* [PATCH net 01/15] netfilter: nft_reject: prevent unbounded recursion in output hooks
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:59 ` netdev-bot+sinfo
2026-11-02 0:56 ` [PATCH net 02/15] ipvs: wait grace period while reusing dest from trash Pablo Neira Ayuso
` (13 subsequent siblings)
14 siblings, 1 reply; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Fernando Fernandez Mancera <fmancera@suse.de>
nftables payload-mangling rules can rewrite packet contents (such as TCP
flags) before they are evaluated by reject targets. This defeats the
content-based loop guards, allowing unbounded hook recursion that leads
to kernel stack exhaustion and panics.
Fix this by extracting the per-CPU xmit recursion limit previously used
by the netdev duplication/forwarding paths into a shared header, and
apply it to the inet and inet6 reject transmit functions. It disables BH
while transmitting the skb to address a possible migration to different
CPU leading to imbalanced decrementation of the recursion counters.
Note that the dev_queue_xmit() path used when CONFIG_BRIDGE_NETFILTER is
enabled does not require this recursion guard. In that scenario, the
generated reset packet is transmitted directly at Layer 2. Because the
packet egresses from a different hook, it cannot synchronously loop. In
addition nf_send_unreach() and nf_send_unreach6() are safe as the ICMP
transmit functions are protected against recursion by the
icmp_xmit_lock() and icmpv6_xmit_lock() guards.
Reported-by: Yu Junzhe <junzheyu1@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/20260921061320.543-1-junzheyu1@gmail.com/
Fixes: bee11dc78fc8 ("netfilter: nft_reject: support for IPv6 and TCP reset")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/linux/netdevice_xmit.h | 4 +--
include/net/netfilter/nf_dup_netdev.h | 35 ----------------------
include/net/netfilter/nf_recursion.h | 42 +++++++++++++++++++++++++++
net/ipv4/netfilter/nf_reject_ipv4.c | 12 ++++++++
net/ipv6/netfilter/nf_reject_ipv6.c | 13 +++++++++
net/netfilter/nf_dup_netdev.c | 1 +
net/netfilter/nft_fwd_netdev.c | 1 +
7 files changed, 71 insertions(+), 37 deletions(-)
create mode 100644 include/net/netfilter/nf_recursion.h
diff --git a/include/linux/netdevice_xmit.h b/include/linux/netdevice_xmit.h
index cc232508e695..286ae5a6101e 100644
--- a/include/linux/netdevice_xmit.h
+++ b/include/linux/netdevice_xmit.h
@@ -18,8 +18,8 @@ struct netdev_xmit {
u8 sched_mirred_nest;
struct net_device *sched_mirred_dev[MIRRED_NEST_LIMIT];
#endif
-#if IS_ENABLED(CONFIG_NF_DUP_NETDEV)
- u8 nf_dup_skb_recursion;
+#if IS_ENABLED(CONFIG_NETFILTER)
+ u8 nf_xmit_skb_recursion;
#endif
};
diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
index f6b05bd80c3f..a39411264614 100644
--- a/include/net/netfilter/nf_dup_netdev.h
+++ b/include/net/netfilter/nf_dup_netdev.h
@@ -9,41 +9,6 @@
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
-#define NF_RECURSION_LIMIT 2
-
-#ifndef CONFIG_PREEMPT_RT
-static inline bool nf_dev_xmit_recursion(void)
-{
- return unlikely(__this_cpu_read(softnet_data.xmit.nf_dup_skb_recursion) >
- NF_RECURSION_LIMIT);
-}
-
-static inline void nf_dev_xmit_recursion_inc(void)
-{
- __this_cpu_inc(softnet_data.xmit.nf_dup_skb_recursion);
-}
-
-static inline void nf_dev_xmit_recursion_dec(void)
-{
- __this_cpu_dec(softnet_data.xmit.nf_dup_skb_recursion);
-}
-#else
-static inline bool nf_dev_xmit_recursion(void)
-{
- return unlikely(current->net_xmit.nf_dup_skb_recursion > NF_RECURSION_LIMIT);
-}
-
-static inline void nf_dev_xmit_recursion_inc(void)
-{
- current->net_xmit.nf_dup_skb_recursion++;
-}
-
-static inline void nf_dev_xmit_recursion_dec(void)
-{
- current->net_xmit.nf_dup_skb_recursion--;
-}
-#endif
-
struct nft_offload_ctx;
struct nft_flow_rule;
diff --git a/include/net/netfilter/nf_recursion.h b/include/net/netfilter/nf_recursion.h
new file mode 100644
index 000000000000..1ac65f7793f1
--- /dev/null
+++ b/include/net/netfilter/nf_recursion.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _NF_RECURSION_H_
+#define _NF_RECURSION_H_
+
+#include <linux/netdevice.h>
+
+#define NF_RECURSION_LIMIT 2
+
+#ifndef CONFIG_PREEMPT_RT
+static inline bool nf_dev_xmit_recursion(void)
+{
+ return unlikely(__this_cpu_read(softnet_data.xmit.nf_xmit_skb_recursion) >
+ NF_RECURSION_LIMIT);
+}
+
+static inline void nf_dev_xmit_recursion_inc(void)
+{
+ __this_cpu_inc(softnet_data.xmit.nf_xmit_skb_recursion);
+}
+
+static inline void nf_dev_xmit_recursion_dec(void)
+{
+ __this_cpu_dec(softnet_data.xmit.nf_xmit_skb_recursion);
+}
+#else
+static inline bool nf_dev_xmit_recursion(void)
+{
+ return unlikely(current->net_xmit.nf_xmit_skb_recursion > NF_RECURSION_LIMIT);
+}
+
+static inline void nf_dev_xmit_recursion_inc(void)
+{
+ current->net_xmit.nf_xmit_skb_recursion++;
+}
+
+static inline void nf_dev_xmit_recursion_dec(void)
+{
+ current->net_xmit.nf_xmit_skb_recursion--;
+}
+#endif
+
+#endif /* _NF_RECURSION_H_ */
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 7cb33af671e2..4082fa184af8 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -10,6 +10,7 @@
#include <net/dst.h>
#include <net/dst_metadata.h>
#include <net/netfilter/ipv4/nf_reject.h>
+#include <net/netfilter/nf_recursion.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_bridge.h>
@@ -336,7 +337,18 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
dev_queue_xmit(nskb);
} else
#endif
+ {
+ local_bh_disable();
+ if (nf_dev_xmit_recursion()) {
+ local_bh_enable();
+ goto free_nskb;
+ }
+
+ nf_dev_xmit_recursion_inc();
ip_local_out(net, nskb->sk, nskb);
+ nf_dev_xmit_recursion_dec();
+ local_bh_enable();
+ }
return;
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 5e08d8529cc8..7c9464184517 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -10,6 +10,7 @@
#include <net/ip6_checksum.h>
#include <net/dst_metadata.h>
#include <net/netfilter/ipv6/nf_reject.h>
+#include <net/netfilter/nf_recursion.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netfilter_bridge.h>
@@ -409,7 +410,19 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
dev_queue_xmit(nskb);
} else
#endif
+ {
+ local_bh_disable();
+ if (nf_dev_xmit_recursion()) {
+ local_bh_enable();
+ kfree_skb(nskb);
+ return;
+ }
+
+ nf_dev_xmit_recursion_inc();
ip6_local_out(net, sk, nskb);
+ nf_dev_xmit_recursion_dec();
+ local_bh_enable();
+ }
}
EXPORT_SYMBOL_GPL(nf_send_reset6);
diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index c6bd5c29bed6..918716629c15 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -12,6 +12,7 @@
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_offload.h>
#include <net/netfilter/nf_dup_netdev.h>
+#include <net/netfilter/nf_recursion.h>
static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
enum nf_dev_hooks hook)
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index a48c2f765bba..7447da931a95 100644
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -14,6 +14,7 @@
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_offload.h>
#include <net/netfilter/nf_dup_netdev.h>
+#include <net/netfilter/nf_recursion.h>
#include <net/neighbour.h>
#include <net/ip.h>
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH net 01/15] netfilter: nft_reject: prevent unbounded recursion in output hooks
2026-11-02 0:56 ` [PATCH net 01/15] netfilter: nft_reject: prevent unbounded recursion in output hooks Pablo Neira Ayuso
@ 2026-11-02 0:59 ` netdev-bot+sinfo
0 siblings, 0 replies; 18+ messages in thread
From: netdev-bot+sinfo @ 2026-11-02 0:59 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet, horms, fw,
ja
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH net 02/15] ipvs: wait grace period while reusing dest from trash
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 01/15] netfilter: nft_reject: prevent unbounded recursion in output hooks Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 03/15] ipvs: Defer application parent freeing until after RCU readers Pablo Neira Ayuso
` (12 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Darong Lu <zzyy19904204639@163.com>
Darong Lu and the VEGA team report a problem with the TWOS scheduler
that manifests as a loop while traversing the list of destinations. The
problem occurs if destinations are removed and re-added through the
destination trash before an RCU grace period has elapsed. As destinations
are re-added to a new service, CPUs traversing the old destination list
may never reach the old list head and fail to terminate.
