Hi Pablo,
On Wed, Mar 15, 2017 at 9:07 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Tue, Mar 14, 2017 at 02:26:06PM +0800, fgao@xxxxxxxxxx wrote:
>> From: Gao Feng <fgao@xxxxxxxxxx>
>>
>> The helper module permits the helper modules register expectfn, and
>> it could be hold by external caller. But when the module is unloaded,
>> there may be some pending expect nodes which still hold the function
>> reference. It may cause unexpected behavior, even panic.
>>
>> Now it would delete the expect nodes which uses the expectfn when
>> unregister expectfn. And it must use the rcu_read_lock to protect
>> the expectfn until insert it or doesn't access it ever.
>
> Expectations should be removed by when the helper module is gone, so
> what is the problem here?
Let me explain it as following:
1. The expectations would be removed by when the helper module is
gone, but expectfn is not. For example, the file nf_nat_sip.c. It
registers the expectfn at init, and unregister expectfn at exit. But
it doesn't remove the expect node when unload;
The nf_nat_sip.c uses nf_ct_helper_expectfn_register register expectfn
and nf_ct_helper_expectfn_unregister unregister the expectfn.
2. ctlink could create one expect by CTA_EXPECT_FN and without
CTA_EXPECT_HELP_NAME. It invokes nf_ct_helper_expectfn_find_by_name to
get expectfn and helper is NULL.
There is one race condition
cpu1
cpu2
ctlink creates the expect node with expectfn
the expectfn is unregistered
insert the expect node
Now the bug comes on. The module which expectfn is in is unloaded.
Best Regards
Feng
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
