[PATCH net 06/15] ipvs: ftp: skip conntrack templates in ip_vs_ftp_out

[Pablo Neira Ayuso <pablo@netfilter.org>]

From: Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>

A CT target hooked after conntrack attaches its template to a packet
that conntrack left without an entry. On an IPVS FTP PASV/EPSV reply,
ip_vs_ftp_out() then mangles with the template and creates an
expectation with the template as master. Deleting the CT rule frees
the template and leaves the expectation, so a later expectation flush
reads freed memory:

  BUG: KASAN: slab-use-after-free in nf_ct_unlink_expect_report

Reachable with CAP_NET_ADMIN in a user namespace.

Skip templates, as nft_ct and nfnetlink_queue do.

Fixes: f4bc17cdd205 ("ipvs: netfilter connection tracking changes")
Cc: stable@vger.kernel.org
Signed-off-by: Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/ipvs/ip_vs_ftp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 4822a1a75212..44de99f4d187 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -383,7 +383,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
 	buf_len = strlen(buf);
 
 	ct = nf_ct_get(skb, &ctinfo);
-	if (ct) {
+	if (ct && !nf_ct_is_template(ct)) {
 		bool mangled;
 
 		/* If mangling fails this function will return 0
-- 
2.47.3