Files
linux/include/net
Tzung-Bi Shih 73db1b8f2b netfilter: conntrack: fix wrong ct->timeout value
(struct nf_conn)->timeout is an interval before the conntrack
confirmed.  After confirmed, it becomes a timestamp.

It is observed that timeout of an unconfirmed conntrack:
- Set by calling ctnetlink_change_timeout(). As a result,
  `nfct_time_stamp` was wrongly added to `ct->timeout` twice.
- Get by calling ctnetlink_dump_timeout(). As a result,
  `nfct_time_stamp` was wrongly subtracted.

Call Trace:
 <TASK>
 dump_stack_lvl
 ctnetlink_dump_timeout
 __ctnetlink_glue_build
 ctnetlink_glue_build
 __nfqnl_enqueue_packet
 nf_queue
 nf_hook_slow
 ip_mc_output
 ? __pfx_ip_finish_output
 ip_send_skb
 ? __pfx_dst_output
 udp_send_skb
 udp_sendmsg
 ? __pfx_ip_generic_getfrag
 sock_sendmsg

Separate the 2 cases in:
- Setting `ct->timeout` in __nf_ct_set_timeout().
- Getting `ct->timeout` in ctnetlink_dump_timeout().

Pablo appends:

Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is
set on, otherwise conntrack creation via ctnetlink breaks.

Note that the problem described in this patch occurs since the
introduction of the nfnetlink_queue conntrack support, select a
sufficiently old Fixes: tag for -stable kernel to pick up this fix.

Fixes: a4b4766c3c ("netfilter: nfnetlink_queue: rename related to nfqueue attaching conntrack info")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2023-04-19 12:08:38 +02:00
..
2022-12-06 07:30:55 +09:00
2021-07-01 13:19:48 -07:00
2022-06-22 12:59:43 +01:00
2022-08-23 10:43:11 +02:00
2022-07-28 22:06:15 -07:00
2022-08-09 22:14:02 -07:00
2021-12-16 07:18:35 -08:00
2021-10-15 11:33:08 +01:00
2023-02-02 14:02:01 +01:00
2021-10-13 09:40:46 -07:00
2021-07-27 13:05:56 +01:00
2022-05-11 12:43:10 +01:00
2020-03-04 13:25:55 -08:00
2023-04-04 18:56:58 -07:00
2022-06-19 10:00:02 +01:00
2019-10-05 16:29:00 -07:00
2021-08-03 13:05:26 +01:00
2023-02-16 09:27:07 +01:00
2022-12-12 15:04:39 -08:00
2019-12-09 10:28:43 -08:00