From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org, Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
netfilter-devel@vger.kernel.org
Subject: Re: [PATCH net 00/10] netfilter: updates for net
Date: Tue, 10 Mar 2026 11:56:03 +0100 [thread overview]
Message-ID: <aa_4w9gXCkzQ06Nk@chamomile> (raw)
In-Reply-To: <20260309210845.15657-1-fw@strlen.de>
Hi,
On Mon, Mar 09, 2026 at 10:08:35PM +0100, Florian Westphal wrote:
> 7-9) fix access bugs in the ctnetlink expectation handling.
> Problem is that while RCU prevents the referenced nf_conn entry
> from going way, nf_conn entries have an extension area that can
> only be safely accessed if the cpu holds a reference to the
> conntrack. Else the extension area can be free'd at any time.
> Fix is to grab references before the accesses happen.
> These bugs are old, v3.10 resp. even pre-git days.
> All fixes from Hyunwoo Kim.
I am not sure 7-9 are correct.
nfct_help() is accessed via exp->master in other existing paths,
I think these fixes are papering an underlying problem since the
typesafe rcu infrastructure was introduced in nf_conntrack.
next prev parent reply other threads:[~2026-03-10 10:56 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-09 21:08 [PATCH net 00/10] netfilter: updates for net Florian Westphal
2026-03-09 21:08 ` [PATCH net 01/10] netfilter: nf_tables: Fix for duplicate device in netdev hooks Florian Westphal
2026-03-09 21:08 ` [PATCH net 02/10] netfilter: nf_tables: always walk all pending catchall elements Florian Westphal
2026-03-09 21:08 ` [PATCH net 03/10] netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() Florian Westphal
2026-03-09 21:08 ` [PATCH net 04/10] netfilter: x_tables: guard option walkers against 1-byte tail reads Florian Westphal
2026-03-09 21:08 ` [PATCH net 05/10] netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path Florian Westphal
2026-03-09 21:08 ` [PATCH net 06/10] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() Florian Westphal
2026-03-09 21:08 ` [PATCH net 07/10] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Florian Westphal
2026-03-09 21:08 ` [PATCH net 08/10] netfilter: ctnetlink: fix use-after-free of exp->master in single expectation GET Florian Westphal
2026-03-09 21:08 ` [PATCH net 09/10] netfilter: ctnetlink: fix use-after-free of exp->master in expectation dump Florian Westphal
2026-03-09 21:08 ` [PATCH net 10/10] netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels Florian Westphal
2026-03-10 10:56 ` Pablo Neira Ayuso [this message]
2026-03-10 12:33 ` [PATCH net 00/10] netfilter: updates for net Florian Westphal
2026-03-10 12:41 ` Pablo Neira Ayuso
2026-03-10 12:48 ` Florian Westphal
2026-03-10 13:02 ` Florian Westphal
-- strict thread matches above, loose matches on Subject: below --
2026-05-22 10:42 Florian Westphal
2026-05-23 12:55 ` Florian Westphal
2026-02-17 16:32 Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aa_4w9gXCkzQ06Nk@chamomile \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.