Florian Westphal 84379c9afe netfilter: ipv6: nf_defrag: drop skb dst before queueing ...

Eric Dumazet reports:
 Here is a reproducer of an annoying bug detected by syzkaller on our production kernel
 [..]
 ./b78305423 enable_conntrack
 Then :
 sleep 60
 dmesg | tail -10
 [  171.599093] unregister_netdevice: waiting for lo to become free. Usage count = 2
 [  181.631024] unregister_netdevice: waiting for lo to become free. Usage count = 2
 [  191.687076] unregister_netdevice: waiting for lo to become free. Usage count = 2
 [  201.703037] unregister_netdevice: waiting for lo to become free. Usage count = 2
 [  211.711072] unregister_netdevice: waiting for lo to become free. Usage count = 2
 [  221.959070] unregister_netdevice: waiting for lo to become free. Usage count = 2

Reproducer sends ipv6 fragment that hits nfct defrag via LOCAL_OUT hook.
skb gets queued until frag timer expiry -- 1 minute.

Normally nf_conntrack_reasm gets called during prerouting, so skb has
no dst yet which might explain why this wasn't spotted earlier.

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-by: John Sperbeck <jsperbeck@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2018-07-09 18:04:12 +02:00

..

ip6_tables.c

netfilter: x_tables: set module owner for icmp(6) matches

2018-07-05 11:45:11 +02:00

ip6t_ah.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_eui64.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

ip6t_frag.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_hbh.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_ipv6header.c

netfilter: remove unnecessary break after return

2014-07-15 16:27:00 -07:00

ip6t_MASQUERADE.c

netfilter: add NAT support for shifted portmap ranges

2018-04-24 10:29:12 +02:00

ip6t_mh.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

ip6t_NPT.c

xtables: extend matches and targets with .usersize

2017-01-09 17:24:55 +01:00

ip6t_REJECT.c

netfilter: x_tables: use pr ratelimiting in all remaining spots

2018-02-14 21:05:38 +01:00

ip6t_rpfilter.c

netfilter: ip6t_rpfilter: provide input interface for route lookup

2018-05-23 09:25:54 +02:00

ip6t_rt.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_srh.c

netfilter: ip6t_srh: extend SRH matching for previous, next and last SID

2018-05-06 23:33:03 +02:00

ip6t_SYNPROXY.c

netfilter: ctnetlink: synproxy support

2018-03-20 14:39:31 +01:00

ip6table_filter.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

ip6table_mangle.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

ip6table_nat.c

netfilter: nf_nat: add nat type hooks to nat core

2018-05-23 09:14:06 +02:00

ip6table_raw.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

ip6table_security.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

Kconfig

netfilter: Libify xt_TPROXY

2018-06-03 00:02:05 +02:00

Makefile

netfilter: Libify xt_TPROXY

2018-06-03 00:02:05 +02:00

nf_conntrack_l3proto_ipv6.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

nf_conntrack_proto_icmpv6.c

netfilter: conntrack: timeouts can be const

2018-01-08 18:01:02 +01:00

nf_conntrack_reasm.c

netfilter: ipv6: nf_defrag: drop skb dst before queueing

2018-07-09 18:04:12 +02:00

nf_defrag_ipv6_hooks.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

nf_dup_ipv6.c

netfilter: kill the fake untracked conntrack objects

2017-04-15 11:47:57 +02:00

nf_flow_table_ipv6.c

netfilter: nf_flow_table: move init code to nf_flow_table_core.c

2018-04-24 10:28:45 +02:00

nf_log_ipv6.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

nf_nat_l3proto_ipv6.c

netfilter: nf_nat: add nat type hooks to nat core

2018-05-23 09:14:06 +02:00

nf_nat_masquerade_ipv6.c

netfilter: nat: merge ipv4/ipv6 masquerade code into main nat module

2018-05-29 00:25:36 +02:00

nf_nat_proto_icmpv6.c

netfilter: add NAT support for shifted portmap ranges

2018-04-24 10:29:12 +02:00

nf_reject_ipv6.c

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

nf_socket_ipv6.c

netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}

2018-03-24 21:17:14 +01:00

nf_tproxy_ipv6.c

netfilter: nf_tproxy: fix possible non-linear access to transport header

2018-07-06 14:32:44 +02:00

nft_chain_nat_ipv6.c

netfilter: nf_nat: add nat type hooks to nat core

2018-05-23 09:14:06 +02:00

nft_chain_route_ipv6.c

netfilter: nf_tables: nft_register_chain_type() returns void

2018-03-30 11:29:18 +02:00

nft_dup_ipv6.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-11-15 10:54:36 -05:00

nft_fib_ipv6.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-06 01:20:46 -05:00

nft_masq_ipv6.c

netfilter: add NAT support for shifted portmap ranges

2018-04-24 10:29:12 +02:00

nft_redir_ipv6.c

netfilter: add NAT support for shifted portmap ranges

2018-04-24 10:29:12 +02:00

nft_reject_ipv6.c

netfilter: nf_tables: use hook state from xt_action_param structure

2016-11-03 11:52:34 +01:00