From: "Emil Tsalapatis" <emil@etsalapatis.com>
To: "Chengfeng Ye" <nicoyip.dev@gmail.com>,
"Pablo Neira Ayuso" <pablo@netfilter.org>,
"Florian Westphal" <fw@strlen.de>, "Phil Sutter" <phil@nwl.cc>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Simon Horman" <horms@kernel.org>,
"Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Jesper Dangaard Brouer" <hawk@kernel.org>,
"John Fastabend" <john.fastabend@gmail.com>,
"Stanislav Fomichev" <sdf@fomichev.me>,
"Kumar Kartikeya Dwivedi" <memxor@gmail.com>,
"Lorenzo Bianconi" <lorenzo@kernel.org>
Cc: <netfilter-devel@vger.kernel.org>, <coreteam@netfilter.org>,
<netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<bpf@vger.kernel.org>
Subject: Re: [PATCH bpf v2] bpf: Fix netns reference imbalance in conntrack kfuncs
Date: Thu, 30 Jul 2026 14:08:04 -0400 [thread overview]
Message-ID: <DKC3UER7LFE1.229F428MUH14A@etsalapatis.com> (raw)
In-Reply-To: <20260730082958.2065194-1-nicoyip.dev@gmail.com>
On Thu Jul 30, 2026 at 4:29 AM EDT, Chengfeng Ye wrote:
> The opts argument of the BPF conntrack kfuncs can point to a shared
> map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
> opts->netns_id separately when acquiring and releasing the network
> namespace reference.
>
> The reference imbalance can occur as follows:
>
> CPU 0 CPU 1
> read opts->netns_id (-1)
> skip get_net_ns_by_id()
> write opts->netns_id (id)
> read opts->netns_id (id)
> put_net(net) /* no matching get */
>
> The reverse transition leaks the reference. Repeating the unmatched put
> can destroy a live namespace and crash later users.
>
> The kernel reported:
>
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
> RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
> Call Trace:
> __sys_bpf+0x1662/0x50c0
> __x64_sys_bpf+0x73/0xb0
> do_syscall_64+0xf9/0x540
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> Kernel panic - not syncing: Fatal exception
>
> Snapshot every input field of opts with READ_ONCE() before validating or
> using it. The netns_id snapshot keeps the namespace get/put pair
> balanced, while the other snapshots keep the remaining options from
> changing partway through an invocation. The individual reads can still
> observe an inconsistent combination during a concurrent update, but each
> selected field value remains stable for that invocation.
>
> Fixes: aed8ee7feb44 ("net: netfilter: Deduplicate code in bpf_{xdp,skb}_ct_lookup")
> Fixes: d7e79c97c00c ("net: netfilter: Add kfuncs to allocate and insert CT")
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Looking a lot better, one nit: We don't really need to read reserve[]
into a separate variable. We use it only once, so reading it into the
stack isn't giving us anything, in contrast to all other fields.
The bot's ordering nit is also a nice-to-have.
pw-bot: cr
> ---
> Changes in v2:
> - Snapshot l4proto, ct_zone_id, ct_zone_dir, and the reserved bytes in
> addition to netns_id, as requested in review.
> - Rebase onto current bpf/master.
>
> Please queue this fix for stable kernels.
>
> net/netfilter/nf_conntrack_bpf.c | 76 ++++++++++++++++++++++----------
> 1 file changed, 52 insertions(+), 24 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_bpf.c b/net/netfilter/nf_conntrack_bpf.c
> index f98d1d4b42c3..c3395cb98c00 100644
> --- a/net/netfilter/nf_conntrack_bpf.c
> +++ b/net/netfilter/nf_conntrack_bpf.c
> @@ -122,42 +122,56 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
> struct nf_conntrack_tuple otuple, rtuple;
> struct nf_conntrack_zone ct_zone;
> struct nf_conn *ct;
> + u16 ct_zone_id;
> + s32 netns_id;
> + u8 ct_zone_dir = 0;
> + u8 reserved[3] = {};
> + u8 l4proto;
> int err;
>
> if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
> return ERR_PTR(-EINVAL);
> +
> + netns_id = READ_ONCE(opts->netns_id);
> + l4proto = READ_ONCE(opts->l4proto);
> + ct_zone_id = READ_ONCE(opts->ct_zone_id);
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
> + ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
> + reserved[0] = READ_ONCE(opts->reserved[0]);
> + reserved[1] = READ_ONCE(opts->reserved[1]);
> + reserved[2] = READ_ONCE(opts->reserved[2]);
> + if (reserved[0] || reserved[1] || reserved[2])
> return ERR_PTR(-EINVAL);
> } else {
> - if (opts->ct_zone_id)
> + if (ct_zone_id)
> return ERR_PTR(-EINVAL);
> }
>
> - if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
> + if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
> return ERR_PTR(-EINVAL);
>
> - err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
> + err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
> IP_CT_DIR_ORIGINAL, &otuple);
> if (err < 0)
> return ERR_PTR(err);
>
> - err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
> + err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
> IP_CT_DIR_REPLY, &rtuple);
> if (err < 0)
> return ERR_PTR(err);
>
> - if (opts->netns_id >= 0) {
> - net = get_net_ns_by_id(net, opts->netns_id);
> + if (netns_id >= 0) {
> + net = get_net_ns_by_id(net, netns_id);
> if (unlikely(!net))
> return ERR_PTR(-ENONET);
> }
>
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->ct_zone_dir == 0)
> - opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> - nf_ct_zone_init(&ct_zone,
> - opts->ct_zone_id, opts->ct_zone_dir, 0);
> + if (ct_zone_dir == 0) {
> + ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> + opts->ct_zone_dir = ct_zone_dir;
> + }
> + nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
> } else {
> ct_zone = nf_ct_zone_dflt;
> }
> @@ -171,7 +185,7 @@ __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
> __nf_ct_set_timeout(ct, timeout * HZ);
>
> out:
> - if (opts->netns_id >= 0)
> + if (netns_id >= 0)
> put_net(net);
>
> return ct;
> @@ -186,46 +200,60 @@ static struct nf_conn *__bpf_nf_ct_lookup(struct net *net,
> struct nf_conntrack_tuple tuple;
> struct nf_conntrack_zone ct_zone;
> struct nf_conn *ct;
> + u16 ct_zone_id;
> + s32 netns_id;
> + u8 ct_zone_dir = 0;
> + u8 reserved[3] = {};
> + u8 l4proto;
> int err;
>
> if (!opts || !bpf_tuple)
> return ERR_PTR(-EINVAL);
> if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
> return ERR_PTR(-EINVAL);
> +
> + netns_id = READ_ONCE(opts->netns_id);
> + l4proto = READ_ONCE(opts->l4proto);
> + ct_zone_id = READ_ONCE(opts->ct_zone_id);
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->reserved[0] || opts->reserved[1] || opts->reserved[2])
> + ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
> + reserved[0] = READ_ONCE(opts->reserved[0]);
> + reserved[1] = READ_ONCE(opts->reserved[1]);
> + reserved[2] = READ_ONCE(opts->reserved[2]);
> + if (reserved[0] || reserved[1] || reserved[2])
> return ERR_PTR(-EINVAL);
> } else {
> - if (opts->ct_zone_id)
> + if (ct_zone_id)
> return ERR_PTR(-EINVAL);
> }
> - if (unlikely(opts->l4proto != IPPROTO_TCP && opts->l4proto != IPPROTO_UDP))
> + if (unlikely(l4proto != IPPROTO_TCP && l4proto != IPPROTO_UDP))
> return ERR_PTR(-EPROTO);
> - if (unlikely(opts->netns_id < BPF_F_CURRENT_NETNS))
> + if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
> return ERR_PTR(-EINVAL);
>
> - err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, opts->l4proto,
> + err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
> IP_CT_DIR_ORIGINAL, &tuple);
> if (err < 0)
> return ERR_PTR(err);
>
> - if (opts->netns_id >= 0) {
> - net = get_net_ns_by_id(net, opts->netns_id);
> + if (netns_id >= 0) {
> + net = get_net_ns_by_id(net, netns_id);
> if (unlikely(!net))
> return ERR_PTR(-ENONET);
> }
>
> if (opts_len == NF_BPF_CT_OPTS_SZ) {
> - if (opts->ct_zone_dir == 0)
> - opts->ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> - nf_ct_zone_init(&ct_zone,
> - opts->ct_zone_id, opts->ct_zone_dir, 0);
> + if (ct_zone_dir == 0) {
> + ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
> + opts->ct_zone_dir = ct_zone_dir;
> + }
> + nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
> } else {
> ct_zone = nf_ct_zone_dflt;
> }
>
> hash = nf_conntrack_find_get(net, &ct_zone, &tuple);
> - if (opts->netns_id >= 0)
> + if (netns_id >= 0)
> put_net(net);
> if (!hash)
> return ERR_PTR(-ENOENT);
prev parent reply other threads:[~2026-07-30 18:08 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 16:31 [PATCH bpf] bpf: Fix netns reference imbalance in conntrack kfuncs Chengfeng Ye
2026-07-29 16:48 ` sashiko-bot
2026-07-29 17:15 ` bot+bpf-ci
2026-07-30 6:38 ` Emil Tsalapatis
2026-07-30 8:30 ` Chengfeng Ye
2026-07-30 8:29 ` [PATCH bpf v2] " Chengfeng Ye
2026-07-30 9:52 ` bot+bpf-ci
2026-07-30 18:08 ` Emil Tsalapatis [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DKC3UER7LFE1.229F428MUH14A@etsalapatis.com \
--to=emil@etsalapatis.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=coreteam@netfilter.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=hawk@kernel.org \
--cc=horms@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nicoyip.dev@gmail.com \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=sdf@fomichev.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox