linux-kernel - Re: [PATCH] netfilter: conntrack: drop expectations before freeing templates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aKUVqxJVrGgRJZA4@strlen.de>
Date: Wed, 20 Aug 2025 02:24:11 +0200
From: Florian Westphal <fw@...len.de>
To: Qingjie Xing <xqjcool@...il.com>
Cc: linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org
Subject: Re: [PATCH] netfilter: conntrack: drop expectations before freeing
 templates

Florian Westphal <fw@...len.de> wrote:
> Qingjie Xing <xqjcool@...il.com> wrote:
> > With an iptables-configured TFTP helper in place, a UDP packet 
> > (10.65.41.36:1069 → 10.65.36.2:69, TFTP RRQ) triggered creation of an expectation.
> > Later, iptables changes removed the rule’s per-rule template nf_conn. 
> > When the expectation’s timer expired, nf_ct_unlink_expect_report() 
> > ran and dereferenced the freed master, causing a crash.
> 
> Sorry, I do not see the problem.
> A template should never be listed as exp->master.
> 
> Can you make a reproducer/selftest for this bug?
> 
> I worry we paper over a different bug.

Or maybe this will provide a clue (not even compile tested).

@@ -299,6 +302,9 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 {
        struct nf_conntrack_expect *new;

+       if (WARN_ON_ONCE(nf_ct_is_template(me)))
+               return NULL;
+
        new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
        if (!new)