netdev - Re: Oops in nf_nat_core.c:find_appropriate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0806071742180.13503@bizon.gios.gov.pl>
Date:	Sat, 7 Jun 2008 17:45:08 +0200 (CEST)
From:	Krzysztof Oledzki <ole@....pl>
To:	Patrick McHardy <kaber@...sh.net>
cc:	Chuck Ebbert <cebbert@...hat.com>, Netdev <netdev@...r.kernel.org>,
	Netfilter Development Mailinglist 
	<netfilter-devel@...r.kernel.org>
Subject: Re: Oops in nf_nat_core.c:find_appropriate_src(), kernel 2.6.25.4



On Sat, 7 Jun 2008, Patrick McHardy wrote:

> Patrick McHardy wrote:
>> Chuck Ebbert wrote:
>>> Reported at https://bugzilla.redhat.com/show_bug.cgi?id=449315
>>> 
>>> In find_appropriate_src():
>>>
>>>         hlist_for_each_entry_rcu(nat, n, &bysource[h], bysource) {
>>>                 ct = nat->ct;
>>>                 if (same_src(ct, tuple)) {
>>> 
>>> Dereference of ct in same_src() causes the oops. This only seems to
>>> happen on heavily loaded firewall machines. Kernel 2.6.24.7 works.
>>> 
>>> The reporter identifies commit 4d354c5782dc352cec187845d17eedc2c2bfcf67
>>> ("[NETFILTER]: nf_nat: use RCU for bysource hash") as a possible cause
>>> of the problem.
>> 
>> We have a similar looking report, but that one also affects 2.6.24:
>> 
>> http://bugzilla.kernel.org/show_bug.cgi?id=10875
>> 
>> Anyways, does this patch help? When reallocating storage
>> for a conntrack, it is replaced in the list before assigning
>> the nat->ct pointer.
>
>
> I'm afraid we also need this one on top - when reallocating
> an extension, we must not free the old storage since it may
> still be used in a RCU read side.

It does not help here: 2.6.26-rc5 plus two above patches still crashes.

Best regards,

 				Krzysztof Olędzki