Re: [PATCH nf] netfilter: nfnetlink_queue: keep socket ownership when expanding skb

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> nfqnl_mangle() replaces the skb with skb_copy_expand() when a verdict
> grows a packet beyond its tailroom. skb_copy_expand() does not copy
> skb->sk, so the replacement is unowned and freeing the original drops
> its socket memory charge.
> 
> The expanded packet is no longer associated with the process that sent
> it. Therefore xt_owner or xt_cgroup and other socket based matches in
> later rules no longer matches and a later NFQUEUE reports no uid/gid. In
> addition, the expanded packet's memory is not counted towards the
> sender's SO_SNDBUF limit, so the sender can keep producing them while
> they sit in a queue.

A proper fix requires wmem/truesize fixups and will have to deal with
wmem-accounted vs. non-wmem accounted.

I dont think its worth fixing this, there are many other ways to
get OOM when you have CAP_NET_ADMIN.