From: Hyunwoo Kim <imv4bel@gmail.com>
To: pablo@netfilter.org, fw@strlen.de, phil@nwl.cc,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, horms@kernel.org
Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org, imv4bel@gmail.com
Subject: [PATCH net] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
Date: Sun, 8 Mar 2026 02:21:37 +0900 [thread overview]
Message-ID: <aaxeoWfcuQJcZlkw@v4bel> (raw)
ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the
netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the
conntrack reference immediately after netlink_dump_start(). When the
dump spans multiple rounds, the second recvmsg() triggers the dump
callback which dereferences the now-freed conntrack via nfct_help(ct),
leading to a use-after-free on ct->ext.
The bug is that the netlink_dump_control has no .start or .done
callbacks to manage the conntrack reference across dump rounds. Other
dump functions in the same file (e.g. ctnetlink_get_conntrack) properly
use .start/.done callbacks for this purpose.
Fix this by adding .start and .done callbacks that hold and release the
conntrack reference for the duration of the dump, and move the
nfct_help() call after the cb->args[0] early-return check in the dump
callback to avoid dereferencing ct->ext unnecessarily.
KASAN report:
[ 3.484270] BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0
[ 3.484508] Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133
[ 3.484717]
[ 3.484772] CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY
[ 3.484775] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 3.484778] Call Trace:
[ 3.484782] <TASK>
[ 3.484785] dump_stack_lvl+0x64/0x80
[ 3.484797] print_report+0xce/0x660
[ 3.484804] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 3.484811] ? __kmalloc_large_node_noprof+0x1f/0xc0
[ 3.484818] ? __virt_addr_valid+0xef/0x1a0
[ 3.484825] ? ctnetlink_exp_ct_dump_table+0x4f/0x2e0
[ 3.484827] kasan_report+0xce/0x100
[ 3.484829] ? ctnetlink_exp_ct_dump_table+0x4f/0x2e0
[ 3.484833] ctnetlink_exp_ct_dump_table+0x4f/0x2e0
[ 3.484836] netlink_dump+0x333/0x880
[ 3.484841] ? __pfx_netlink_dump+0x10/0x10
[ 3.484844] ? netlink_recvmsg+0x27c/0x4b0
[ 3.484847] ? kmem_cache_free+0x100/0x440
[ 3.484849] ? netlink_recvmsg+0x27c/0x4b0
[ 3.484851] netlink_recvmsg+0x3e2/0x4b0
[ 3.484855] ? aa_sk_perm+0x184/0x450
[ 3.484862] ? __pfx_netlink_recvmsg+0x10/0x10
[ 3.484864] ? __pfx_aa_sk_perm+0x10/0x10
[ 3.484866] ? mutex_unlock+0x80/0xd0
[ 3.484870] ? __pfx_netlink_recvmsg+0x10/0x10
[ 3.484873] sock_recvmsg+0xde/0xf0
[ 3.484880] __sys_recvfrom+0x150/0x200
[ 3.484882] ? __pfx___sys_recvfrom+0x10/0x10
[ 3.484885] ? ksys_write+0xe1/0x160
[ 3.484889] ? __pfx_ksys_write+0x10/0x10
[ 3.484891] __x64_sys_recvfrom+0x76/0x90
[ 3.484893] do_syscall_64+0xc3/0x6e0
[ 3.484898] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 3.484903] RIP: 0033:0x42366d
[ 3.484907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d fd 19 09 00 00 41 89 ca 74 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89
[ 3.484908] RSP: 002b:00007fffb7e89be8 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
[ 3.484915] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000042366d
[ 3.484916] RDX: 0000000000004000 RSI: 00007fffb7e8ac30 RDI: 0000000000000003
[ 3.484920] RBP: 00007fffb7e8ec50 R08: 0000000000000000 R09: 0000000000000000
[ 3.484921] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffb7e8ed68
[ 3.484922] R13: 00007fffb7e8ed78 R14: 00000000004af868 R15: 0000000000000001
[ 3.484924] </TASK>
[ 3.484925]
[ 3.491086] Allocated by task 133:
[ 3.491190] kasan_save_stack+0x33/0x60
[ 3.491308] kasan_save_track+0x14/0x30
[ 3.491425] __kasan_slab_alloc+0x6e/0x70
[ 3.491545] kmem_cache_alloc_noprof+0x134/0x440
[ 3.491683] __nf_conntrack_alloc+0xa8/0x2b0
[ 3.491815] ctnetlink_create_conntrack+0xa1/0x900
[ 3.491959] ctnetlink_new_conntrack+0x3cf/0x7d0
[ 3.492097] nfnetlink_rcv_msg+0x48e/0x510
[ 3.492223] netlink_rcv_skb+0xc9/0x1f0
[ 3.492339] nfnetlink_rcv+0xdb/0x220
[ 3.492450] netlink_unicast+0x3ec/0x590
[ 3.492568] netlink_sendmsg+0x397/0x690
[ 3.492687] ____sys_sendmsg+0x538/0x550
[ 3.492807] ___sys_sendmsg+0xfc/0x170
[ 3.492921] __sys_sendmsg+0xf4/0x180
[ 3.493032] do_syscall_64+0xc3/0x6e0
[ 3.493143] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 3.493293]
[ 3.493344] Freed by task 0:
[ 3.493433] kasan_save_stack+0x33/0x60
[ 3.493549] kasan_save_track+0x14/0x30
[ 3.493666] kasan_save_free_info+0x3b/0x60
[ 3.493795] __kasan_slab_free+0x43/0x70
[ 3.493913] slab_free_after_rcu_debug+0xad/0x1e0
[ 3.494051] rcu_core+0x5c3/0x9c0
[ 3.494148] handle_softirqs+0x148/0x460
[ 3.494260] __irq_exit_rcu+0x97/0xf0
[ 3.494363] sysvec_apic_timer_interrupt+0x71/0x90
[ 3.494495] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 3.494635]
[ 3.494682] Last potentially related work creation:
[ 3.494815] kasan_save_stack+0x33/0x60
[ 3.494923] kasan_record_aux_stack+0x8c/0xa0
[ 3.495044] kmem_cache_free+0x1f5/0x440
[ 3.495153] nf_conntrack_free+0xc1/0x140
[ 3.495264] ctnetlink_del_conntrack+0x4c4/0x520
[ 3.495391] nfnetlink_rcv_msg+0x48e/0x510
[ 3.495505] netlink_rcv_skb+0xc9/0x1f0
[ 3.495611] nfnetlink_rcv+0xdb/0x220
[ 3.495714] netlink_unicast+0x3ec/0x590
[ 3.495823] netlink_sendmsg+0x397/0x690
[ 3.495932] ____sys_sendmsg+0x538/0x550
[ 3.496041] ___sys_sendmsg+0xfc/0x170
[ 3.496145] __sys_sendmsg+0xf4/0x180
[ 3.496248] do_syscall_64+0xc3/0x6e0
[ 3.496350] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 3.496487]
[ 3.496534] The buggy address belongs to the object at ffff88810597eb40
[ 3.496534] which belongs to the cache nf_conntrack of size 248
[ 3.496866] The buggy address is located 176 bytes inside of
[ 3.496866] freed 248-byte region [ffff88810597eb40, ffff88810597ec38)
[ 3.497187]
[ 3.497234] The buggy address belongs to the physical page:
[ 3.497385] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810597e140 pfn:0x10597e
[ 3.497632] flags: 0x200000000000200(workingset|node=0|zone=2)
[ 3.497794] page_type: f5(slab)
[ 3.497884] raw: 0200000000000200 ffff88810463fb40 ffff888104640410 ffff888104640410
[ 3.498089] raw: ffff88810597e140 00000008000c0004 00000000f5000000 0000000000000000
[ 3.498293] page dumped because: kasan: bad access detected
[ 3.498442]
[ 3.498489] Memory state around the buggy address:
[ 3.498619] ffff88810597ea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 3.498812] ffff88810597eb00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 3.499005] >ffff88810597eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3.499197] ^
[ 3.499379] ffff88810597ec00: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[ 3.499573] ffff88810597ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 3.499765] ==================================================================
Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
net/netfilter/nf_conntrack_netlink.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c9d725fc2d71..65aa44a12d01 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3212,7 +3212,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
{
struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
struct nf_conn *ct = cb->data;
- struct nf_conn_help *help = nfct_help(ct);
+ struct nf_conn_help *help;
u_int8_t l3proto = nfmsg->nfgen_family;
unsigned long last_id = cb->args[1];
struct nf_conntrack_expect *exp;
@@ -3220,6 +3220,10 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
if (cb->args[0])
return 0;
+ help = nfct_help(ct);
+ if (!help)
+ return 0;
+
rcu_read_lock();
restart:
@@ -3249,6 +3253,24 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
return skb->len;
}
+static int ctnetlink_dump_exp_ct_start(struct netlink_callback *cb)
+{
+ struct nf_conn *ct = cb->data;
+
+ if (!refcount_inc_not_zero(&ct->ct_general.use))
+ return -ENOENT;
+ return 0;
+}
+
+static int ctnetlink_dump_exp_ct_done(struct netlink_callback *cb)
+{
+ struct nf_conn *ct = cb->data;
+
+ if (ct)
+ nf_ct_put(ct);
+ return 0;
+}
+
static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
struct sk_buff *skb,
const struct nlmsghdr *nlh,
@@ -3264,6 +3286,8 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
struct nf_conntrack_zone zone;
struct netlink_dump_control c = {
.dump = ctnetlink_exp_ct_dump_table,
+ .start = ctnetlink_dump_exp_ct_start,
+ .done = ctnetlink_dump_exp_ct_done,
};
err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
--
2.43.0
reply other threads:[~2026-03-07 17:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aaxeoWfcuQJcZlkw@v4bel \
--to=imv4bel@gmail.com \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.