iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/include/net/netfilter
History
Florian Westphal 56b14ecec9 netfilter: conntrack: re-fetch conntrack after insertion 
In case the conntrack is clashing, insertion can free skb->_nfct and
set skb->_nfct to the already-confirmed entry.

This wasn't found before because the conntrack entry and the extension
space used to free'd after an rcu grace period, plus the race needs
events enabled to trigger.

Reported-by: <syzbot+793a590957d9c1b96620@syzkaller.appspotmail.com>
Fixes: 71d8c47fc653 ("netfilter: conntrack: introduce clash resolution on insertion race")
Fixes: 2ad9d7747c10 ("netfilter: conntrack: free extension area immediately")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2022-05-27 11:16:34 +02:00
..
ipv4
netfilter: disable defrag once its no longer needed
2021-04-26 03:20:07 +02:00
ipv6
netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
2021-09-28 13:04:55 +02:00
br_netfilter.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_conntrack_acct.h
netfilter: conntrack: remove extension register api
2022-02-04 06:30:28 +01:00
nf_conntrack_act_ct.h
net/sched: act_ct: Fill offloading tuple iifidx
2022-01-04 12:12:55 +00:00
nf_conntrack_bpf.h
net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPF
2022-01-18 14:26:42 -08:00
nf_conntrack_bridge.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_conntrack_core.h
netfilter: conntrack: re-fetch conntrack after insertion
2022-05-27 11:16:34 +02:00
nf_conntrack_count.h
netfilter: nf_conncount: reduce unnecessary GC
2022-05-16 13:05:40 +02:00
nf_conntrack_ecache.h
netfilter: prefer extension check to pointer check
2022-05-13 18:56:28 +02:00
nf_conntrack_expect.h
netfilter: fix coding-style errors.
2019-09-13 11:39:38 +02:00
nf_conntrack_extend.h
netfilter: extensions: introduce extension genid count
2022-05-13 18:52:16 +02:00
nf_conntrack_helper.h
netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned()
2022-03-20 00:29:35 +01:00
nf_conntrack_l4proto.h
netfilter: conntrack: pass hook state to log functions
2021-06-18 14:47:43 +02:00
nf_conntrack_labels.h
netfilter: extensions: introduce extension genid count
2022-05-13 18:52:16 +02:00
nf_conntrack_seqadj.h
netfilter: conntrack: remove extension register api
2022-02-04 06:30:28 +01:00
nf_conntrack_synproxy.h
netfilter: conntrack: wrap two inline functions in config checks.
2019-09-13 12:47:10 +02:00
nf_conntrack_timeout.h
netfilter: cttimeout: decouple unlink and free on netns destruction
2022-05-13 18:52:16 +02:00
nf_conntrack_timestamp.h
netfilter: conntrack: remove extension register api
2022-02-04 06:30:28 +01:00
nf_conntrack_tuple.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_conntrack_zones.h
netfilter: conntrack: remove CONFIG_NF_CONNTRACK checks from nf_conntrack_zones.h.
2019-09-13 12:47:41 +02:00
nf_conntrack.h
netfilter: conntrack: add nf_ct_iter_data object for nf_ct_iterate_cleanup*()
2022-05-13 18:56:27 +02:00
nf_dup_netdev.h
netfilter: nft_{fwd,dup}_netdev: add offload support
2019-09-10 22:44:29 +02:00
nf_flow_table.h
netfilter: flowtable: Fix QinQ and pppoe support for inet table
2022-03-16 11:25:04 +01:00
nf_hooks_lwtunnel.h
netfilter: add netfilter hooks to SRv6 data plane
2021-08-30 01:51:36 +02:00
nf_log.h
netfilter: nf_log_common: merge with nf_log_syslog
2021-03-31 22:34:10 +02:00
nf_nat_helper.h
netfilter: add missing includes to a number of header-files.
2019-08-13 12:14:39 +02:00
nf_nat_masquerade.h
netfilter: update include directives.
2019-09-13 12:33:06 +02:00
nf_nat_redirect.h
netfilter: add missing includes to a number of header-files.
2019-08-13 12:14:39 +02:00
nf_nat.h
netfilter: nat: move nf_xfrm_me_harder to where it is used
2021-04-26 03:20:07 +02:00
nf_queue.h
netfilter: nf_queue: fix possible use-after-free
2022-03-01 11:50:35 +01:00
nf_reject.h
netfilter: conntrack: skip verification of zero UDP checksum
2022-05-13 18:56:28 +02:00
nf_socket.h
netfilter: Decrease code duplication regarding transparent socket option
2018-06-03 00:02:01 +02:00
nf_synproxy.h
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
nf_tables_core.h
netfilter: nft_cmp: optimize comparison for 16-bytes
2022-02-09 12:00:28 +01:00
nf_tables_ipv4.h
netfilter: nf_tables: convert pktinfo->tprot_set to flags field
2021-11-01 09:30:20 +01:00
nf_tables_ipv6.h
netfilter: nf_tables: convert pktinfo->tprot_set to flags field
2021-11-01 09:30:20 +01:00
nf_tables_offload.h
netfilter: nf_tables_offload: incorrect flow offload action array size
2022-02-20 01:22:20 +01:00
nf_tables.h
netfilter: nf_tables: cancel tracking for clobbered destination registers
2022-03-20 00:29:46 +01:00
nf_tproxy.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-07-20 22:28:28 -07:00
nft_fib.h
netfilter: nft_fib: add reduce support
2022-03-20 00:29:47 +01:00
nft_meta.h
netfilter: nft_meta: extend reduce support to bridge family
2022-03-20 00:29:46 +01:00
nft_reject.h
netfilter: add missing includes to a number of header-files.
2019-08-13 12:14:39 +02:00
xt_rateest.h
net: sched: Merge Qdisc::bstats and Qdisc::cpu_bstats data types
2021-10-18 12:54:41 +01:00