From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from Chamillionaire.breakpoint.cc ([146.0.238.67]:55260 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751753AbeCVLQV (ORCPT ); Thu, 22 Mar 2018 07:16:21 -0400 Date: Thu, 22 Mar 2018 12:16:19 +0100 From: Florian Westphal To: Paolo Abeni Cc: netdev@vger.kernel.org, Pablo Neira Ayuso , Florian Westphal , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, syzbot+0346441ae0545cfcea3a@syzkaller.appspotmail.com, syzkaller-bugs@googlegroups.com Subject: Re: [PATCH nf] netfilter: drop template ct when conntrack is skipped. Message-ID: <20180322111619.GA8867@breakpoint.cc> References: <7d4cd8cddda45ba93066e8f977aed5d16d220a67.1521713327.git.pabeni@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <7d4cd8cddda45ba93066e8f977aed5d16d220a67.1521713327.git.pabeni@redhat.com> Sender: netdev-owner@vger.kernel.org List-ID: Paolo Abeni wrote: > The ipv4 nf_ct code currently skips the nf_conntrak_in() call > for fragmented packets. As a results later matches/target can end > up manipulating template ct entry instead of 'real' ones. > > Exploiting the above, syzbot found a way to trigger the following > splat: > > WARNING: CPU: 1 PID: 4242 at net/netfilter/xt_cluster.c:55 > xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127 > Kernel panic - not syncing: panic_on_warn set ... Right, template has l3 protocol 0. > Instead of adding checks for template ct on every target/match > manipulating skb->_nfct, simply drop the template ct when skipping > nf_conntrack_in(). Fixes: 7b4fdf77a450ec ("netfilter: don't track fragmented packets") Acked-by: Florian Westphal