netdev - Re: [PATCH net-next v2 0/2] net: flow dissector: allow explicit passing of netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 27 Jun 2024 01:49:31 +0200
From: Pablo Neira Ayuso <pablo@...filter.org>
To: Florian Westphal <fw@...len.de>
Cc: netdev@...r.kernel.org, Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, willemb@...gle.com
Subject: Re: [PATCH net-next v2 0/2] net: flow dissector: allow explicit
 passing of netns

Hi,

This series got applied to net-next.

But I can trigger this splat via nftables/tests/shell in net.git (6.10-rc).

As well as in -stable 6.1.x:

Jun 26 02:19:26 curiosity kernel: [ 1211.840595] ------------[ cut here ]------------
Jun 26 02:19:26 curiosity kernel: [ 1211.840605] WARNING: CPU: 0 PID: 70274 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0x107e/0x2860
[...]
Jun 26 02:19:26 curiosity kernel: [ 1211.841240] CPU: 0 PID: 70274 Comm: socat Not tainted 6.1.93+ #18

I think that turning this into DEBUG_NET_WARN_ON_ONCE as Willem
suggested provides a workaround for net.git until Florian's fixes in
net-next hit -stable.

Would you accept such a patch?

Thanks.

On Sun, Jun 09, 2024 at 12:10:38AM +0200, Florian Westphal wrote:
> Change since last version:
>  fix kdoc comment warning reported by kbuild robot, no other changes,
>  thus retaining RvB tags from Eric and Willem.
>  v1: https://lore.kernel.org/netdev/20240607083205.3000-1-fw@strlen.de/
> 
> Years ago flow dissector gained ability to delegate flow dissection
> to a bpf program, scoped per netns.
> 
> The netns is derived from skb->dev, and if that is not available, from
> skb->sk.  If neither is set, we hit a (benign) WARN_ON_ONCE().
> 
> This WARN_ON_ONCE can be triggered from netfilter.
> Known skb origins are nf_send_reset and ipv4 stack generated IGMP
> messages.
> 
> Lets allow callers to pass the current netns explicitly and make
> nf_tables use those instead.
> 
> This targets net-next instead of net because the WARN is benign and this
> is not a regression.
> 
> Florian Westphal (2):
>   net: add and use skb_get_hash_net
>   net: add and use __skb_get_hash_symmetric_net
> 
>  include/linux/skbuff.h          | 20 +++++++++++++++++---
>  net/core/flow_dissector.c       | 21 ++++++++++++++-------
>  net/netfilter/nf_tables_trace.c |  2 +-
>  net/netfilter/nft_hash.c        |  3 ++-
>  4 files changed, 34 insertions(+), 12 deletions(-)
> 
> -- 
> 2.44.2
>