From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
To: Florian Westphal <fw@strlen.de>, netdev@vger.kernel.org
Cc: stephen@networkplumber.org, Felix Fietkau <nbd@openwrt.org>,
Zefir Kurtisi <zefir.kurtisi@neratec.com>
Subject: Re: [PATCH -next] bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict
Date: Sat, 12 Mar 2016 22:20:08 +0300 [thread overview]
Message-ID: <56E46BE8.7070403@cogentembedded.com> (raw)
In-Reply-To: <1457777682-24689-1-git-send-email-fw@strlen.de>
Hello.
On 03/12/2016 01:14 PM, Florian Westphal wrote:
> Zefir Kurtisi reported kernel panic with an openwrt specific patch.
> However, it turns out that mainline has a similar bug waiting to happen.
>
> Once NF_HOOK() returns the skb is in undefined state and must not be
> used. Moreover, the okfn must consume the skb to support async
> processing (NF_QUEUE).
>
> Current okfn in this spot doesn't consume it and caller assumes that
> NF_HOOK return value tells us if skb was freed or not, but thats wrong.
That's.
> It "works" because no in-tree user registers a NFPROTO_BRIDGE hook at
> LOCAL_IN that returns STOLEN or NF_QUEUE verdicts.
>
> Once we add NF_QUEUE support for nftables bridge this will break --
> NF_QUEUE holds the skb for async processing, caller will erronoulsy
Erroneously.
> return RX_HANDLER_PASS and on reinject netfilter will access free'd skb.
>
> Fix this by pushing skb up the stack in the okfn instead.
>
> NB: It also seems dubious to use LOCAL_IN while bypassing PRE_ROUTING
> completely in this case but this is how its been forever so it seems
> preferable to not change this.
>
> Cc: Felix Fietkau <nbd@openwrt.org>
> Cc: Zefir Kurtisi <zefir.kurtisi@neratec.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
[...]
MBR, Sergei
next prev parent reply other threads:[~2016-03-12 19:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-12 10:14 [PATCH -next] bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict Florian Westphal
2016-03-12 19:20 ` Sergei Shtylyov [this message]
2016-03-14 15:28 ` Zefir Kurtisi
2016-03-14 19:47 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56E46BE8.7070403@cogentembedded.com \
--to=sergei.shtylyov@cogentembedded.com \
--cc=fw@strlen.de \
--cc=nbd@openwrt.org \
--cc=netdev@vger.kernel.org \
--cc=stephen@networkplumber.org \
--cc=zefir.kurtisi@neratec.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.