aboutsummaryrefslogtreecommitdiff
path: root/net/ipv6
diff options
context:
space:
mode:
authorFlorian Westphal2023-02-14 17:23:59 +0100
committerGreg Kroah-Hartman2023-03-11 13:55:24 +0100
commit1fd3c69f6511cc0785d5f5f828a5c095d74df69f (patch)
tree063dafb46f9f01b1f8f7469c690ca670b61f5bd6 /net/ipv6
parent4f25d1dff80535f088b8f8568dd731fb098e29b4 (diff)
netfilter: conntrack: fix rmmod double-free race
[ Upstream commit e6d57e9ff0aec323717ee36fc9ea34ad89217151 ] nf_conntrack_hash_check_insert() callers free the ct entry directly, via nf_conntrack_free. This isn't safe anymore because nf_conntrack_hash_check_insert() might place the entry into the conntrack table and then delteted the entry again because it found that a conntrack extension has been removed at the same time. In this case, the just-added entry is removed again and an error is returned to the caller. Problem is that another cpu might have picked up this entry and incremented its reference count. This results in a use-after-free/double-free, once by the other cpu and once by the caller of nf_conntrack_hash_check_insert(). Fix this by making nf_conntrack_hash_check_insert() not fail anymore after the insertion, just like before the 'Fixes' commit. This is safe because a racing nf_ct_iterate() has to wait for us to release the conntrack hash spinlocks. While at it, make the function return -EAGAIN in the rmmod (genid changed) case, this makes nfnetlink replay the command (suggested by Pablo Neira). Fixes: c56716c69ce1 ("netfilter: extensions: introduce extension genid count") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions