}
-
 	atomic_set(&conntrack->ct_general.use, 1);
 	conntrack->ct_general.destroy = destroy_conntrack;
 	conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
@@ -982,8 +976,13 @@ #ifdef CONFIG_NF_CONNTRACK_SECMARK
 #endif
 		nf_conntrack_get(&conntrack->master->ct_general);
 		NF_CT_STAT_INC(expect_new);
-	} else
+	} else {
+		struct nf_conn_help *help = nfct_help(conntrack);
+
+		if (help)
+			help->helper = __nf_ct_helper_find(&repl_tuple);
 		NF_CT_STAT_INC(new);
+	}
 
 	/* Overload tuple linked list to put us in unconfirmed list. */
 	list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);

[NETFILTER 03/04]: ctnetlink: fix reference count leak

[Patrick McHardy]

[NETFILTER]: ctnetlink: fix reference count leak

When NFA_NEST exceeds the skb size the protocol reference is leaked.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 7d79b94fc3d91498b8f2ff655839ad84d3390b13
tree 696fa16de7c8051fee047121a9747301c65b94f5
parent a88ad2f562c2c108f76adfda4d5ee954e09e6d98
author Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 18:56:26 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:45 +0100

 net/ipv4/netfilter/ip_conntrack_netlink.c |    1 +
 net/netfilter/nf_conntrack_netlink.c      |    1 +
 2 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 262d0d4..55f0ae6 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -153,6 +153,7 @@ ctnetlink_dump_protoinfo(struct sk_buff 
 	return ret;
 
 nfattr_failure:
+	ip_conntrack_proto_put(proto);
 	return -1;
 }
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 77a46ee..ab67c2b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -161,6 +161,7 @@ ctnetlink_dump_protoinfo(struct sk_buff 
 	return ret;
 
 nfattr_failure:
+	nf_ct_proto_put(proto);
 	return -1;
 }
 

[NETFILTER 04/04]: conntrack: fix refcount leak when finding expectation

[Patrick McHardy]

[NETFILTER]: conntrack: fix refcount leak when finding expectation

All users of __{ip,nf}_conntrack_expect_find() don't expect that
it increments the reference count of expectation.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit a9c71b046b2ba5ced529e0cf53a061c02b2bbf4b
tree f0d31367b29c1ebccdd3aaa35771a2f5adfcae11
parent 7d79b94fc3d91498b8f2ff655839ad84d3390b13
author Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Mon, 27 Nov 2006 18:56:27 +0100
committer Patrick McHardy <kaber@trash.net> Mon, 27 Nov 2006 19:10:45 +0100

 net/ipv4/netfilter/ip_conntrack_core.c |    6 +++---
 net/netfilter/nf_conntrack_core.c      |    6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 143c466..8b848aa 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -225,10 +225,8 @@ __ip_conntrack_expect_find(const struct 
 	struct ip_conntrack_expect *i;
 	
 	list_for_each_entry(i, &ip_conntrack_expect_list, list) {
-		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
+		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
 			return i;
-		}
 	}
 	return NULL;
 }
@@ -241,6 +239,8 @@ ip_conntrack_expect_find(const struct ip
 	
 	read_lock_bh(&ip_conntrack_lock);
 	i = __ip_conntrack_expect_find(tuple);
+	if (i)
+		atomic_inc(&i->use);
 	read_unlock_bh(&ip_conntrack_lock);
 
 	return i;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0f58307..de0567b 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -469,10 +469,8 @@ __nf_conntrack_expect_find(const struct 
 	struct nf_conntrack_expect *i;
 	
 	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
-		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
+		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
 			return i;
-		}
 	}
 	return NULL;
 }
@@ -485,6 +483,8 @@ nf_conntrack_expect_find(const struct nf
 	
 	read_lock_bh(&nf_conntrack_lock);
 	i = __nf_conntrack_expect_find(tuple);
+	if (i)
+		atomic_inc(&i->use);
 	read_unlock_bh(&nf_conntrack_lock);
 
 	return i;

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Mon, 27 Nov 2006 19:20:53 +0100 (MET)

> following are a few small netfilter fixes for 2.6.19, fixing multiple
> refcount leaks and a nf_conntrack helper assignment race which can
> lead to use-after-free.
> 
> Please apply, thanks.

Applied, thanks a lot Patrick.