As the problem is not specific to the TWOS scheduler, use a general
solution. Jiayuan Chen provided an initial solution based on
get_state_synchronize_rcu() and cond_synchronize_rcu(), where the grace
period cookie is saved after a destination is unlinked and moved into the
destination trash. cond_synchronize_rcu() then ensures the grace period
before the destination is reused.
Use a temporary list for destinations removed together from a service or
during a flush. A single get_state_synchronize_rcu() call records the
cookie for all destinations before the temporary list is spliced into the
public destination trash. This also limits destination-trash locking to
one acquisition for bulk removal.
Destination edits that remove and re-add an entry to the real-server hash
table use the same grace-period mechanism. Destinations returned to the
trash after an estimator failure are put back without recording a new
cookie.
Fixes: ceec4c381681 ("ipvs: convert services to rcu")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reported-by: Darong Lu <zzyy19904204639@163.com>
Link: https://patch.msgid.link/cover.1789117690.git.zzyy19904204639@163.com/
Co-developed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Darong Lu <zzyy19904204639@163.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/ip_vs.h | 4 +-
net/netfilter/ipvs/ip_vs_ctl.c | 109 ++++++++++++++++++++++++++-------
2 files changed, 90 insertions(+), 23 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 9a83bff32569..50a2999beb01 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1021,7 +1021,9 @@ struct ip_vs_dest {
struct rcu_head rcu_head;
struct list_head t_list; /* in dest_trash */
- unsigned int in_rs_table:1; /* we are in rs_table */
+ unsigned long rcu_state; /* GP cookie when trashed */
+ unsigned int in_rs_table:1, /* we are in rs_table */
+ need_gp:1; /* Need GP on rehash */
};
/* The scheduler object */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index ce9fe20d6106..7f10cf5b48c7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -64,7 +64,8 @@ int ip_vs_get_debug_level(void)
/* Protos */
-static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup);
+static void __ip_vs_del_service(struct ip_vs_service *svc,
+ struct list_head *dest_trash, bool cleanup);
#ifdef CONFIG_IP_VS_IPV6
@@ -918,6 +919,11 @@ static void ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
*/
hash = ip_vs_rs_hashkey(dest->af, &dest->addr, port);
+ /* Need RCU grace period when rehashing */
+ if (dest->need_gp) {
+ cond_synchronize_rcu(dest->rcu_state);
+ dest->need_gp = 0;
+ }
hlist_add_head_rcu(&dest->d_list, &ipvs->rs_table[hash]);
dest->in_rs_table = 1;
}
@@ -1111,6 +1117,8 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, int dest_af,
struct ip_vs_dest *dest;
struct netns_ipvs *ipvs = svc->ipvs;
+ lockdep_assert_held(&ipvs->service_mutex);
+
/*
* Find the destination in trash
*/
@@ -1144,24 +1152,57 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, int dest_af,
return dest;
}
-/* Put destination in trash */
-static void ip_vs_trash_put_dest(struct netns_ipvs *ipvs,
+/* Add destination in temp list for trash */
+static void ip_vs_trash_add_dest(struct netns_ipvs *ipvs,
struct ip_vs_dest *dest, unsigned long istart,
- bool cleanup)
+ struct list_head *dest_trash)
{
- spin_lock_bh(&ipvs->dest_trash_lock);
IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
refcount_read(&dest->refcnt));
+ /* dest lives in trash with reference */
+ list_add(&dest->t_list, dest_trash);
+ dest->idle_start = istart;
+}
+
+/* Put destinations in trash */
+static void ip_vs_trash_put_dests(struct netns_ipvs *ipvs,
+ struct list_head *dest_trash, bool cleanup)
+{
+ spin_lock_bh(&ipvs->dest_trash_lock);
if (list_empty(&ipvs->dest_trash) && !cleanup)
mod_timer(&ipvs->dest_trash_timer,
jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
- /* dest lives in trash with reference */
- list_add(&dest->t_list, &ipvs->dest_trash);
- dest->idle_start = istart;
+ list_splice(dest_trash, &ipvs->dest_trash);
spin_unlock_bh(&ipvs->dest_trash_lock);
}
+/* Put destination back in trash */
+static void ip_vs_trash_put_back(struct netns_ipvs *ipvs,
+ struct ip_vs_dest *dest)
+{
+ LIST_HEAD(dest_trash);
+
+ ip_vs_trash_add_dest(ipvs, dest, dest->idle_start, &dest_trash);
+ ip_vs_trash_put_dests(ipvs, &dest_trash, false);
+}
+
+/* Put destinations in trash and save the RCU state */
+static void ip_vs_trash_save_dests(struct netns_ipvs *ipvs,
+ struct list_head *dest_trash, bool cleanup)
+{
+ struct ip_vs_dest *dest;
+ unsigned long rcu_state;
+
+ if (!list_empty(dest_trash)) {
+ /* Remember when dests were removed and added to dest_trash */
+ rcu_state = get_state_synchronize_rcu();
+ list_for_each_entry(dest, dest_trash, t_list)
+ dest->rcu_state = rcu_state;
+ ip_vs_trash_put_dests(ipvs, dest_trash, cleanup);
+ }
+}
+
static void ip_vs_dest_rcu_free(struct rcu_head *head)
{
struct ip_vs_dest *dest;
@@ -1369,8 +1410,16 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
if ((udest->conn_flags & IP_VS_CONN_F_FWD_MASK) !=
IP_VS_DFWD_METHOD(dest) ||
udest->tun_type != dest->tun_type ||
- udest->tun_port != dest->tun_port)
+ udest->tun_port != dest->tun_port) {
+ bool unlinked = dest->in_rs_table;
+
ip_vs_rs_unhash(dest);
+ if (unlinked) {
+ dest->rcu_state = get_state_synchronize_rcu();
+ /* Need grace period in this or next dest update */
+ dest->need_gp = 1;
+ }
+ }
/* set the tunnel info */
dest->tun_type = udest->tun_type;
@@ -1566,11 +1615,18 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
ret = ip_vs_start_estimator(svc->ipvs, &dest->stats);
/* On error put back dest into the trash */
- if (ret < 0)
- ip_vs_trash_put_dest(svc->ipvs, dest, dest->idle_start,
- false);
- else
+ if (ret < 0) {
+ ip_vs_trash_put_back(svc->ipvs, dest);
+ } else {
+ /* Readers may still follow the n_list/d_list of the
+ * unlinked dest, wait before linking it again.
