* [PATCH bpf v3] bpf: Fix netns reference imbalance in conntrack kfuncs
@ 2026-07-31 16:09 Chengfeng Ye
2026-07-31 20:41 ` bot+bpf-ci
2026-07-31 20:52 ` Emil Tsalapatis
0 siblings, 2 replies; 3+ messages in thread
From: Chengfeng Ye @ 2026-07-31 16:09 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal, Phil Sutter, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Stanislav Fomichev, Kumar Kartikeya Dwivedi,
Lorenzo Bianconi
Cc: netfilter-devel, coreteam, netdev, linux-kernel, bpf,
Chengfeng Ye
The opts argument of the BPF conntrack kfuncs can point to a shared
map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
opts->netns_id separately when acquiring and releasing the network
namespace reference.
The reference imbalance can occur as follows:
CPU 0 CPU 1
read opts->netns_id (-1)
skip get_net_ns_by_id()
write opts->netns_id (id)
read opts->netns_id (id)
put_net(net) /* no matching get */
The reverse transition leaks the reference. Repeating the unmatched put
can destroy a live namespace and crash later users.
The kernel reported:
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
Call Trace:
__sys_bpf+0x1662/0x50c0
__x64_sys_bpf+0x73/0xb0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: Fatal exception
Snapshot every input field of opts with READ_ONCE() before validating or
using it. The netns_id snapshot keeps the namespace get/put pair
balanced, while the other snapshots keep the remaining options from
changing partway through an invocation. The individual reads can still
observe an inconsistent combination during a concurrent update, but each
selected field value remains stable for that invocation.
Fixes: aed8ee7feb44 ("net: netfilter: Deduplicate code in bpf_{xdp,skb}_ct_lookup")
Fixes: d7e79c97c00c ("net: netfilter: Add kfuncs to allocate and insert CT")
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
Changes in v3:
- Inline the one-use reserved-byte READ_ONCE() checks instead of
copying them into a local array.
- Reorder the new local declarations in reverse-xmas-tree order.
Link: https://lore.kernel.org/bpf/20260730082958.2065194-1-nicoyip.dev@gmail.com/ [v2]
Changes in v2:
- Snapshot l4proto, ct_zone_id, ct_zone_dir, and the reserved bytes in
addition to netns_id, as requested in review.
- Rebase onto bpf/master.
Link: https://lore.kernel.org/bpf/20260729163141.213611-1-nicoyip.dev@gmail.com/ [v1]
Please queue this fix for stable kernels.
net/netfilter/nf_conntrack_bpf.c | 72 +++++++++++++++++++++-----------
1 file changed, 48 insertions(+), 24 deletions(-)
diff --git a/net/netfilter/nf_conntrack_bpf.c b/net/netfilter/nf_conntrack_bpf.c
index f98d1d4b42c3..c2df7c948281 100644
--- a/net/netfilter/nf_conntrack_bpf.c
+++ b/net/netfilter/nf_conntrack_bpf.c
@@ -122,42 +122,54 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
struct nf_conntrack_tuple otuple, rtuple;
struct nf_conntrack_zone ct_zone;
struct nf_conn *ct;
+ u8 ct_zone_dir = 0;
+ u16 ct_zone_id;
+ s32 netns_id;
+ u8 l4proto;
int err;
if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
return ERR_PTR(-EINVAL);
+
+ netns_id = READ_ONCE(opts->netns_id);
+ l4proto = READ_ONCE(opts->l4proto);
+ ct_zone_id = READ_ONCE(opts->ct_zone_id);
if (opts_len == NF_BPF_CT_OPTS_SZ) {
- if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
+ ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
+ if (READ_ONCE(opts->reserved[0]) ||
+ READ_ONCE(opts->reserved[1]) ||
+ READ_ONCE(opts->reserved[2]))
return ERR_PTR(-EINVAL);
} else {
- if (opts->ct_zone_id)
+ if (ct_zone_id)
return ERR_PTR(-EINVAL);
}
- if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
+ if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
return ERR_PTR(-EINVAL);
- err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
+ err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
IP_CT_DIR_ORIGINAL, &otuple);
if (err < 0)
return ERR_PTR(err);
- err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
+ err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
IP_CT_DIR_REPLY, &rtuple);
if (err < 0)
return ERR_PTR(err);
- if (opts->netns_id >= 0) {
- net = get_net_ns_by_id(net, opts->netns_id);
+ if (netns_id >= 0) {
+ net = get_net_ns_by_id(net, netns_id);
if (unlikely(!net))
return ERR_PTR(-ENONET);
}
if (opts_len == NF_BPF_CT_OPTS_SZ) {
- if (opts->ct_zone_dir == 0)
- opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
- nf_ct_zone_init(&ct_zone,
- opts->ct_zone_id, opts->ct_zone_dir, 0);
+ if (ct_zone_dir == 0) {
+ ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
+ opts->ct_zone_dir = ct_zone_dir;
+ }
+ nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
} else {
ct_zone = nf_ct_zone_dflt;
}
@@ -171,7 +183,7 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
__nf_ct_set_timeout(ct, timeout * HZ);
out:
- if (opts->netns_id >= 0)
+ if (netns_id >= 0)
put_net(net);
return ct;
@@ -186,46 +198,58 @@ static struct nf_conn *__bpf_nf_ct_lookup(struct net *net,
struct nf_conntrack_tuple tuple;
struct nf_conntrack_zone ct_zone;
struct nf_conn *ct;
+ u8 ct_zone_dir = 0;
+ u16 ct_zone_id;
+ s32 netns_id;
+ u8 l4proto;
int err;
if (!opts || !bpf_tuple)
return ERR_PTR(-EINVAL);
if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
return ERR_PTR(-EINVAL);
+
+ netns_id = READ_ONCE(opts->netns_id);
+ l4proto = READ_ONCE(opts->l4proto);
+ ct_zone_id = READ_ONCE(opts->ct_zone_id);
if (opts_len == NF_BPF_CT_OPTS_SZ) {
- if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
+ ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
+ if (READ_ONCE(opts->reserved[0]) ||
+ READ_ONCE(opts->reserved[1]) ||
+ READ_ONCE(opts->reserved[2]))
return ERR_PTR(-EINVAL);
} else {
- if (opts->ct_zone_id)
+ if (ct_zone_id)
return ERR_PTR(-EINVAL);
}
- if (unlikely(opts->l4proto != IPPROTO_TCP && opts->l4proto != IPPROTO_UDP))
+ if (unlikely(l4proto != IPPROTO_TCP && l4proto != IPPROTO_UDP))
return ERR_PTR(-EPROTO);
- if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
+ if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
return ERR_PTR(-EINVAL);
- err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
+ err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
IP_CT_DIR_ORIGINAL, &tuple);
if (err < 0)
return ERR_PTR(err);
- if (opts->netns_id >= 0) {
- net = get_net_ns_by_id(net, opts->netns_id);
+ if (netns_id >= 0) {
+ net = get_net_ns_by_id(net, netns_id);
if (unlikely(!net))
return ERR_PTR(-ENONET);
}
if (opts_len == NF_BPF_CT_OPTS_SZ) {
- if (opts->ct_zone_dir == 0)
- opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
- nf_ct_zone_init(&ct_zone,
- opts->ct_zone_id, opts->ct_zone_dir, 0);
+ if (ct_zone_dir == 0) {
+ ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
+ opts->ct_zone_dir = ct_zone_dir;
+ }
+ nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
} else {
ct_zone = nf_ct_zone_dflt;
}
hash = nf_conntrack_find_get(net, &ct_zone, &tuple);
- if (opts->netns_id >= 0)
+ if (netns_id >= 0)
put_net(net);
if (!hash)
return ERR_PTR(-ENOENT);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH bpf v3] bpf: Fix netns reference imbalance in conntrack kfuncs
2026-07-31 16:09 [PATCH bpf v3] bpf: Fix netns reference imbalance in conntrack kfuncs Chengfeng Ye
@ 2026-07-31 20:41 ` bot+bpf-ci
2026-07-31 20:52 ` Emil Tsalapatis
1 sibling, 0 replies; 3+ messages in thread
From: bot+bpf-ci @ 2026-07-31 20:41 UTC (permalink / raw)
To: nicoyip.dev, pablo, fw, phil, davem, edumazet, kuba, pabeni,
horms, ast, daniel, hawk, john.fastabend, sdf, memxor, lorenzo
Cc: netfilter-devel, coreteam, netdev, linux-kernel, bpf, nicoyip.dev,
ast, andrii, daniel, martin.lau, eddyz87, yonghong.song, clm,
ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 4374 bytes --]
> diff --git a/net/netfilter/nf_conntrack_bpf.c b/net/netfilter/nf_conntrack_bpf.c
> --- a/net/netfilter/nf_conntrack_bpf.c
> +++ b/net/netfilter/nf_conntrack_bpf.c
> @@ -122,42 +122,54 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
> struct nf_conntrack_tuple otuple, rtuple;
> struct nf_conntrack_zone ct_zone;
> struct nf_conn *ct;
> + u8 ct_zone_dir = 0;
> + u16 ct_zone_id;
> + s32 netns_id;
> + u8 l4proto;
> int err;
>
> if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
> return ERR_PTR(-EINVAL);
> +
> + netns_id = READ_ONCE(opts->netns_id);
> + l4proto = READ_ONCE(opts->l4proto);
> + ct_zone_id = READ_ONCE(opts->ct_zone_id);
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
> + ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
> + if (READ_ONCE(opts->reserved[0]) ||
> + READ_ONCE(opts->reserved[1]) ||
> + READ_ONCE(opts->reserved[2]))
> return ERR_PTR(-EINVAL);
> } else {
> - if (opts->ct_zone_id)
> + if (ct_zone_id)
> return ERR_PTR(-EINVAL);
> }
>
> - if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
> + if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
> return ERR_PTR(-EINVAL);
[ ... ]
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->ct_zone_dir == 0)
> - opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> - nf_ct_zone_init(&ct_zone,
> - opts->ct_zone_id, opts->ct_zone_dir, 0);
> + if (ct_zone_dir == 0) {
> + ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> + opts->ct_zone_dir = ct_zone_dir;
> + }
> + nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
> } else {
> ct_zone = nf_ct_zone_dflt;
> }
[ ... ]
> @@ -186,46 +198,58 @@ static struct nf_conn *__bpf_nf_ct_lookup(struct net *net,
> struct nf_conntrack_tuple tuple;
> struct nf_conntrack_zone ct_zone;
> struct nf_conn *ct;
> + u8 ct_zone_dir = 0;
> + u16 ct_zone_id;
> + s32 netns_id;
> + u8 l4proto;
> int err;
>
> if (!opts || !bpf_tuple)
> return ERR_PTR(-EINVAL);
> if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
> return ERR_PTR(-EINVAL);
> +
> + netns_id = READ_ONCE(opts->netns_id);
> + l4proto = READ_ONCE(opts->l4proto);
> + ct_zone_id = READ_ONCE(opts->ct_zone_id);
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
> + ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
> + if (READ_ONCE(opts->reserved[0]) ||
> + READ_ONCE(opts->reserved[1]) ||
> + READ_ONCE(opts->reserved[2]))
> return ERR_PTR(-EINVAL);
> } else {
> - if (opts->ct_zone_id)
> + if (ct_zone_id)
> return ERR_PTR(-EINVAL);
> }
> - if (unlikely(opts->l4proto != IPPROTO_TCP && opts->l4proto != IPPROTO_UDP))
> + if (unlikely(l4proto != IPPROTO_TCP && l4proto != IPPROTO_UDP))
> return ERR_PTR(-EPROTO);
> - if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
> + if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
> return ERR_PTR(-EINVAL);
[ ... ]
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->ct_zone_dir == 0)
> - opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> - nf_ct_zone_init(&ct_zone,
> - opts->ct_zone_id, opts->ct_zone_dir, 0);
> + if (ct_zone_dir == 0) {
> + ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> + opts->ct_zone_dir = ct_zone_dir;
> + }
> + nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
> } else {
> ct_zone = nf_ct_zone_dflt;
> }
This isn't a bug, but both __bpf_nf_ct_alloc_entry() and
__bpf_nf_ct_lookup() now snapshot and validate the same five opts fields
in the same order with the same declarations (u8 ct_zone_dir = 0; u16
ct_zone_id; s32 netns_id; u8 l4proto;), and both carry the identical
zone-init block. The two functions now share about 25 lines of duplicated
code, and the patch grows each copy from roughly 8 lines to roughly 14.
Would it be worth factoring the snapshot and validation into a shared
helper so a future opts field only has to be handled once? One of the
Fixes targets, aed8ee7feb44, was itself a de-duplication of similar code
in this file, so the direction of travel here has been toward sharing
rather than copying.
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/30647492237
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH bpf v3] bpf: Fix netns reference imbalance in conntrack kfuncs
2026-07-31 16:09 [PATCH bpf v3] bpf: Fix netns reference imbalance in conntrack kfuncs Chengfeng Ye
2026-07-31 20:41 ` bot+bpf-ci
@ 2026-07-31 20:52 ` Emil Tsalapatis
1 sibling, 0 replies; 3+ messages in thread
From: Emil Tsalapatis @ 2026-07-31 20:52 UTC (permalink / raw)
To: Chengfeng Ye, Pablo Neira Ayuso, Florian Westphal, Phil Sutter,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
Kumar Kartikeya Dwivedi, Lorenzo Bianconi
Cc: netfilter-devel, coreteam, netdev, linux-kernel, bpf
On Fri Jul 31, 2026 at 12:09 PM EDT, Chengfeng Ye wrote:
> The opts argument of the BPF conntrack kfuncs can point to a shared
> map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
> opts->netns_id separately when acquiring and releasing the network
> namespace reference.
>
> The reference imbalance can occur as follows:
>
> CPU 0 CPU 1
> read opts->netns_id (-1)
> skip get_net_ns_by_id()
> write opts->netns_id (id)
> read opts->netns_id (id)
> put_net(net) /* no matching get */
>
> The reverse transition leaks the reference. Repeating the unmatched put
> can destroy a live namespace and crash later users.
>
> The kernel reported:
>
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
> RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
> Call Trace:
> __sys_bpf+0x1662/0x50c0
> __x64_sys_bpf+0x73/0xb0
> do_syscall_64+0xf9/0x540
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Kernel panic - not syncing: Fatal exception
>
> Snapshot every input field of opts with READ_ONCE() before validating or
> using it. The netns_id snapshot keeps the namespace get/put pair
> balanced, while the other snapshots keep the remaining options from
> changing partway through an invocation. The individual reads can still
> observe an inconsistent combination during a concurrent update, but each
> selected field value remains stable for that invocation.
>
> Fixes: aed8ee7feb44 ("net: netfilter: Deduplicate code in bpf_{xdp,skb}_ct_lookup")
> Fixes: d7e79c97c00c ("net: netfilter: Add kfuncs to allocate and insert CT")
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
> ---
> Changes in v3:
> - Inline the one-use reserved-byte READ_ONCE() checks instead of
> copying them into a local array.
> - Reorder the new local declarations in reverse-xmas-tree order.
>
> Link: https://lore.kernel.org/bpf/20260730082958.2065194-1-nicoyip.dev@gmail.com/ [v2]
>
> Changes in v2:
> - Snapshot l4proto, ct_zone_id, ct_zone_dir, and the reserved bytes in
> addition to netns_id, as requested in review.
> - Rebase onto bpf/master.
>
> Link: https://lore.kernel.org/bpf/20260729163141.213611-1-nicoyip.dev@gmail.com/ [v1]
>
> Please queue this fix for stable kernels.
