lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 4 Jul 2022 16:45:10 +0200 From: Greg KH <greg@...ah.com> To: Jakub Kicinski <kuba@...nel.org> Cc: stable@...r.kernel.org, edumazet@...gle.com, netdev@...r.kernel.org, Ilya Maximets <i.maximets@....org>, Florian Westphal <fw@...len.de>, Pablo Neira Ayuso <pablo@...filter.org>, Steffen Klassert <steffen.klassert@...unet.com> Subject: Re: [PATCH stable 5.15] tcp: add a missing nf_reset_ct() in 3WHS handling On Thu, Jun 30, 2022 at 06:41:01PM -0700, Jakub Kicinski wrote: > From: Eric Dumazet <edumazet@...gle.com> > > commit 6f0012e35160cd08a53e46e3b3bbf724b92dfe68 upstream. > > When the third packet of 3WHS connection establishment > contains payload, it is added into socket receive queue > without the XFRM check and the drop of connection tracking > context. > > This means that if the data is left unread in the socket > receive queue, conntrack module can not be unloaded. > > As most applications usually reads the incoming data > immediately after accept(), bug has been hiding for > quite a long time. > > Commit 68822bdf76f1 ("net: generalize skb freeing > deferral to per-cpu lists") exposed this bug because > even if the application reads this data, the skb > with nfct state could stay in a per-cpu cache for > an arbitrary time, if said cpu no longer process RX softirqs. > > Many thanks to Ilya Maximets for reporting this issue, > and for testing various patches: > https://lore.kernel.org/netdev/20220619003919.394622-1-i.maximets@ovn.org/ > > Note that I also added a missing xfrm4_policy_check() call, > although this is probably not a big issue, as the SYN > packet should have been dropped earlier. > > Fixes: b59c270104f0 ("[NETFILTER]: Keep conntrack reference until IPsec policy checks are done") > Reported-by: Ilya Maximets <i.maximets@....org> > Signed-off-by: Eric Dumazet <edumazet@...gle.com> > Cc: Florian Westphal <fw@...len.de> > Cc: Pablo Neira Ayuso <pablo@...filter.org> > Cc: Steffen Klassert <steffen.klassert@...unet.com> > Tested-by: Ilya Maximets <i.maximets@....org> > Reviewed-by: Ilya Maximets <i.maximets@....org> > Link: https://lore.kernel.org/r/20220623050436.1290307-1-edumazet@google.com > Signed-off-by: Jakub Kicinski <kuba@...nel.org> > --- > net/ipv4/tcp_ipv4.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Now queued up, thanks. greg k-h
Powered by blists - more mailing lists