From: Eric Dumazet <eric.dumazet@gmail.com>
To: Florian Westphal <fw@strlen.de>, David Miller <davem@davemloft.net>
Cc: Sami Farin <hvtaifwkbgefbaei@gmail.com>, netdev@vger.kernel.org
Subject: Re: [PATCH v2] netfilter: take care of timewait sockets
Date: Tue, 04 Sep 2012 09:55:25 +0200 [thread overview]
Message-ID: <1346745325.13121.4.camel@edumazet-glaptop> (raw)
In-Reply-To: <1346629684.2563.78.camel@edumazet-glaptop>
On Mon, 2012-09-03 at 01:48 +0200, Eric Dumazet wrote:
> Sami Farin reported crashes in xt_LOG because it assumes skb->sk is a
> full blown socket.
>
> But with TCP early demux, we can have skb->sk pointing to a timewait
> socket.
>
> Same fix is needed in netfnetlink_log
>
> Diagnosed-by: Florian Westphal <fw@strlen.de>
> Reported-by: Sami Farin <hvtaifwkbgefbaei@gmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> net/netfilter/nfnetlink_log.c | 14 +++++++------
> net/netfilter/xt_LOG.c | 33 ++++++++++++++++----------------
> 2 files changed, 25 insertions(+), 22 deletions(-)
>
> diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
> index 14e2f39..5cfb5be 100644
> --- a/net/netfilter/nfnetlink_log.c
> +++ b/net/netfilter/nfnetlink_log.c
> @@ -381,6 +381,7 @@ __build_packet_message(struct nfulnl_instance *inst,
> struct nlmsghdr *nlh;
> struct nfgenmsg *nfmsg;
> sk_buff_data_t old_tail = inst->skb->tail;
> + struct sock *sk;
>
> nlh = nlmsg_put(inst->skb, 0, 0,
> NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
> @@ -499,18 +500,19 @@ __build_packet_message(struct nfulnl_instance *inst,
> }
>
> /* UID */
> - if (skb->sk) {
> - read_lock_bh(&skb->sk->sk_callback_lock);
> - if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
> - struct file *file = skb->sk->sk_socket->file;
> + sk = skb->sk;
> + if (sk && sk->sk_state != TCP_TIME_WAIT) {
> + read_lock_bh(&sk->sk_callback_lock);
> + if (sk->sk_socket && sk->sk_socket->file) {
> + struct file *file = sk->sk_socket->file;
> __be32 uid = htonl(file->f_cred->fsuid);
> __be32 gid = htonl(file->f_cred->fsgid);
> - read_unlock_bh(&skb->sk->sk_callback_lock);
> + read_unlock_bh(&sk->sk_callback_lock);
> if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
> nla_put_be32(inst->skb, NFULA_GID, gid))
> goto nla_put_failure;
> } else
> - read_unlock_bh(&skb->sk->sk_callback_lock);
> + read_unlock_bh(&sk->sk_callback_lock);
> }
>
> /* local sequence number */
> diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
> index ff5f75f..2a4f969 100644
> --- a/net/netfilter/xt_LOG.c
> +++ b/net/netfilter/xt_LOG.c
> @@ -145,6 +145,19 @@ static int dump_tcp_header(struct sbuff *m, const struct sk_buff *skb,
> return 0;
> }
>
> +static void dump_sk_uid_gid(struct sbuff *m, struct sock *sk)
> +{
> + if (!sk || sk->sk_state == TCP_TIME_WAIT)
> + return;
> +
> + read_lock_bh(&sk->sk_callback_lock);
> + if (sk->sk_socket && sk->sk_socket->file)
> + sb_add(m, "UID=%u GID=%u ",
> + sk->sk_socket->file->f_cred->fsuid,
> + sk->sk_socket->file->f_cred->fsgid);
> + read_unlock_bh(&sk->sk_callback_lock);
> +}
> +
> /* One level of recursion won't kill us */
> static void dump_ipv4_packet(struct sbuff *m,
> const struct nf_loginfo *info,
> @@ -361,14 +374,8 @@ static void dump_ipv4_packet(struct sbuff *m,
> }
>
> /* Max length: 15 "UID=4294967295 " */
> - if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
> - read_lock_bh(&skb->sk->sk_callback_lock);
> - if (skb->sk->sk_socket && skb->sk->sk_socket->file)
> - sb_add(m, "UID=%u GID=%u ",
> - skb->sk->sk_socket->file->f_cred->fsuid,
> - skb->sk->sk_socket->file->f_cred->fsgid);
> - read_unlock_bh(&skb->sk->sk_callback_lock);
> - }
> + if ((logflags & XT_LOG_UID) && !iphoff)
> + dump_sk_uid_gid(m, skb->sk);
>
> /* Max length: 16 "MARK=0xFFFFFFFF " */
> if (!iphoff && skb->mark)
> @@ -717,14 +724,8 @@ static void dump_ipv6_packet(struct sbuff *m,
> }
>
> /* Max length: 15 "UID=4294967295 " */
> - if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
> - read_lock_bh(&skb->sk->sk_callback_lock);
> - if (skb->sk->sk_socket && skb->sk->sk_socket->file)
> - sb_add(m, "UID=%u GID=%u ",
> - skb->sk->sk_socket->file->f_cred->fsuid,
> - skb->sk->sk_socket->file->f_cred->fsgid);
> - read_unlock_bh(&skb->sk->sk_callback_lock);
> - }
> + if ((logflags & XT_LOG_UID) && recurse)
> + dump_sk_uid_gid(m, skb->sk);
>
> /* Max length: 16 "MARK=0xFFFFFFFF " */
> if (!recurse && skb->mark)
>
Hi David
This patch was marked "Not applicable" in Patchwork
( http://patchwork.ozlabs.org/patch/181275/ )
It seems a mistake, since it should be applied ?
Tell me if I should resend it
Thanks
next prev parent reply other threads:[~2012-09-04 7:55 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-21 13:49 (ipt_log_packet, sb_add) 3.6.0-rc2 kernel panic - not syncing; Fatal exception in interrupt Sami Farin
2012-09-02 12:20 ` Sami Farin
2012-09-02 13:28 ` Florian Westphal
2012-09-02 13:45 ` Sami Farin
2012-09-02 22:53 ` Eric Dumazet
2012-09-02 23:37 ` Eric Dumazet
2012-09-02 23:48 ` [PATCH v2] netfilter: take care of timewait sockets Eric Dumazet
2012-09-03 7:47 ` Florian Westphal
2012-09-03 9:57 ` Eric Dumazet
2012-09-03 17:23 ` David Miller
2012-09-04 7:55 ` Eric Dumazet [this message]
2012-09-04 16:16 ` David Miller
2012-09-14 9:30 ` Sami Farin
2012-09-10 5:02 ` (ipt_log_packet, sb_add) 3.6.0-rc2 kernel panic - not syncing; Fatal exception in interrupt Jan Engelhardt
2012-09-10 6:00 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1346745325.13121.4.camel@edumazet-glaptop \
--to=eric.dumazet@gmail.com \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=hvtaifwkbgefbaei@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox