linux-kernel - Re: [PATCH net] netfilter: br_netfilter: reread nf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9f576014-c54f-44d4-a8aa-ddfafeb7a310@huawei.com>
Date: Fri, 22 Aug 2025 09:08:47 +0800
From: Wang Liang <wangliang74@...wei.com>
To: Florian Westphal <fw@...len.de>
CC: <pablo@...filter.org>, <kadlec@...filter.org>, <razor@...ckwall.org>,
	<idosch@...dia.com>, <davem@...emloft.net>, <edumazet@...gle.com>,
	<kuba@...nel.org>, <pabeni@...hat.com>, <horms@...nel.org>,
	<yuehaibing@...wei.com>, <zhangchangzhong@...wei.com>,
	<netfilter-devel@...r.kernel.org>, <coreteam@...filter.org>,
	<bridge@...ts.linux.dev>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net] netfilter: br_netfilter: reread nf_conn from skb
 after confirm()


在 2025/8/21 14:57, Florian Westphal 写道:
> Wang Liang <wangliang74@...wei.com> wrote:
>> 在 2025/8/20 19:31, Florian Westphal 写道:
>>> Wang Liang <wangliang74@...wei.com> wrote:
>>>> Previous commit 2d72afb34065 ("netfilter: nf_conntrack: fix crash due to
>>>> removal of uninitialised entry") move the IPS_CONFIRMED assignment after
>>>> the hash table insertion.
>>> How is that related to this change?
>>> As you write below, the bug came in with 62e7151ae3eb.
>> Before the commit 2d72afb34065, __nf_conntrack_confirm() set
>> 'ct->status |= IPS_CONFIRMED;' before check hash, the warning will not
>> happen, so I put it here.
> Oh, right, the problem was concealed before this.
>
>>> There is a second bug here, confirm can return NF_DROP and
>>> nfct will be NULL.
>> Thanks for your suggestion!
>>
>> Do you mean that ct may be deleted in confirm and return NF_DROP, so we can
>> not visit it in br_nf_local_in() and need to add 'case NF_DROP:' here?
>>
>> I cannot find somewhere set skb->_nfct to NULL and return NF_DROP. Can you
>> give some hints?
> You are right, skb->_nfct isn't set to NULL in case NF_DROP is returned.
> However, the warning will trigger as we did not insert the conntrack
> entry in that case.
>
> I suggest to remove the warning, I don't think it buys anything.
>
> Thanks.


Yes, remove the warning is a good a choice. I will remove the two lines in
v2 patch later, please check it.

------
Best regards
Wang Liang