+ */
+ cond_synchronize_rcu(dest->rcu_state);
+ /* need_gp matters only on dest edit, reinit it */
+ dest->need_gp = 0;
+
__ip_vs_update_dest(svc, dest, udest, 1);
+ }
} else {
/*
* Allocate and initialize the dest structure
@@ -1634,7 +1690,7 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
* Delete a destination (must be already unlinked from the service)
*/
static void __ip_vs_del_dest(struct netns_ipvs *ipvs, struct ip_vs_dest *dest,
- bool cleanup)
+ struct list_head *dest_trash, bool cleanup)
{
ip_vs_stop_estimator(ipvs, &dest->stats);
@@ -1643,7 +1699,7 @@ static void __ip_vs_del_dest(struct netns_ipvs *ipvs, struct ip_vs_dest *dest,
*/
ip_vs_rs_unhash(dest);
- ip_vs_trash_put_dest(ipvs, dest, 0, cleanup);
+ ip_vs_trash_add_dest(ipvs, dest, 0, dest_trash);
/* Queue up delayed work to expire all no destination connections.
* No-op when CONFIG_SYSCTL is disabled.
@@ -1693,6 +1749,7 @@ ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
{
struct ip_vs_dest *dest;
__be16 dport = udest->port;
+ LIST_HEAD(dest_trash);
/* We use function that requires RCU lock */
rcu_read_lock();
@@ -1712,7 +1769,9 @@ ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
/*
* Delete the destination
*/
- __ip_vs_del_dest(svc->ipvs, dest, false);
+ __ip_vs_del_dest(svc->ipvs, dest, &dest_trash, false);
+
+ ip_vs_trash_save_dests(svc->ipvs, &dest_trash, false);
return 0;
}
@@ -2057,7 +2116,8 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
* - The service must be unlinked, unlocked and not referenced!
* - We are called under _bh lock
*/
-static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
+static void __ip_vs_del_service(struct ip_vs_service *svc,
+ struct list_head *dest_trash, bool cleanup)
{
struct ip_vs_dest *dest, *nxt;
struct ip_vs_scheduler *old_sched;
@@ -2091,7 +2151,7 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
*/
list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
__ip_vs_unlink_dest(svc, dest, 0);
- __ip_vs_del_dest(svc->ipvs, dest, cleanup);
+ __ip_vs_del_dest(svc->ipvs, dest, dest_trash, cleanup);
}
/*
@@ -2114,7 +2174,8 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
/*
* Unlink a service from list and try to delete it if its refcnt reached 0
*/
-static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup)
+static void ip_vs_unlink_service(struct ip_vs_service *svc,
+ struct list_head *dest_trash, bool cleanup)
{
ip_vs_unregister_conntrack(svc);
/* Hold svc to avoid double release from dest_trash */
@@ -2124,7 +2185,7 @@ static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup)
*/
ip_vs_svc_unhash(svc);
- __ip_vs_del_service(svc, cleanup);
+ __ip_vs_del_service(svc, dest_trash, cleanup);
}
/*
@@ -2134,12 +2195,14 @@ static int ip_vs_del_service(struct ip_vs_service *svc)
{
struct netns_ipvs *ipvs;
struct ip_vs_rht *t, *p;
+ LIST_HEAD(dest_trash);
int ns;
if (svc == NULL)
return -EEXIST;
ipvs = svc->ipvs;
- ip_vs_unlink_service(svc, false);
+ ip_vs_unlink_service(svc, &dest_trash, false);
+ ip_vs_trash_save_dests(ipvs, &dest_trash, false);
/* Drop the table if no more services */
ns = ip_vs_get_num_services(ipvs);
@@ -2190,6 +2253,7 @@ static int ip_vs_flush(struct netns_ipvs *ipvs, bool cleanup)
struct hlist_bl_node *ne;
struct hlist_bl_node *e;
struct ip_vs_rht *t, *p;
+ LIST_HEAD(dest_trash);
/* Stop the resizer and drop the tables */
if (!test_and_set_bit(IP_VS_WORK_SVC_NORESIZE, &ipvs->work_flags))
@@ -2199,8 +2263,9 @@ static int ip_vs_flush(struct netns_ipvs *ipvs, bool cleanup)
if (ip_vs_get_num_services(ipvs)) {
ip_vs_rht_walk_buckets(ipvs->svc_table, head) {
hlist_bl_for_each_entry_safe(svc, e, ne, head, s_list)
- ip_vs_unlink_service(svc, cleanup);
+ ip_vs_unlink_service(svc, &dest_trash, cleanup);
}
+ ip_vs_trash_save_dests(ipvs, &dest_trash, cleanup);
}
/* Unregister the hash table and release it after RCU grace period */
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 03/15] ipvs: Defer application parent freeing until after RCU readers
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 01/15] netfilter: nft_reject: prevent unbounded recursion in output hooks Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 02/15] ipvs: wait grace period while reusing dest from trash Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 04/15] ipvs: fix protocol data lifetime during namespace teardown Pablo Neira Ayuso
` (11 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Chengfeng Ye <nicoyip.dev@gmail.com>
unregister_ip_vs_app() removes each incarnation from its protocol list and
uses call_rcu() to defer freeing it, but frees the parent application
immediately. An RCU reader that already found an incarnation can still
access the parent through inc->app in ip_vs_app_inc_get().
During FTP helper module unload, the following interleaving is possible:
CPU 0 (RCU reader) CPU 1 (module unload)
tcp_app_conn_bind()
find inc in protocol list
unregister_ip_vs_app()
ip_vs_app_inc_release(inc)
list_del_rcu(&inc->p_list)
call_rcu(&inc->rcu_head, ...)
kfree(a)
ip_vs_app_inc_get(inc)
try_module_get(inc->app->module)
The helper module is already going away, so try_module_get() would fail,
but evaluating its argument first reads the freed parent. The subsequent
rcu_barrier() in pernet unregistration cannot protect this earlier free.
KASAN reported:
BUG: KASAN: slab-use-after-free in ip_vs_app_inc_get+0x7c/0x90
Call Trace:
ip_vs_app_inc_get+0x7c/0x90
tcp_app_conn_bind+0x1bc/0x290
ip_vs_conn_new+0x1915/0x20d0
ip_vs_schedule+0x697/0xea0
tcp_conn_schedule+0x489/0x820
ip_vs_in_hook+0x7bf/0x1f40
Allocated by task 88:
kmemdup_noprof+0x20/0x50
register_ip_vs_app+0x12d/0x2c0
__ip_vs_ftp_init+0x56/0x160 [ip_vs_ftp]
Freed by task 104:
kfree+0x131/0x3c0
unregister_ip_vs_app+0x2f4/0x5b0
unregister_pernet_operations+0x232/0x490
unregister_pernet_subsys+0x1c/0x30
__do_sys_delete_module+0x346/0x510
Use kfree_rcu() with the existing rcu_head to keep the parent alive until
these readers finish. Successful helper references already prevent normal
module unload, and incarnation RCU callbacks do not access the parent.
