netdev - Re: [ovs-dev] [PATCH] openvswitch: Ensure nf_ct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YmaJlOS1YtPaq0EC@kroah.com>
Date:   Mon, 25 Apr 2022 13:44:20 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Ilya Maximets <i.maximets@....org>
Cc:     Florian Westphal <fw@...len.de>,
        Mark Mielke <mark.mielke@...il.com>, dev@...nvswitch.org,
        netdev@...r.kernel.org, stable@...r.kernel.org,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        "David S. Miller" <davem@...emloft.net>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Antti Antinoja <antti@...nosys.fi>
Subject: Re: [ovs-dev] [PATCH] openvswitch: Ensure nf_ct_put is not called
 with null pointer

On Mon, Apr 25, 2022 at 12:36:54PM +0200, Ilya Maximets wrote:
> On 4/10/22 17:41, Florian Westphal wrote:
> > Mark Mielke <mark.mielke@...il.com> wrote:
> >> A recent commit replaced calls to nf_conntrack_put() with calls
> >> to nf_ct_put(). nf_conntrack_put() permitted the caller to pass
> >> null without side effects, while nf_ct_put() performs WARN_ON()
> >> and proceeds to try and de-reference the pointer. ovs-vswitchd
> >> triggers the warning on startup:
> >>
> >> [   22.178881] WARNING: CPU: 69 PID: 2157 at include/net/netfilter/nf_conntrack.h:176 __ovs_ct_lookup+0x4e2/0x6a0 [openvswitch]
> >> ...
> >> [   22.213573] Call Trace:
> >> [   22.214318]  <TASK>
> >> [   22.215064]  ovs_ct_execute+0x49c/0x7f0 [openvswitch]
> >> ...
> >> Cc: stable@...r.kernel.org
> >> Fixes: 408bdcfce8df ("net: prefer nf_ct_put instead of nf_conntrack_put")
> > 
> > Actually, no.  As Pablo Neira just pointed out to me Upstream kernel is fine.
> > The preceeding commit made nf_ct_out() a noop when ct is NULL.
> 
> Hi, Florian.
> 
> There is a problem on 5.15 longterm tree where the offending commit
> got backported, but the previous one was not, so it triggers an issue
> while loading the openvswitch module.
> 
> To be more clear, v5.15.35 contains the following commit:
>   408bdcfce8df ("net: prefer nf_ct_put instead of nf_conntrack_put")
> backported as commit 72dd9e61fa319bc44020c2d365275fc8f6799bff, but
> it doesn't have the previous one:
>   6ae7989c9af0 ("netfilter: conntrack: avoid useless indirection during conntrack destruction")
> that adds the NULL pointer check to the nf_ct_put().
> 
> Either 6ae7989c9af0 should be backported to 5.15 or 72dd9e61fa31
> reverted on that tree.

I've backported the needed commit now, thanks.

greg k-h