>
> net/netfilter/nf_conntrack_bpf.c | 72 +++++++++++++++++++++-----------
> 1 file changed, 48 insertions(+), 24 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_bpf.c b/net/netfilter/nf_conntrack_bpf.c
> index f98d1d4b42c3..c2df7c948281 100644
> --- a/net/netfilter/nf_conntrack_bpf.c
> +++ b/net/netfilter/nf_conntrack_bpf.c
> @@ -122,42 +122,54 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
> struct nf_conntrack_tuple otuple, rtuple;
> struct nf_conntrack_zone ct_zone;
> struct nf_conn *ct;
> + u8 ct_zone_dir = 0;
> + u16 ct_zone_id;
> + s32 netns_id;
> + u8 l4proto;
> int err;
>
> if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
> return ERR_PTR(-EINVAL);
> +
> + netns_id = READ_ONCE(opts->netns_id);
> + l4proto = READ_ONCE(opts->l4proto);
> + ct_zone_id = READ_ONCE(opts->ct_zone_id);
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
> + ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
> + if (READ_ONCE(opts->reserved[0]) ||
> + READ_ONCE(opts->reserved[1]) ||
> + READ_ONCE(opts->reserved[2]))
> return ERR_PTR(-EINVAL);
> } else {
> - if (opts->ct_zone_id)
> + if (ct_zone_id)
> return ERR_PTR(-EINVAL);
> }
>
> - if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
> + if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
> return ERR_PTR(-EINVAL);
>
> - err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
> + err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
> IP_CT_DIR_ORIGINAL, &otuple);
> if (err < 0)
> return ERR_PTR(err);
>
> - err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
> + err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
> IP_CT_DIR_REPLY, &rtuple);
> if (err < 0)
> return ERR_PTR(err);
>
> - if (opts->netns_id >= 0) {
> - net = get_net_ns_by_id(net, opts->netns_id);
> + if (netns_id >= 0) {
> + net = get_net_ns_by_id(net, netns_id);
> if (unlikely(!net))
> return ERR_PTR(-ENONET);
> }
>
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->ct_zone_dir == 0)
> - opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> - nf_ct_zone_init(&ct_zone,
> - opts->ct_zone_id, opts->ct_zone_dir, 0);
> + if (ct_zone_dir == 0) {
> + ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> + opts->ct_zone_dir = ct_zone_dir;
> + }
> + nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
> } else {
> ct_zone = nf_ct_zone_dflt;
> }
> @@ -171,7 +183,7 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
> __nf_ct_set_timeout(ct, timeout * HZ);
>
> out:
> - if (opts->netns_id >= 0)
> + if (netns_id >= 0)
> put_net(net);
>
> return ct;
> @@ -186,46 +198,58 @@ static struct nf_conn *__bpf_nf_ct_lookup(struct net *net,
> struct nf_conntrack_tuple tuple;
> struct nf_conntrack_zone ct_zone;
> struct nf_conn *ct;
> + u8 ct_zone_dir = 0;
> + u16 ct_zone_id;
> + s32 netns_id;
> + u8 l4proto;
> int err;
>
> if (!opts || !bpf_tuple)
> return ERR_PTR(-EINVAL);
> if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
> return ERR_PTR(-EINVAL);
> +
> + netns_id = READ_ONCE(opts->netns_id);
> + l4proto = READ_ONCE(opts->l4proto);
> + ct_zone_id = READ_ONCE(opts->ct_zone_id);
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
> + ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
> + if (READ_ONCE(opts->reserved[0]) ||
> + READ_ONCE(opts->reserved[1]) ||
> + READ_ONCE(opts->reserved[2]))
> return ERR_PTR(-EINVAL);
> } else {
> - if (opts->ct_zone_id)
> + if (ct_zone_id)
> return ERR_PTR(-EINVAL);
> }
> - if (unlikely(opts->l4proto != IPPROTO_TCP && opts->l4proto != IPPROTO_UDP))
> + if (unlikely(l4proto != IPPROTO_TCP && l4proto != IPPROTO_UDP))
> return ERR_PTR(-EPROTO);
> - if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
> + if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
> return ERR_PTR(-EINVAL);
>
> - err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
> + err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
> IP_CT_DIR_ORIGINAL, &tuple);
> if (err < 0)
> return ERR_PTR(err);
>
> - if (opts->netns_id >= 0) {
> - net = get_net_ns_by_id(net, opts->netns_id);
> + if (netns_id >= 0) {
> + net = get_net_ns_by_id(net, netns_id);
> if (unlikely(!net))
> return ERR_PTR(-ENONET);
> }
>
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->ct_zone_dir == 0)
> - opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> - nf_ct_zone_init(&ct_zone,
> - opts->ct_zone_id, opts->ct_zone_dir, 0);
> + if (ct_zone_dir == 0) {
> + ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> + opts->ct_zone_dir = ct_zone_dir;
> + }
> + nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
> } else {
> ct_zone = nf_ct_zone_dflt;
> }
>
> hash = nf_conntrack_find_get(net, &ct_zone, &tuple);
> - if (opts->netns_id >= 0)
> + if (netns_id >= 0)
> put_net(net);
> if (!hash)
> return ERR_PTR(-ENOENT);
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-31 20:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-31 16:09 [PATCH bpf v3] bpf: Fix netns reference imbalance in conntrack kfuncs Chengfeng Ye
2026-07-31 20:41 ` bot+bpf-ci
2026-07-31 20:52 ` Emil Tsalapatis
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox