netfilter: conntrack: fix possible bug_on with enable_hooks=1
authorFlorian Westphal <fw@strlen.de>
Thu, 4 May 2023 12:55:02 +0000 (14:55 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 10 May 2023 06:50:39 +0000 (08:50 +0200)
commite72eeab542dbf4f544e389e64fa13b82a1b6d003
tree296f5202317f6d23f41818b9454d4ce0215e7bdb
parentdc1c9fd4a8bbe1e06add9053010b652449bfe411
netfilter: conntrack: fix possible bug_on with enable_hooks=1

I received a bug report (no reproducer so far) where we trip over

712         rcu_read_lock();
713         ct_hook = rcu_dereference(nf_ct_hook);
714         BUG_ON(ct_hook == NULL);  // here

In nf_conntrack_destroy().

First turn this BUG_ON into a WARN.  I think it was triggered
via enable_hooks=1 flag.

When this flag is turned on, the conntrack hooks are registered
before nf_ct_hook pointer gets assigned.
This opens a short window where packets enter the conntrack machinery,
can have skb->_nfct set up and a subsequent kfree_skb might occur
before nf_ct_hook is set.

Call nf_conntrack_init_end() to set nf_ct_hook before we register the
pernet ops.

Fixes: ba3fbe663635 ("netfilter: nf_conntrack: provide modparam to always register conntrack hooks")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/core.c
net/netfilter/nf_conntrack_standalone.c