mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
Yuqi Xu
403f96c32c
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.
Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.
Netns teardown detaches the RCU-protected CT limit state in the pernet
.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
RCU grace period between the .pre_exit and .exit callbacks, so the .exit
callback completes the teardown without adding any extra synchronization.
The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.
Fixes: 11efd5cb04 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com
Co-developed-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/288fbd5459d92b9dd0dcc6faf625f04819161ff3.1787280296.git.xuyuqiabc@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
109 lines
2.9 KiB
C
109 lines
2.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (c) 2015 Nicira, Inc.
|
|
*/
|
|
|
|
#ifndef OVS_CONNTRACK_H
|
|
#define OVS_CONNTRACK_H 1
|
|
|
|
#include "flow.h"
|
|
|
|
struct ovs_conntrack_info;
|
|
struct ovs_ct_limit_info;
|
|
enum ovs_key_attr;
|
|
|
|
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
|
|
int ovs_ct_init(struct net *);
|
|
void ovs_ct_exit_start(struct net *net);
|
|
void ovs_ct_exit_finish(struct net *net);
|
|
bool ovs_ct_verify(struct net *, enum ovs_key_attr attr);
|
|
int ovs_ct_copy_action(struct net *, const struct nlattr *,
|
|
const struct sw_flow_key *, struct sw_flow_actions **,
|
|
bool log);
|
|
int ovs_ct_action_to_attr(const struct ovs_conntrack_info *, struct sk_buff *);
|
|
|
|
int ovs_ct_execute(struct net *, struct sk_buff *, struct sw_flow_key *,
|
|
const struct ovs_conntrack_info *);
|
|
int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key);
|
|
|
|
void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key,
|
|
bool post_ct);
|
|
int ovs_ct_put_key(const struct sw_flow_key *swkey,
|
|
const struct sw_flow_key *output, struct sk_buff *skb);
|
|
void ovs_ct_free_action(const struct nlattr *a);
|
|
|
|
#define CT_SUPPORTED_MASK (OVS_CS_F_NEW | OVS_CS_F_ESTABLISHED | \
|
|
OVS_CS_F_RELATED | OVS_CS_F_REPLY_DIR | \
|
|
OVS_CS_F_INVALID | OVS_CS_F_TRACKED | \
|
|
OVS_CS_F_SRC_NAT | OVS_CS_F_DST_NAT)
|
|
#else
|
|
#include <linux/errno.h>
|
|
|
|
static inline int ovs_ct_init(struct net *net) { return 0; }
|
|
|
|
static inline void ovs_ct_exit_start(struct net *net) { }
|
|
static inline void ovs_ct_exit_finish(struct net *net) { }
|
|
|
|
static inline bool ovs_ct_verify(struct net *net, int attr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline int ovs_ct_copy_action(struct net *net, const struct nlattr *nla,
|
|
const struct sw_flow_key *key,
|
|
struct sw_flow_actions **acts, bool log)
|
|
{
|
|
return -ENOTSUPP;
|
|
}
|
|
|
|
static inline int ovs_ct_action_to_attr(const struct ovs_conntrack_info *info,
|
|
struct sk_buff *skb)
|
|
{
|
|
return -ENOTSUPP;
|
|
}
|
|
|
|
static inline int ovs_ct_execute(struct net *net, struct sk_buff *skb,
|
|
struct sw_flow_key *key,
|
|
const struct ovs_conntrack_info *info)
|
|
{
|
|
kfree_skb(skb);
|
|
return -ENOTSUPP;
|
|
}
|
|
|
|
static inline int ovs_ct_clear(struct sk_buff *skb,
|
|
struct sw_flow_key *key)
|
|
{
|
|
return -ENOTSUPP;
|
|
}
|
|
|
|
static inline void ovs_ct_fill_key(const struct sk_buff *skb,
|
|
struct sw_flow_key *key,
|
|
bool post_ct)
|
|
{
|
|
key->ct_state = 0;
|
|
key->ct_zone = 0;
|
|
key->ct.mark = 0;
|
|
memset(&key->ct.labels, 0, sizeof(key->ct.labels));
|
|
/* Clear 'ct_orig_proto' to mark the non-existence of original
|
|
* direction key fields.
|
|
*/
|
|
key->ct_orig_proto = 0;
|
|
}
|
|
|
|
static inline int ovs_ct_put_key(const struct sw_flow_key *swkey,
|
|
const struct sw_flow_key *output,
|
|
struct sk_buff *skb)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ovs_ct_free_action(const struct nlattr *a) { }
|
|
|
|
#define CT_SUPPORTED_MASK 0
|
|
#endif /* CONFIG_NF_CONNTRACK */
|
|
|
|
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
|
|
extern struct genl_family dp_ct_limit_genl_family;
|
|
#endif
|
|
#endif /* ovs_conntrack.h */
|