| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1419640765-7707-1-git-send-email-asbjorn@asbjorn.biz>
Date: Sat, 27 Dec 2014 00:39:25 +0000
From: Asbjoern Sloth Toennesen <asbjorn@...jorn.biz>
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: "David S. Miller" <davem@...emloft.net>,
netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: [PATCH v2] nftables: nft_flush_table: handle chain dependencies
Update: I errously assumed that git add, while writing the commit
message, would be added to the commit.
Based on net-next f96fe225. Compiles and checkpatch clean.
Jumping between chains doesn't mix well with flush ruleset,
since nft_flush_table doesn't handle chains referencing chains.
This way it will take one to two loops, to settle.
Alternatively it can be solved by always having two loops,
[ 353.373791] ------------[ cut here ]------------
[ 353.373845] kernel BUG at net/netfilter/nf_tables_api.c:1159!
[ 353.373896] invalid opcode: 0000 [#1] SMP
[ 353.373942] Modules linked in: intel_powerclamp uas iwldvm iwlwifi
[ 353.374017] CPU: 0 PID: 6445 Comm: 31c3.nft Not tainted 3.18.0 #98
[ 353.374069] Hardware name: LENOVO 5129CTO/5129CTO, BIOS 6QET47WW
(1.17 ) 07/14/2010
[ 353.374132] task: ffff880230976300 ti: ffff8800a8444000 task.ti:
ffff8800a8444000
[ 353.374192] RIP: 0010:[<ffffffff8195fef8>] [<ffffffff8195fef8>]
nf_tables_chain_destroy+0x58/0x60
[ 353.374275] RSP: 0018:ffff8800a8447a90 EFLAGS: 00010202
[ 353.374320] RAX: 0000000000000001 RBX: ffff880231d92c00 RCX:
00000001802a0027
[ 353.374379] RDX: 00000001802a0028 RSI: ffffea0008c537c0 RDI:
ffff8802314df4e0
[ 353.374437] RBP: ffff8800a8447ad8 R08: 00000000314df201 R09:
00000001802a0027
[ 353.374494] R10: ffffffff81964a32 R11: ffff8802314df2a0 R12:
ffffffff820c50a8
[ 353.374552] R13: ffffffff820c46c0 R14: ffff8800ad706700 R15:
ffff8802314dfcc0
[ 353.374611] FS: 00007f96eacb6700(0000) GS:ffff88023bc00000(0000)
knlGS:0000000000000000
[ 353.374676] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 353.374723] CR2: 00007f96eacc7002 CR3: 00000000a8418000 CR4:
00000000000007f0
[ 353.374781] Stack:
[ 353.374800] ffffffff81964c31 0000000000000000 ffffc90024fecb30
ffffc90024fecb3c
[ 353.374872] ffffc90024fecb7c ffff8800ad706700 0000000000000001
0000000000000000
[ 353.374944] ffff8800ad706300 ffff8800a8447b68 ffffffff81949118
0000000000000000
[ 353.375018] Call Trace:
[ 353.375046] [<ffffffff81964c31>] ? nf_tables_commit+0x381/0x540
[ 353.375101] [<ffffffff81949118>] nfnetlink_rcv+0x3d8/0x4b0
[ 353.375150] [<ffffffff81943fc5>] netlink_unicast+0x105/0x1a0
[ 353.375200] [<ffffffff8194438e>] netlink_sendmsg+0x32e/0x790
[ 353.375253] [<ffffffff818f398e>] sock_sendmsg+0x8e/0xc0
[ 353.375300] [<ffffffff818f36b9>] ?
move_addr_to_kernel.part.20+0x19/0x70
[ 353.375357] [<ffffffff818f44f9>] ? move_addr_to_kernel+0x19/0x30
[ 353.375410] [<ffffffff819016d2>] ? verify_iovec+0x42/0xd0
[ 353.375459] [<ffffffff818f3e10>] ___sys_sendmsg+0x3f0/0x400
[ 353.375510] [<ffffffff810615fa>] ? native_sched_clock+0x2a/0x90
[ 353.375563] [<ffffffff81176697>] ? acct_account_cputime+0x17/0x20
[ 353.375616] [<ffffffff8110dc78>] ? account_user_time+0x88/0xa0
[ 353.375667] [<ffffffff818f4bbd>] __sys_sendmsg+0x3d/0x80
[ 353.375719] [<ffffffff81b184f4>] ?
int_check_syscall_exit_work+0x34/0x3d
[ 353.375776] [<ffffffff818f4c0d>] SyS_sendmsg+0xd/0x20
[ 353.375823] [<ffffffff81b1826d>] system_call_fastpath+0x16/0x1b
[ 353.375872] Code: 8b 78 10 e8 cb cd 7e ff 48 8b 7b f8 e8 f2 98 86 ff
48 8d bb 78 ff ff ff e8 56 b8 89 ff 48 83 c4 08 5b 5d c3 0f 1f 80 00 00
00 00 <0f> 0b 66 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53
[ 353.376307] RIP [<ffffffff8195fef8>]
nf_tables_chain_destroy+0x58/0x60
[ 353.376368] RSP <ffff8800a8447a90>
[ 353.388988] ---[ end trace e51c442af1fdea42 ]---
Cc: stable@...r.kernel.org
Signed-off-by: Asbjoern Sloth Toennesen <asbjorn@...jorn.biz>
---
net/netfilter/nf_tables_api.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 129a8da..761519b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -712,7 +712,11 @@ static int nft_flush_table(struct nft_ctx *ctx)
int err;
struct nft_chain *chain, *nc;
struct nft_set *set, *ns;
+ int skipped_chains, flushed_chains;
+flush_chains:
+ skipped_chains = 0;
+ flushed_chains = 0;
list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
ctx->chain = chain;
@@ -720,9 +724,20 @@ static int nft_flush_table(struct nft_ctx *ctx)
if (err < 0)
goto out;
+ if (chain->use > 0) {
+ skipped_chains++;
+ continue;
+ }
+
err = nft_delchain(ctx);
if (err < 0)
goto out;
+
+ flushed_chains++;
+ }
+ if (skipped_chains > 0) {
+ BUG_ON(flushed_chains == 0);
+ goto flush_chains;
}
list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
--
2.1.4
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists