mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 08:15:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()

Browse Source 
Trigger a warning if nf_ct_set() overlaps an existing ct object leading
to refcount leak. Add this warning to skb_set_nfct() whose only user is
nf_ct_set() instead.

Update existing nf_ct_set() callers to use nf_reset_ct() first to clean
up stale pointer to conntrack object which migh trigger false positive
warnings.

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2026-08-05 23:16:34 +02:00
parent 001b5d347d
commit 5546b082fa
5 changed files with 9 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/skbuff.h
View File

@@ -5004,6 +5004,7 @@ static inline unsigned long skb_get_nfct(const struct sk_buff *skb)
static inline void skb_set_nfct(struct sk_buff *skb, unsigned long nfct)
{
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
DEBUG_NET_WARN_ON_ONCE(skb->_nfct & NFCT_PTRMASK);
skb->slow_gro |= !!nfct;
skb->_nfct = nfct;
#endif

2
include/net/ip_vs.h
View File

@@ -2121,7 +2121,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb)
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
if (ct) {
nf_conntrack_put(&ct->ct_general);
nf_reset_ct(skb);
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
}
#endif

2
net/netfilter/nf_conntrack_core.c
View File

@@ -1031,7 +1031,7 @@ static int __nf_ct_resolve_clash(struct sk_buff *skb,
nf_conntrack_get(&ct->ct_general);
nf_ct_acct_merge(ct, ctinfo, loser_ct);
nf_ct_put(loser_ct);
nf_reset_ct(skb);
nf_ct_set(skb, ct, ctinfo);
NF_CT_STAT_INC(net, clash_resolve);

12
net/openvswitch/conntrack.c
View File

@@ -603,7 +603,7 @@ static bool skb_nfct_cached(struct net *net,
if (nf_ct_is_confirmed(ct))
nf_ct_delete(ct, 0, 0);
nf_ct_put(ct);
nf_reset_ct(skb);
nf_ct_set(skb, NULL, 0);
return false;
}
@@ -745,8 +745,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
/* Associate skb with specified zone. */
if (tmpl) {
ct = nf_ct_get(skb, &ctinfo);
nf_ct_put(ct);
nf_reset_ct(skb);
nf_conntrack_get(&tmpl->ct_general);
nf_ct_set(skb, tmpl, IP_CT_NEW);
}
@@ -1075,12 +1074,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
{
enum ip_conntrack_info ctinfo;
struct nf_conn *ct;
ct = nf_ct_get(skb, &ctinfo);
nf_ct_put(ct);
nf_reset_ct(skb);
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
if (key)

6
net/sched/act_ct.c
View File

@@ -782,7 +782,7 @@ static bool tcf_ct_skb_nfct_cached(struct net *net, struct sk_buff *skb,
return true;
drop_ct:
nf_ct_put(ct);
nf_reset_ct(skb);
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
return false;
@@ -996,7 +996,7 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
qdisc_skb_cb(skb)->post_ct = false;
ct = nf_ct_get(skb, &ctinfo);
if (ct) {
nf_ct_put(ct);
nf_reset_ct(skb);
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
}
@@ -1034,7 +1034,7 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
/* Associate skb with specified zone. */
if (tmpl) {
nf_conntrack_put(skb_nfct(skb));
nf_reset_ct(skb);
nf_conntrack_get(&tmpl->ct_general);
nf_ct_set(skb, tmpl, IP_CT_NEW);
}