Fixes: 363c97d7435e ("ipvs: convert app locks")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_app.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 11cbdbaf561d..2c1b47702da2 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -242,7 +242,7 @@ void unregister_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *app)
}
list_del(&a->a_list);
- kfree(a);
+ kfree_rcu(a, rcu_head);
/* decrease the module use count */
ip_vs_use_count_dec();
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 04/15] ipvs: fix protocol data lifetime during namespace teardown
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 03/15] ipvs: Defer application parent freeing until after RCU readers Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 05/15] ipvs: do not create conns from packets with port 0 Pablo Neira Ayuso
` (10 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Chengfeng Ye <nicoyip.dev@gmail.com>
IPVS frees its per-net protocol data before control cleanup cancels
defense work and unregisters the sysctl table. A defense worker can load
a protocol data pointer, then namespace cleanup can unlink and free that
object before the worker dereferences pd->pp or pd->next. The worker's
securetcp_lock does not serialize with protocol cleanup. A concurrent
defense-mode sysctl write can reach the same timeout update path.
KASAN reported:
BUG: KASAN: slab-use-after-free in ip_vs_protocol_timeout_change
Workqueue: events_long defense_work_handler
Call Trace:
ip_vs_protocol_timeout_change+0x1b4/0x1e0
update_defense_level+0x63e/0xd80
defense_work_handler+0x1e/0xc0
Allocated by task 125:
ip_vs_protocol_net_init+0xda/0x2f0
__ip_vs_init+0x16b/0x240
setup_net+0xfc/0x310
Freed by task 12:
ip_vs_protocol_net_cleanup+0x1d6/0x2e0
__ip_vs_cleanup_batch+0x7d/0x100
cleanup_net+0x38c/0x770
Run control cleanup before protocol cleanup so that defense work and
active sysctl handlers have finished before their protocol data is freed.
Initialize protocols before exposing the control interface, and unwind
in reverse order, to enforce the same lifetime on initialization failure.
Protocol initialization and exit do not depend on control state.
Fixes: 9330419d9aa4 ("IPVS: netns, use ip_vs_proto_data as param.")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index fd503f0efb57..8a3c880fdb26 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -2502,12 +2502,12 @@ static int __net_init __ip_vs_init(struct net *net)
if (ip_vs_estimator_net_init(ipvs) < 0)
goto estimator_fail;
- if (ip_vs_control_net_init(ipvs) < 0)
- goto control_fail;
-
if (ip_vs_protocol_net_init(ipvs) < 0)
goto protocol_fail;
+ if (ip_vs_control_net_init(ipvs) < 0)
+ goto control_fail;
+
if (ip_vs_app_net_init(ipvs) < 0)
goto app_fail;
@@ -2527,10 +2527,10 @@ static int __net_init __ip_vs_init(struct net *net)
conn_fail:
ip_vs_app_net_cleanup(ipvs);
app_fail:
- ip_vs_protocol_net_cleanup(ipvs);
-protocol_fail:
ip_vs_control_net_cleanup(ipvs);
control_fail:
+ ip_vs_protocol_net_cleanup(ipvs);
+protocol_fail:
ip_vs_estimator_net_cleanup(ipvs);
estimator_fail:
net->ipvs = NULL;
@@ -2547,8 +2547,8 @@ static void __net_exit __ip_vs_cleanup_batch(struct list_head *net_list)
ipvs = net_ipvs(net);
ip_vs_conn_net_cleanup(ipvs);
ip_vs_app_net_cleanup(ipvs);
- ip_vs_protocol_net_cleanup(ipvs);
ip_vs_control_net_cleanup(ipvs);
+ ip_vs_protocol_net_cleanup(ipvs);
ip_vs_estimator_net_cleanup(ipvs);
IP_VS_DBG(2, "ipvs netns %d released\n", ipvs->gen);
net->ipvs = NULL;
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 05/15] ipvs: do not create conns from packets with port 0
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 04/15] ipvs: fix protocol data lifetime during namespace teardown Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 06/15] netfilter: nf_conntrack: limit expectation master chain depth Pablo Neira Ayuso
` (9 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Julian Anastasov <ja@ssi.bg>
We should disallow normal connections with cport 0 to be
created from packets by the scheduler (from clients) or
by ip_vs_new_conn_out (from real servers) because later
such traffic can not hit the connection due to the
NO_CPORT requirement. As result, it can lead to duplicate
connection for every packet. Do the same for vport 0.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260925141115.16126-1-axel.mierczuk%401password.com
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_core.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 5 +++++
net/netfilter/ipvs/ip_vs_proto_tcp.c | 5 +++++
net/netfilter/ipvs/ip_vs_proto_udp.c | 4 ++++
4 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 8a3c880fdb26..f3eb72e95024 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1305,6 +1305,7 @@ static inline bool is_new_conn_expected(const struct ip_vs_conn *cp,
* In fwmark-VS actual vaddr and vport are unknown to IPVS
* 2) Real Server and Virtual Service were NOT configured without port:
* This is to allow match of different VS to the same RS ip-addr
+ * 3) Client port is not 0
*/
struct ip_vs_conn *ip_vs_new_conn_out(struct ip_vs_service *svc,
struct ip_vs_dest *dest,
@@ -1328,7 +1329,7 @@ struct ip_vs_conn *ip_vs_new_conn_out(struct ip_vs_service *svc,
/* check pre-requisites are satisfied */
if (svc->fwmark)
return NULL;
- if (!vport || !dport)
+ if (!vport || !dport || !cport)
return NULL;
/* for persistent service first create connection template */
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index fb8af6b15a39..83d1443ebe01 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -30,6 +30,7 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
sch = skb_header_pointer(skb, iph->len + sizeof(_sctph),
sizeof(_schunkh), &_schunkh);
if (sch) {
+ /* Accept packet without scheduling? */
if (sch->type == SCTP_CID_ABORT ||
!(sysctl_sloppy_sctp(ipvs) ||
sch->type == SCTP_CID_INIT))
@@ -47,6 +48,10 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
return 0;
}
+ /* Do not create connection for port 0, skip the packet */
+ if (!ports[0] || !ports[1])
+ return 1;
+
if (likely(!ip_vs_iph_inverse(iph)))
svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
&iph->daddr, ports[1]);
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index fec0e8b47b71..2e55b62445c6 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -48,6 +48,7 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
if (likely(!ip_vs_iph_icmp(iph))) {
th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph);
if (th) {
+ /* Accept packet without scheduling? */
if (th->rst || !(sysctl_sloppy_tcp(ipvs) || th->syn))
return 1;
ports = &th->source;
@@ -62,6 +63,10 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
return 0;
}
+ /* Do not create connection for port 0, skip the packet */
+ if (!ports[0] || !ports[1])
+ return 1;
+
/* No !th->ack check to allow scheduling on SYN+ACK for Active FTP */
if (likely(!ip_vs_iph_inverse(iph)))
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index f32785682402..92c0b76c1a02 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -52,6 +52,10 @@ udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
return 0;
}
+ /* Do not create connection for port 0, skip the packet */
+ if (!ports[0] || !ports[1])
+ return 1;
+
if (likely(!ip_vs_iph_inverse(iph)))
svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
&iph->daddr, ports[1]);
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 06/15] netfilter: nf_conntrack: limit expectation master chain depth
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 05/15] ipvs: do not create conns from packets with port 0 Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 07/15] netfilter: nf_dup: preserve guard across NFQUEUE reinjection Pablo Neira Ayuso
` (8 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Florian Westphal <fw@strlen.de>
A conntrack can point to a master conntrack, which itself may point to
another master, and so on. There is currently no bound on how deep this
chain can grow.
