Patch "netfilter: conntrack: fix wrong ct->timeout value" has been added to the 6.3-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    netfilter: conntrack: fix wrong ct->timeout value

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-conntrack-fix-wrong-ct-timeout-value.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e47bd80b2a29d1ef74923277662d8329f7480219
Author: Tzung-Bi Shih <tzungbi@xxxxxxxxxx>
Date:   Wed Apr 19 13:15:26 2023 +0800

    netfilter: conntrack: fix wrong ct->timeout value
    
    [ Upstream commit 73db1b8f2bb6725b7391e85aab41fdf592b3c0c1 ]
    
    (struct nf_conn)->timeout is an interval before the conntrack
    confirmed.  After confirmed, it becomes a timestamp.
    
    It is observed that timeout of an unconfirmed conntrack:
    - Set by calling ctnetlink_change_timeout(). As a result,
      `nfct_time_stamp` was wrongly added to `ct->timeout` twice.
    - Get by calling ctnetlink_dump_timeout(). As a result,
      `nfct_time_stamp` was wrongly subtracted.
    
    Call Trace:
     <TASK>
     dump_stack_lvl
     ctnetlink_dump_timeout
     __ctnetlink_glue_build
     ctnetlink_glue_build
     __nfqnl_enqueue_packet
     nf_queue
     nf_hook_slow
     ip_mc_output
     ? __pfx_ip_finish_output
     ip_send_skb
     ? __pfx_dst_output
     udp_send_skb
     udp_sendmsg
     ? __pfx_ip_generic_getfrag
     sock_sendmsg
    
    Separate the 2 cases in:
    - Setting `ct->timeout` in __nf_ct_set_timeout().
    - Getting `ct->timeout` in ctnetlink_dump_timeout().
    
    Pablo appends:
    
    Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is
    set on, otherwise conntrack creation via ctnetlink breaks.
    
    Note that the problem described in this patch occurs since the
    introduction of the nfnetlink_queue conntrack support, select a
    sufficiently old Fixes: tag for -stable kernel to pick up this fix.
    
    Fixes: a4b4766c3ceb ("netfilter: nfnetlink_queue: rename related to nfqueue attaching conntrack info")
    Signed-off-by: Tzung-Bi Shih <tzungbi@xxxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 71d1269fe4d4f..3384859a89210 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -89,7 +89,11 @@ static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout)
 {
 	if (timeout > INT_MAX)
 		timeout = INT_MAX;
-	WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout);
+
+	if (nf_ct_is_confirmed(ct))
+		WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout);
+	else
+		ct->timeout = (u32)timeout;
 }
 
 int __nf_ct_change_timeout(struct nf_conn *ct, u64 cta_timeout);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d3ee188546982..6f3b23a6653cc 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -176,7 +176,12 @@ static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
 static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct,
 				  bool skip_zero)
 {
-	long timeout = nf_ct_expires(ct) / HZ;
+	long timeout;
+
+	if (nf_ct_is_confirmed(ct))
+		timeout = nf_ct_expires(ct) / HZ;
+	else
+		timeout = ct->timeout / HZ;
 
 	if (skip_zero && timeout == 0)
 		return 0;
@@ -2253,9 +2258,6 @@ ctnetlink_create_conntrack(struct net *net,
 	if (!cda[CTA_TIMEOUT])
 		goto err1;
 
-	timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
-	__nf_ct_set_timeout(ct, timeout);
-
 	rcu_read_lock();
  	if (cda[CTA_HELP]) {
 		char *helpname = NULL;
@@ -2319,6 +2321,9 @@ ctnetlink_create_conntrack(struct net *net,
 	/* we must add conntrack extensions before confirmation. */
 	ct->status |= IPS_CONFIRMED;
 
+	timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
+	__nf_ct_set_timeout(ct, timeout);
+
 	if (cda[CTA_STATUS]) {
 		err = ctnetlink_change_status(ct, cda);
 		if (err < 0)



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux