| Message ID | 9925b0003629c6f3421f6b36819fa1edabd44f4f.1648149598.git.marcelo.leitner@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | bcb74e132a76ce0502bb33d5b65533a4ed72d159 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net/sched: act_ct: fix ref leak when switching zones | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Thu, 24 Mar 2022 16:22:10 -0300 you wrote: > When switching zones or network namespaces without doing a ct clear in > between, it is now leaking a reference to the old ct entry. That's > because tcf_ct_skb_nfct_cached() returns false and > tcf_ct_flow_table_lookup() may simply overwrite it. > > The fix is to, as the ct entry is not reusable, free it already at > tcf_ct_skb_nfct_cached(). > > [...] Here is the summary with links: - [net] net/sched: act_ct: fix ref leak when switching zones https://git.kernel.org/netdev/net/c/bcb74e132a76 You are awesome, thank you!
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index ec19f625863a04229a9a3894a423e6dd562844a1..25718acc0ff00178fa42d6169d930351e565b104 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -605,22 +605,25 @@ static bool tcf_ct_skb_nfct_cached(struct net *net, struct sk_buff *skb, if (!ct) return false; if (!net_eq(net, read_pnet(&ct->ct_net))) - return false; + goto drop_ct; if (nf_ct_zone(ct)->id != zone_id) - return false; + goto drop_ct; /* Force conntrack entry direction. */ if (force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) { if (nf_ct_is_confirmed(ct)) nf_ct_kill(ct); - nf_ct_put(ct); - nf_ct_set(skb, NULL, IP_CT_UNTRACKED); - - return false; + goto drop_ct; } return true; + +drop_ct: + nf_ct_put(ct); + nf_ct_set(skb, NULL, IP_CT_UNTRACKED); + + return false; } /* Trim the skb to the length specified by the IP/IPv6 header,
When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcf_ct_skb_nfct_cached() returns false and tcf_ct_flow_table_lookup() may simply overwrite it. The fix is to, as the ct entry is not reusable, free it already at tcf_ct_skb_nfct_cached(). Reported-by: Florian Westphal <fw@strlen.de> Fixes: 2f131de361f6 ("net/sched: act_ct: Fix flow table lookup after ct clear or switching zones") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> --- net/sched/act_ct.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)