Force a max depth in nf_ct_expect_alloc(): walk the master chain and
reject allocation if it would exceed 2 levels of nesting.
Also add ctnetlink_find_get_master and use it so that ctnetlink create
paths return -EMLINK instead of falling through to nf_ct_expect_alloc()
and returning a misleading -ENOMEM.
This prevents unbounded ct->master->master->... chains.
Assisted-by: LLM
Reported-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_helper.h | 15 +++++++++
net/netfilter/nf_conntrack_expect.c | 15 +++++++--
net/netfilter/nf_conntrack_netlink.c | 36 +++++++++++++++------
3 files changed, 53 insertions(+), 13 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 335b8c43694f..617178fd4d8b 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -29,6 +29,8 @@ enum nf_ct_helper_flags {
#define NF_CT_HELPER_NAME_LEN 16
+#define NF_CT_MAX_EXPECT_CHAIN_LEN 2
+
/* Must be kept in sync with the classes defined by helpers */
#define NF_CT_MAX_EXPECT_CLASSES 4
@@ -159,6 +161,19 @@ static inline void nf_ct_help_put(const struct nf_conn *ct)
kfree_rcu(helper, rcu);
}
+static inline bool nf_ct_master_acceptable(const struct nf_conn *m)
+{
+ unsigned int depth = 0;
+
+ while (m->master) {
+ if (++depth >= NF_CT_MAX_EXPECT_CHAIN_LEN)
+ return false;
+ m = m->master;
+ }
+
+ return true;
+}
+
int nf_conntrack_helper_init(void);
void nf_conntrack_helper_fini(void);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 06242c86e1dc..e9e796bda577 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -299,13 +299,22 @@ void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
}
EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
-/* We don't increase the master conntrack refcount for non-fulfilled
- * conntracks. During the conntrack destruction, the expectations are
- * always killed before the conntrack itself */
+/**
+ * nf_ct_expect_alloc - allocate a new conntrack expectation
+ * @me: The conntrack to be used as master.
+ *
+ * The master conntrack refcount is not incremented; expectations
+ * are always killed before the master conntrack is destroyed.
+ *
+ * Returns a new expectation on success or NULL on failure.
+ */
struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
{
struct nf_conntrack_expect *new;
+ if (!nf_ct_master_acceptable(me))
+ return NULL;
+
new = kmem_cache_zalloc(nf_ct_expect_cachep, GFP_ATOMIC);
if (!new)
return NULL;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1f8d94a05240..30428d520e43 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2231,6 +2231,26 @@ ctnetlink_change_conntrack(struct nf_conn *ct,
return 0;
}
+static struct nf_conn *
+ctnetlink_find_get_master(struct net *net, const struct nf_conntrack_zone *zone,
+ const struct nf_conntrack_tuple *tuple)
+{
+ struct nf_conntrack_tuple_hash *master_h;
+ struct nf_conn *master_ct;
+
+ master_h = nf_conntrack_find_get(net, zone, tuple);
+ if (!master_h)
+ return ERR_PTR(-ENOENT);
+
+ master_ct = nf_ct_tuplehash_to_ctrack(master_h);
+ if (!nf_ct_master_acceptable(master_ct)) {
+ nf_ct_put(master_ct);
+ return ERR_PTR(-EMLINK);
+ }
+
+ return master_ct;
+}
+
static struct nf_conn *
ctnetlink_create_conntrack(struct net *net,
const struct nf_conntrack_zone *zone,
@@ -2356,7 +2376,6 @@ ctnetlink_create_conntrack(struct net *net,
/* setup master conntrack: this is a confirmed expectation */
if (cda[CTA_TUPLE_MASTER]) {
struct nf_conntrack_tuple master;
- struct nf_conntrack_tuple_hash *master_h;
struct nf_conn *master_ct;
err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER,
@@ -2364,12 +2383,11 @@ ctnetlink_create_conntrack(struct net *net,
if (err < 0)
goto err2;
- master_h = nf_conntrack_find_get(net, zone, &master);
- if (master_h == NULL) {
- err = -ENOENT;
+ master_ct = ctnetlink_find_get_master(net, zone, &master);
+ if (IS_ERR(master_ct)) {
+ err = PTR_ERR(master_ct);
goto err2;
}
- master_ct = nf_ct_tuplehash_to_ctrack(master_h);
__set_bit(IPS_EXPECTED_BIT, &ct->status);
ct->master = master_ct;
}
@@ -3613,7 +3631,6 @@ ctnetlink_create_expect(struct net *net,
u_int8_t u3, u32 portid, int report)
{
struct nf_conntrack_tuple tuple, mask, master_tuple;
- struct nf_conntrack_tuple_hash *h = NULL;
struct nf_conntrack_expect *exp;
struct nf_conn *ct;
int err;
@@ -3633,10 +3650,9 @@ ctnetlink_create_expect(struct net *net,
return err;
/* Look for master conntrack of this expectation */
- h = nf_conntrack_find_get(net, zone, &master_tuple);
- if (!h)
- return -ENOENT;
- ct = nf_ct_tuplehash_to_ctrack(h);
+ ct = ctnetlink_find_get_master(net, zone, &master_tuple);
+ if (IS_ERR(ct))
+ return PTR_ERR(ct);
rcu_read_lock();
exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask);
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 07/15] netfilter: nf_dup: preserve guard across NFQUEUE reinjection
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (5 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 06/15] netfilter: nf_conntrack: limit expectation master chain depth Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 08/15] netfilter: flowtable: extend ct timeout of offloaded GRE flows Pablo Neira Ayuso
` (7 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Zihan Xi <zihanx@nebusec.ai>
NFQUEUE can suspend traversal of a duplicated packet while the task-local
duplication guard is set. The output call then returns and clears the guard
before a later verdict resumes hook traversal.
Save the guard in the queue entry and restore it while reinjection
continues hook traversal. Preserve and restore the verdict task's prior
state, including nested synchronous reinjection.
Fixes: cd58bcd9787e ("netfilter: xt_TEE: have cloned packet travel through Xtables too")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: LLM
Co-developed-by: Luxing Yin <root@tr0jan.top>
Signed-off-by: Luxing Yin <root@tr0jan.top>
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_queue.h | 1 +
net/netfilter/nf_queue.c | 1 +
net/netfilter/nfnetlink_queue.c | 17 ++++++++++++++---
3 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index 86021c55ba3c..4a8cefd8398d 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -23,6 +23,7 @@ struct nf_queue_entry {
struct net_device *physout;
#endif
struct nf_hook_state state;
+ bool in_nf_duplicate;
bool nf_ct_is_unconfirmed;
u16 size; /* sizeof(entry) + saved route keys */
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 166d05e994ac..bd603e3a99a5 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -219,6 +219,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
*entry = (struct nf_queue_entry) {
.skb = skb,
.skb_dev = skb->dev,
+ .in_nf_duplicate = current->in_nf_duplicate,
.state = *state,
.hook_index = index,
.size = sizeof(*entry) + route_key_size,
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 90d887546f7d..a8aa7ad832c3 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -44,6 +44,7 @@
#include <net/sock.h>
#include <net/tcp_states.h>
#include <net/netfilter/nf_queue.h>
+#include <net/net_debug.h>
#include <net/netns/generic.h>
#include <linux/atomic.h>
@@ -365,21 +366,30 @@ static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
const struct nf_hook_entry *hook_entry;
const struct nf_hook_entries *hooks;
struct sk_buff *skb = entry->skb;
+ bool old_in_nf_duplicate;
const struct net *net;
unsigned int i;
int err;
u8 pf;
+ DEBUG_NET_WARN_ONCE(current->in_nf_duplicate &&
+ !entry->in_nf_duplicate,
+ "%s called with unexpected duplication guard",
+ __func__);
+ local_bh_disable();
+ old_in_nf_duplicate = current->in_nf_duplicate;
+
net = entry->state.net;
pf = entry->state.pf;
+ current->in_nf_duplicate = entry->in_nf_duplicate;
hooks = nf_hook_entries_head(net, pf, entry->state.hook);
i = entry->hook_index;
if (!hooks || i >= hooks->num_hook_entries) {
kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP);
nf_queue_entry_free(entry);
- return;
+ goto out;
}
hook_entry = &hooks->hooks[i];
@@ -402,9 +412,7 @@ static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
switch (verdict & NF_VERDICT_MASK) {
case NF_ACCEPT:
case NF_STOP:
- local_bh_disable();
entry->state.okfn(entry->state.net, entry->state.sk, skb);
- local_bh_enable();
break;
case NF_QUEUE:
err = nf_queue(skb, &entry->state, i, verdict);
@@ -418,6 +426,9 @@ static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
}
nf_queue_entry_free(entry);
+out:
+ current->in_nf_duplicate = old_in_nf_duplicate;
+ local_bh_enable();
}
/* return true if the entry has an unconfirmed conntrack attached that isn't owned by us
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 08/15] netfilter: flowtable: extend ct timeout of offloaded GRE flows
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (6 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 07/15] netfilter: nf_dup: preserve guard across NFQUEUE reinjection Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 09/15] netfilter: nft_set_rbtree: check catchall_sync return before queue_done Pablo Neira Ayuso
` (6 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Since commit 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn
timeout extension logic"), the flowtable gc worker extends the timeout
of an offloaded conntrack entry from nf_flow_table_extend_ct_timeout()
once it falls below 5 minutes. That function only knows about TCP and
UDP and hits WARN_ON_ONCE() for any other layer 4 protocol. However,
GRE flows can be offloaded too, both via nft_flow_offload and act_ct,
since commit 4e8d9584d154 ("netfilter: flowtable: Support GRE").
The timeout of an offloaded GRE entry drops below that threshold as soon
as a packet of the flow still goes through conntrack. With ip6gre
tunnels using the default encapsulation limit this is ordinary traffic:
the flowtable does not parse the Destination Options header in front of
GRE, so every packet of the flow takes the classic forwarding path. It
also happens for a packet with ttl <= 1, which the flowtable fast path
passes up to the classic forwarding path. nf_conntrack_gre_packet() then
refreshes ct->timeout to the GRE stream timeout (180 seconds by default),
and the next gc run triggers, as reported by syzbot:
WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0
Workqueue: events_power_efficient nf_flow_offload_work_gc
Call Trace:
nf_flow_offload_gc_step+0x545/0x7b0
nf_flow_table_iterate+0x13c/0x1f0
nf_flow_offload_work_gc+0x22/0x70
process_scheduled_works+0xc3d/0x1630
worker_thread+0xa47/0xfb0
kthread+0x38b/0x480
Besides the splat, which panics the machine with panic_on_warn, the
default branch sets the new timeout to 1 jiffy, so the conntrack entry
expires right away and the offloaded flow is torn down.
Handle GRE like UDP and extend the timeout to NF_CT_DAY. GRE conntrack
has no protocol state to take into account, and NF_CT_DAY is also what
flow_offload_add() already sets for every offloaded entry, GRE included.
This also restores the behaviour from before commit 03428ca5cee9, when
the conntrack gc worker extended offloaded entries of any protocol to
NF_CT_DAY.
Fixes: 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn timeout extension logic")
Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_flow_table_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 0d72dc8ae47a..2aa2647ed9df 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -544,6 +544,7 @@ static void nf_flow_table_extend_ct_timeout(struct nf_conn *ct)
switch (l4proto) {
case IPPROTO_UDP:
+ case IPPROTO_GRE:
new_timeout = NF_CT_DAY;
break;
case IPPROTO_TCP:
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 09/15] netfilter: nft_set_rbtree: check catchall_sync return before queue_done
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (7 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 08/15] netfilter: flowtable: extend ct timeout of offloaded GRE flows Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 10/15] netfilter: bridge: use DEBUG_NET_WARN_ON_ONCE in nf_ct_bridge_refrag() Pablo Neira Ayuso
` (5 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Xingyuan Mo <hdthky0@gmail.com>
nft_rbtree_gc_queue() passes the result of nft_trans_gc_catchall_sync()
straight to nft_trans_gc_queue_sync_done(). When the catchall path flushes
a full GC batch and nft_trans_gc_alloc() fails, catchall_sync returns
NULL and queue_sync_done dereferences trans->net (NULL+0x10). Guard the
call like the pipapo GC path already does.
Fixes: 7d259f021aaa ("netfilter: nft_set_rbtree: prefer sync gc to async worker")
Assisted-by: opencode:deepseek-v4
Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_set_rbtree.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index fbe1750f1ca2..9d685899da70 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -953,7 +953,8 @@ static void nft_rbtree_gc_queue(struct nft_set *set)
}
gc = nft_trans_gc_catchall_sync(gc);
- nft_trans_gc_queue_sync_done(gc);
+ if (gc)
+ nft_trans_gc_queue_sync_done(gc);
}
static u64 nft_rbtree_privsize(const struct nlattr * const nla[],
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 10/15] netfilter: bridge: use DEBUG_NET_WARN_ON_ONCE in nf_ct_bridge_refrag()
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (8 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 09/15] netfilter: nft_set_rbtree: check catchall_sync return before queue_done Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 11/15] netfilter: x_tables: check target name before accessing verdict Pablo Neira Ayuso
` (4 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Laveesh Bansal <laveeshb@laveeshbansal.com>
nf_ct_bridge_refrag() warns when skb->protocol is neither IPv4 nor IPv6.
A vlan filtering bridge can get there with a vlan ethertype: if the
protocol of the tag of a frame differs from the vlan_protocol of the
bridge, br_allowed_ingress() moves the tag back into the packet after
NF_BR_PRE_ROUTING, where bridge conntrack has already defragmented it.
Anyone who can send fragments into a port of such a bridge can trigger the
warning, which takes the machine down with panic_on_warn. The packet is
dropped either way, so only warn on kernels built with CONFIG_DEBUG_NET.
This only avoids the warning. Such fragmented packets are still dropped.
syzbot reported the warning. It keeps triggering on CONFIG_DEBUG_NET
kernels until the vlan tag is handled, which is left for a follow-up:
https://syzkaller.appspot.com/bug?extid=a8ba738fe2db6b4bb27f
Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
Assisted-by: LLM
Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/nf_conntrack_bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index b5444335b86f..8c83dc05114b 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -358,7 +358,7 @@ nf_ct_bridge_refrag(struct sk_buff *skb, const struct nf_hook_state *state,
nf_br_ip6_fragment(state->net, state->sk, skb, &data, output);
break;
default:
- WARN_ON_ONCE(1);
+ DEBUG_NET_WARN_ON_ONCE(1);
return NF_DROP;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 11/15] netfilter: x_tables: check target name before accessing verdict
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (9 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 10/15] netfilter: bridge: use DEBUG_NET_WARN_ON_ONCE in nf_ct_bridge_refrag() Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 12/15] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport() Pablo Neira Ayuso
` (3 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Fernando Fernandez Mancera <fmancera@suse.de>
Non-standard targets may contain only struct xt_entry_target.
mark_source_chains() nevertheless reads the target as an
xt_standard_target before checking its name, potentially reading four
bytes beyond a header-only target.
Check that the target is standard before reading its verdict.
Non-standard targets remain handled as fallthrough rules.
See the following KASAN trace:
BUG: KASAN: slab-out-of-bounds in translate_table+0x1660/0x1a40 [ip6_tables]
Read of size 4 at addr ffff88800ed56ff8 by task rep/432
Call Trace:
kasan_report+0xfa/0x120
translate_table+0x1660/0x1a40 [ip6_tables]
do_ip6t_set_ctl+0x667/0xa76 [ip6_tables]
nf_setsockopt+0x77/0xd0
do_sock_setsockopt+0x118/0x490
__sys_setsockopt+0xe4/0x160
__x64_sys_setsockopt+0xbd/0x190
do_syscall_64+0xde/0x4f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 432:
kasan_save_stack+0x2f/0x50
__kasan_kmalloc+0x7f/0x90
__kvmalloc_node_noprof+0x1b1/0x5c0
xt_alloc_table_info+0x3c/0xa0
do_ip6t_set_ctl+0x5ee/0xa76 [ip6_tables]
nf_setsockopt+0x77/0xd0
do_sock_setsockopt+0x118/0x490
__sys_setsockopt+0xe4/0x160
__x64_sys_setsockopt+0xbd/0x190
do_syscall_64+0xde/0x4f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: VEGA <vega@nebusec.ai>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/arp_tables.c | 5 +++--
net/ipv4/netfilter/ip_tables.c | 5 +++--
net/ipv6/netfilter/ip6_tables.c | 5 +++--
3 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index cf747e1e17a3..7ff3d1f0ffd4 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -371,11 +371,12 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
e->counters.pcnt = pos;
pos += size;
} else {
- int newpos = t->verdict;
+ int newpos;
if (strcmp(t->target.u.user.name,
XT_STANDARD_TARGET) == 0 &&
- newpos >= 0) {
+ t->verdict >= 0) {
+ newpos = t->verdict;
/* This a jump; chase it. */
if (!xt_find_jump_offset(offsets, newpos,
newinfo->number))
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 809441cedced..b302bd77180a 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -422,11 +422,12 @@ mark_source_chains(const struct xt_table_info *newinfo,
e->counters.pcnt = pos;
pos += size;
} else {
- int newpos = t->verdict;
+ int newpos;
if (strcmp(t->target.u.user.name,
XT_STANDARD_TARGET) == 0 &&
- newpos >= 0) {
+ t->verdict >= 0) {
+ newpos = t->verdict;
/* This a jump; chase it. */
if (!xt_find_jump_offset(offsets, newpos,
newinfo->number))
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 313c4aac377a..010baaa60665 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -440,11 +440,12 @@ mark_source_chains(const struct xt_table_info *newinfo,
e->counters.pcnt = pos;
pos += size;
} else {
- int newpos = t->verdict;
+ int newpos;
if (strcmp(t->target.u.user.name,
XT_STANDARD_TARGET) == 0 &&
- newpos >= 0) {
+ t->verdict >= 0) {
+ newpos = t->verdict;
/* This a jump; chase it. */
if (!xt_find_jump_offset(offsets, newpos,
newinfo->number))
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 12/15] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (10 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 11/15] netfilter: x_tables: check target name before accessing verdict Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 13/15] netfilter: nf_tables: fix memleak when rule deletion fails with hardware offload Pablo Neira Ayuso
` (2 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Joas Antonio dos Santos <joasantonio108@gmail.com>
ct_sip_parse_transport() compares the value of the "transport=" header
parameter against "TCP"/"UDP" with strncasecmp(..., 3), but it never
checks that the parsed value is at least 3 bytes long.
ct_sip_parse_param() returns matchlen = end - start, where end is the
next ';' or, when there is no ';', the end of the payload buffer
(limit = dptr + datalen). If the "transport=" value is only 1 or 2
bytes long and runs exactly to the end of the payload (e.g. a REGISTER
request whose Contact header ends in ";transport=T" with no trailing
CRLF), matchlen is less than 3 while strncasecmp() still reads up to 3
bytes, reading 1-2 bytes past the end of the linearized skb data.
Add a matchlen check before the comparison, mirroring the
sdp_media_type() pattern a few lines below, so short values cannot reach
strncasecmp().
The bug was found by LLM-assisted manual review of the SIP helper's
parsers and confirmed with a userspace ASan harness built from the
verbatim parser functions, which reports a heap-buffer-overflow read of
size 2 in strncasecmp() called from ct_sip_parse_transport().
Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly")
Link: https://patch.msgid.link/20260815133104.50369-1-joasantonio108@gmail.com/
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_sip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 64bc440b1181..b05dc8858d09 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -701,9 +701,9 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
&matchoff, &matchlen)) {
- if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP")))
+ if (matchlen >= 3 && !strncasecmp(dptr + matchoff, "TCP", 3))
*proto = IPPROTO_TCP;
- else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP")))
+ else if (matchlen >= 3 && !strncasecmp(dptr + matchoff, "UDP", 3))
*proto = IPPROTO_UDP;
else
return 0;
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 13/15] netfilter: nf_tables: fix memleak when rule deletion fails with hardware offload
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (11 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 12/15] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport() Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 14/15] netfilter: xt_recent: do not call remove_proc_entry() under recent_lock Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 15/15] netfilter: nat: zero newrange before filling it in Pablo Neira Ayuso
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
Allocate flow rule object after transaction has been allocation and rule
deactivation has been performed, otherwise memleak is possible. Let the
transaction unwind the existing rule deactivation from the abort path,
this needs to update nft_flow_rule_destroy() to skip release if
flow_rule is null.
While at this, remove check for non-null flow_rule in newrule error path
now that nft_flow_rule_destroy() is skipped if flow_rule is null.
Fixes: 63b48c73ff56 ("netfilter: nf_tables_offload: undo updates if transaction fails")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Link: https://patch.msgid.link/20261028062204.1079089-1-hdthky0@gmail.com/
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 21 +++++++++------------
net/netfilter/nf_tables_offload.c | 3 +++
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 59ac623e6805..8b94b5e7dbdb 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -760,16 +760,6 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
if (trans == NULL)
return -ENOMEM;
- if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
- flow = nft_flow_rule_create(ctx->net, rule);
- if (IS_ERR(flow)) {
- nft_trans_destroy(trans);
- return PTR_ERR(flow);
- }
-
- nft_trans_flow_rule(trans) = flow;
- }
-
err = nf_tables_delrule_deactivate(ctx, rule);
if (err < 0) {
nft_trans_destroy(trans);
@@ -777,6 +767,14 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
}
nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
+ if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
+ flow = nft_flow_rule_create(ctx->net, rule);
+ if (IS_ERR(flow))
+ return PTR_ERR(flow);
+
+ nft_trans_flow_rule(trans) = flow;
+ }
+
return 0;
}
@@ -4570,8 +4568,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
err_destroy_flow_rule:
nft_use_dec_restore(&chain->use);
err_destroy_flow:
- if (flow)
- nft_flow_rule_destroy(flow);
+ nft_flow_rule_destroy(flow);
err_release_rule:
nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR);
nf_tables_rule_destroy(&ctx, rule);
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 0ac3c26dfb3d..48b9e58e0c44 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -148,6 +148,9 @@ void nft_flow_rule_destroy(struct nft_flow_rule *flow)
struct flow_action_entry *entry;
int i;
+ if (!flow)
+ return;
+
flow_action_for_each(i, entry, &flow->rule->action) {
switch (entry->id) {
case FLOW_ACTION_REDIRECT:
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 14/15] netfilter: xt_recent: do not call remove_proc_entry() under recent_lock
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (12 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 13/15] netfilter: nf_tables: fix memleak when rule deletion fails with hardware offload Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
2026-11-02 0:56 ` [PATCH net 15/15] netfilter: nat: zero newrange before filling it in Pablo Neira Ayuso
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: "Cen Zhang (Microsoft)" <cenzhang@linux.microsoft.com>
recent_proc_net_exit() removes the /proc/net/xt_recent/<name> entries of
a dying network namespace while holding spin_lock_bh(&recent_lock).
remove_proc_entry() may sleep: proc_entry_rundown() waits until every
task that is still inside the entry's file operations has left. A reader
of such an entry is counted in by proc_reg_read() before
recent_seq_start() takes recent_lock. So if a read is in flight when the
namespace is torn down, cleanup_net() sleeps in atomic context holding
the spinlock that the reader is spinning on, and neither side can ever
make progress.
An unprivileged user can trigger this from a user namespace by adding a
rule with the "recent" match and reading its proc file while the
namespace is being destroyed. As recent_lock is global, every later
attempt to take it spins forever too: the spinning can spread to all
CPUs, and network namespace teardown stops system-wide.
BUG: sleeping function called from invalid context at
kernel/sched/completion.c:116
#3: (recent_lock){+...}-{3:3}, at: recent_net_exit+0x2b/0x140
Workqueue: netns cleanup_net
Call Trace:
proc_entry_rundown+0x185/0x1b0
remove_proc_entry+0x21a/0x520
recent_net_exit+0x7f/0x140
cleanup_net+0x414/0x8f0
...
rcu: INFO: rcu_preempt self-detected stall on CPU
Call Trace:
queued_spin_lock_slowpath+0x313/0xc20
recent_seq_start+0x87/0x1b0
seq_read_iter+0x265/0x11e0
proc_reg_read+0x1ab/0x270
Fix by taking recent_mutex instead of recent_lock. According to
commit a0e889bb1bdc ("[NETFILTER]: recent match: fix "sleeping function
called from invalid context""), recent_mutex is the lock to use here: it
protects recent_net->tables and was introduced so that proc entries are
created and removed without recent_lock held, because those calls may
sleep. hashlimit_proc_net_exit() does the same for xt_hashlimit.
Fixes: 665e205c16c1 ("netfilter: xt_recent: fix namespace destroy path")
Cc: stable@vger.kernel.org
Cc: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_recent.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 55f1f2d89952..00cccf003cff 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -650,14 +650,15 @@ static void __net_exit recent_proc_net_exit(struct net *net)
/* recent_net_exit() is called before recent_mt_destroy(). Make sure
* that the parent xt_recent proc entry is empty before trying to
- * remove it.
+ * remove it. Use recent_mutex instead of recent_lock since
+ * remove_proc_entry() may sleep.
*/
- spin_lock_bh(&recent_lock);
+ mutex_lock(&recent_mutex);
list_for_each_entry(t, &recent_net->tables, list)
remove_proc_entry(t->name, recent_net->xt_recent);
recent_net->xt_recent = NULL;
- spin_unlock_bh(&recent_lock);
+ mutex_unlock(&recent_mutex);
remove_proc_entry("xt_recent", net->proc_net);
}
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH net 15/15] netfilter: nat: zero newrange before filling it in
2026-11-02 0:56 [PATCH net 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
` (13 preceding siblings ...)
2026-11-02 0:56 ` [PATCH net 14/15] netfilter: xt_recent: do not call remove_proc_entry() under recent_lock Pablo Neira Ayuso
@ 2026-11-02 0:56 ` Pablo Neira Ayuso
14 siblings, 0 replies; 18+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-02 0:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, horms, fw, ja
From: Florian Westphal <fw@strlen.de>
nf_nat_masquerade_ipv4(), nf_nat_masquerade_ipv6(), netmap_tg4() and
netmap_tg6() each build a stack-local struct nf_nat_range2 from the
caller-supplied range, inheriting range->flags unmodified. Two of them
only memset() the min_addr/max_addr members, the other two don't
memset() anything at all, so newrange.base_proto is left as stack
garbage.
If the inherited flags include NF_NAT_RANGE_PROTO_OFFSET,
nf_nat_l4proto_unique_tuple() reads range->base_proto.all to compute
the NAT port offset. Neither the NETMAP nor the MASQUERADE targets
mask the flags field in their checkentry callback, so this
uninitialized stack value can end up feeding the NAT port selection.
The per-member memset()s are not enough: they have to enumerate every
field that must be cleared, and base_proto was missed when
NF_NAT_RANGE_PROTO_OFFSET/base_proto was added to the struct. memset()
the whole struct instead, so every member is covered regardless of
which ones get explicitly assigned afterwards.
There are other places that miss this, but those hardcode .flags so
nat core won't read from the uninitialized fields.
C99 initializers would be preferrable, but this is a more intrusive
change. Lets followup in nf-next and convert others as well.
This is an LLM finding.
Fixes: 2eb0f624b709 ("netfilter: add NAT support for shifted portmap ranges")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_nat_masquerade.c | 4 ++--
net/netfilter/xt_NETMAP.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c
index 4de6e0a51701..c2a85bd84af1 100644
--- a/net/netfilter/nf_nat_masquerade.c
+++ b/net/netfilter/nf_nat_masquerade.c
@@ -62,8 +62,7 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
nat->masq_index = out->ifindex;
/* Transfer from original range. */
- memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
- memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+ memset(&newrange, 0, sizeof(newrange));
newrange.flags = range->flags | NF_NAT_RANGE_MAP_IPS;
newrange.min_addr.ip = newsrc;
newrange.max_addr.ip = newsrc;
@@ -242,6 +241,7 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
if (nat)
nat->masq_index = out->ifindex;
+ memset(&newrange, 0, sizeof(newrange));
newrange.flags = range->flags | NF_NAT_RANGE_MAP_IPS;
newrange.min_addr.in6 = src;
newrange.max_addr.in6 = src;
diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c
index 7da065a472e0..8bcb3f716d68 100644
--- a/net/netfilter/xt_NETMAP.c
+++ b/net/netfilter/xt_NETMAP.c
@@ -44,6 +44,7 @@ netmap_tg6(struct sk_buff *skb, const struct xt_action_param *par)
netmask.ip6[i];
}
+ memset(&newrange, 0, sizeof(newrange));
newrange.flags = range->flags | NF_NAT_RANGE_MAP_IPS;
newrange.min_addr = new_addr;
newrange.max_addr = new_addr;
@@ -91,8 +92,7 @@ netmap_tg4(struct sk_buff *skb, const struct xt_action_param *par)
new_ip = ip_hdr(skb)->saddr & ~netmask;
new_ip |= mr->range[0].min_ip & netmask;
- memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
- memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+ memset(&newrange, 0, sizeof(newrange));
newrange.flags = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
newrange.min_addr.ip = new_ip;
newrange.max_addr.ip = new_ip;
--
2.47.3
^ permalink raw reply related [flat|nested] 18+ messages in thread