Re: net: suspicious RCU usage in nf_hook
From: Eric Dumazet
Date: Fri Jan 27 2017 - 20:32:09 EST
On Fri, 2017-01-27 at 17:00 -0800, Cong Wang wrote:
> On Fri, Jan 27, 2017 at 3:35 PM, Eric Dumazet <eric.dumazet@xxxxxxxxx> wrote:
> > Oh well, I forgot to submit the official patch I think, Jan 9th.
> > https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ
> Hmm, but why only fragments need skb_orphan()? It seems like
> any kfree_skb() inside a nf hook needs to have a preceding
> Also, I am not convinced it is similar to commit 8282f27449bf15548
> which is on RX path.
Well, we clearly see IPv6 reassembly being part of the equation in both
I was replying to first part of the splat , which was already
diagnosed and had a non official patch.
use after free is also a bug, regardless of jump label being used or
I still do not really understand this nf_hook issue, I thought we were
disabling BH in netfilter.
So the in_interrupt() check in net_disable_timestamp() should trigger,
this was the intent of netstamp_needed_deferred existence.
Not sure if we can test for rcu_read_lock() as well.
inet_frag_put include/net/inet_frag.h:133 [inline]
nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
nf_hook include/linux/netfilter.h:212 [inline]