No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Liping Zhang 53b56da83d netfilter: ctnetlink: make it safer when updating ct->status
After converting to use rcu for conntrack hash, one CPU may update
the ct->status via ctnetlink, while another CPU may process the
packets and update the ct->status.

So the non-atomic operation "ct->status |= status;" via ctnetlink
becomes unsafe, and this may clear the IPS_DYING_BIT bit set by
another CPU unexpectedly. For example:
         CPU0                            CPU1
  ctnetlink_change_status        __nf_conntrack_find_get
      old = ct->status              nf_ct_gc_expired
          -                         nf_ct_kill
          -                      test_and_set_bit(IPS_DYING_BIT
      new = old | status;                 -
  ct->status = new; <-- oops, _DYING_ is cleared!

Now using a series of atomic bit operation to solve the above issue.

Also note, user shouldn't set IPS_TEMPLATE, IPS_SEQ_ADJUST directly,
so make these two bits be unchangable too.

If we set the IPS_TEMPLATE_BIT, ct will be freed by nf_ct_tmpl_free,
but actually it is alloced by nf_conntrack_alloc.
If we set the IPS_SEQ_ADJUST_BIT, this may cause the NULL pointer
deference, as the nfct_seqadj(ct) maybe NULL.

Last, add some comments to describe the logic change due to the
commit a963d710f3 ("netfilter: ctnetlink: Fix regression in CTA_STATUS
processing"), which makes me feel a little confusing.

Fixes: 76507f69c4 ("[NETFILTER]: nf_conntrack: use RCU for conntrack hash")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-04-24 20:06:28 +02:00
arch powerpc fixes for 4.11 #8 2017-04-21 09:34:45 -07:00
block blk-mq: fix potential oops with polling and blk-mq scheduler 2017-04-20 14:53:28 -06:00
certs
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2017-04-18 09:03:50 -07:00
Documentation pci-v4.11-fixes-5 2017-04-21 09:26:34 -07:00
drivers Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-04-21 13:20:47 -07:00
firmware
fs Fix a 4.11 regression that triggers a BUG() on an attempt to use an 2017-04-21 16:37:48 -07:00
include netfilter: ctnetlink: make it safer when updating ct->status 2017-04-24 20:06:28 +02:00
init
ipc
kernel While continuing my development, I uncovered two more small bugs. 2017-04-20 12:30:10 -07:00
lib sparc64: Use LOCKDEP_SMALL, not PROVE_LOCKING_SMALL 2017-04-18 13:11:07 -07:00
mm mm: prevent NR_ISOLATE_* stats from going negative 2017-04-20 15:30:18 -07:00
net netfilter: ctnetlink: make it safer when updating ct->status 2017-04-24 20:06:28 +02:00
samples
scripts Kbuild fixes for v4.11 2017-04-05 08:37:28 -07:00
security KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings 2017-04-18 15:31:49 +01:00
sound
tools bpf: Fix values type used in test_maps 2017-04-21 15:16:46 -04:00
usr
virt KVM/ARM Fixes for v4.11-rc6 2017-04-05 16:27:47 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap mailmap: add Martin Kepplinger's email 2017-04-13 18:24:21 -07:00
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS bpf, doc: update bpf maintainers entry 2017-04-21 15:25:10 -04:00
Makefile Linux 4.11-rc7 2017-04-16 13:00:18 -07:00
README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.