From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A0A9C282CE for ; Fri, 12 Apr 2019 17:55:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0AC9620818 for ; Fri, 12 Apr 2019 17:55:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="L6uzsjKn" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726798AbfDLRzM (ORCPT ); Fri, 12 Apr 2019 13:55:12 -0400 Received: from mail-pg1-f194.google.com ([209.85.215.194]:45130 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726765AbfDLRzM (ORCPT ); Fri, 12 Apr 2019 13:55:12 -0400 Received: by mail-pg1-f194.google.com with SMTP id y3so5531443pgk.12 for ; Fri, 12 Apr 2019 10:55:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=SaS+qPYFUymdM5olQNs6/EIS3R1ZuDQFfxACotO11T8=; b=L6uzsjKnieHsx/mPZUtmiMH3Ctp0go8ixRkRit3Ug5gTb2TvTEcgveZ6YLyxAMG2MP 9JRpXrluA4xCRMzxlwP/50NM0tFfA662rG1PjuxJfug9yXX6O2DA4mcPaBR23gjjlCFd 8oa5vCaeVp2nBok71v5cAVwxaNUdDpkmzH+cQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=SaS+qPYFUymdM5olQNs6/EIS3R1ZuDQFfxACotO11T8=; b=JEdM/vLbjH5EuzbzTv/5yBRn7KFa68m5qp8CrZxTUATWbtC2H2VmJ3dCWVEsv+Rdw0 GZvLpHVq/avoWMYWhrJSlHeZHrJC27tavTIrEYLUFLfcc5M2LWj2daAnq+cl5a6K9to2 n3Oym1VPtuDfGL4ZVJjRjc+8D+swdMJDFgudjoEsM+3UTvecN1zNRRVXrlRrnHrrCGoU xbFtfA2woKfQsbDUlAjj4xYGsGEg4yXRUadxlT06gWjOyR6t19ifbsc5C0MZv6eMdhOE gJNo08TwTjqYyxWX6MSoTTLVTRXLTrUxvmJvY87kH9Hgs4fcFvrjmP6Ti9aFiy364JX6 auzQ== X-Gm-Message-State: APjAAAWBzJI0Zq0MO/BLvz2YiMIplRW9MyxYXiOAEvPxFVjp9/UaxeCH Fok80sopvuvtniwMNW8Vb2B9mhu13DgUqQ== X-Google-Smtp-Source: APXvYqx4MrspPEurYncLlU59Vce8GAKHg0+ybC1kSvypIX4DmeO8JFWzxW2q/c/GPEkBpxAYs/41Zw== X-Received: by 2002:aa7:9a89:: with SMTP id w9mr50637786pfi.213.1555091711100; Fri, 12 Apr 2019 10:55:11 -0700 (PDT) Received: from zsm-linux.mtv.corp.google.com ([2620:15c:202:201:49ea:b78f:4f04:4d25]) by smtp.googlemail.com with ESMTPSA id a24sm46133190pgv.10.2019.04.12.10.55.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 12 Apr 2019 10:55:10 -0700 (PDT) From: Zubin Mithra To: stable@vger.kernel.org Cc: gregkh@linuxfoundation.org, groeck@chromium.org, pablo@netfilter.org, fw@strlen.de, eric.dumazet@gmail.com, kadlec@blackhole.kfki.hu, davem@davemloft.net Subject: [PATCH v4.19.y 2/2] netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too Date: Fri, 12 Apr 2019 10:55:03 -0700 Message-Id: <20190412175503.132995-2-zsm@chromium.org> X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog In-Reply-To: <20190412175503.132995-1-zsm@chromium.org> References: <20190412175503.132995-1-zsm@chromium.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Florian Westphal commit 89259088c1b7fecb43e8e245dc931909132a4e03 upstream syzbot was able to trigger the WARN in cttimeout_default_get() by passing UDPLITE as l4protocol. Alias UDPLITE to UDP, both use same timeout values. Furthermore, also fetch GRE timeouts. GRE is a bit more complicated, as it still can be a module and its netns_proto_gre struct layout isn't visible outside of the gre module. Can't move timeouts around, it appears conntrack sysctl unregister assumes net_generic() returns nf_proto_net, so we get crash. Expose layout of netns_proto_gre instead. A followup nf-next patch could make gre tracker be built-in as well if needed, its not that large. Last, make the WARN() mention the missing protocol value in case anything else is missing. Reported-by: syzbot+2fae8fa157dd92618cae@syzkaller.appspotmail.com Fixes: 8866df9264a3 ("netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Zubin Mithra --- include/linux/netfilter/nf_conntrack_proto_gre.h | 13 +++++++++++++ net/netfilter/nf_conntrack_proto_gre.c | 14 ++------------ net/netfilter/nfnetlink_cttimeout.c | 15 +++++++++++++-- 3 files changed, 28 insertions(+), 14 deletions(-) diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h index b8d95564bd53..14edb795ab43 100644 --- a/include/linux/netfilter/nf_conntrack_proto_gre.h +++ b/include/linux/netfilter/nf_conntrack_proto_gre.h @@ -21,6 +21,19 @@ struct nf_ct_gre_keymap { struct nf_conntrack_tuple tuple; }; +enum grep_conntrack { + GRE_CT_UNREPLIED, + GRE_CT_REPLIED, + GRE_CT_MAX +}; + +struct netns_proto_gre { + struct nf_proto_net nf; + rwlock_t keymap_lock; + struct list_head keymap_list; + unsigned int gre_timeouts[GRE_CT_MAX]; +}; + /* add new tuple->key_reply pair to keymap */ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir, struct nf_conntrack_tuple *t); diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c index 650eb4fba2c5..841c472aae1c 100644 --- a/net/netfilter/nf_conntrack_proto_gre.c +++ b/net/netfilter/nf_conntrack_proto_gre.c @@ -43,24 +43,12 @@ #include #include -enum grep_conntrack { - GRE_CT_UNREPLIED, - GRE_CT_REPLIED, - GRE_CT_MAX -}; - static const unsigned int gre_timeouts[GRE_CT_MAX] = { [GRE_CT_UNREPLIED] = 30*HZ, [GRE_CT_REPLIED] = 180*HZ, }; static unsigned int proto_gre_net_id __read_mostly; -struct netns_proto_gre { - struct nf_proto_net nf; - rwlock_t keymap_lock; - struct list_head keymap_list; - unsigned int gre_timeouts[GRE_CT_MAX]; -}; static inline struct netns_proto_gre *gre_pernet(struct net *net) { @@ -408,6 +396,8 @@ static int __init nf_ct_proto_gre_init(void) { int ret; + BUILD_BUG_ON(offsetof(struct netns_proto_gre, nf) != 0); + ret = register_pernet_subsys(&proto_gre_net_ops); if (ret < 0) goto out_pernet; diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c index 1dc4ea327cbe..70a7382b9787 100644 --- a/net/netfilter/nfnetlink_cttimeout.c +++ b/net/netfilter/nfnetlink_cttimeout.c @@ -469,7 +469,8 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, case IPPROTO_TCP: timeouts = net->ct.nf_ct_proto.tcp.timeouts; break; - case IPPROTO_UDP: + case IPPROTO_UDP: /* fallthrough */ + case IPPROTO_UDPLITE: timeouts = net->ct.nf_ct_proto.udp.timeouts; break; case IPPROTO_DCCP: @@ -483,13 +484,23 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, case IPPROTO_SCTP: #ifdef CONFIG_NF_CT_PROTO_SCTP timeouts = net->ct.nf_ct_proto.sctp.timeouts; +#endif + break; + case IPPROTO_GRE: +#ifdef CONFIG_NF_CT_PROTO_GRE + if (l4proto->net_id) { + struct netns_proto_gre *net_gre; + + net_gre = net_generic(net, *l4proto->net_id); + timeouts = net_gre->gre_timeouts; + } #endif break; case 255: timeouts = &net->ct.nf_ct_proto.generic.timeout; break; default: - WARN_ON_ONCE(1); + WARN_ONCE(1, "Missing timeouts for proto %d", l4proto->l4proto); break; } -- 2.21.0.392.gf8f6787159e-goog