Pablo Neira Ayuso 7b1d83da25 netfilter: nft_inner: incorrect percpu area handling under softirq ... Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets. Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff: 1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register. 2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again. 3) Finally, validate if the percpu area refers to this tunnel type. Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again. After inner header fetching, the on-stack copy is stored back to the percpu area. Fixes: 3a07327d10 ("netfilter: nft_inner: support for inner tunnel header matching") Reported-by: syzbot+84d0441b9860f0d63285@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2024-12-03 22:10:58 +01:00
..
ipv4	netfilter: disable defrag once its no longer needed	2021-04-26 03:20:07 +02:00
ipv6	netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1	2021-09-28 13:04:55 +02:00
br_netfilter.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_bpf_link.h	bpf: minimal support for programs hooked into netfilter framework	2023-04-21 11:34:14 -07:00
nf_conntrack_acct.h	netfilter: conntrack: Remove unused function declarations	2023-08-08 13:02:00 +02:00
nf_conntrack_act_ct.h	net/sched: act_ct: Always fill offloading tuple iifidx	2023-11-08 17:47:08 -08:00
nf_conntrack_bpf.h	net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c	2022-10-03 09:17:32 -07:00
nf_conntrack_bridge.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_conntrack_core.h	netfilter: conntrack: fix wrong ct->timeout value	2023-04-19 12:08:38 +02:00
nf_conntrack_count.h	netfilter: move nf_ct_netns_get out of nf_conncount_init	2024-08-19 18:44:51 +02:00
nf_conntrack_ecache.h	netfilter: prefer extension check to pointer check	2022-05-13 18:56:28 +02:00
nf_conntrack_expect.h	netfilter: allow exp not to be removed in nf_ct_find_expectation	2023-07-20 10:06:36 +02:00
nf_conntrack_extend.h	netfilter: extensions: introduce extension genid count	2022-05-13 18:52:16 +02:00
nf_conntrack_helper.h	netfilter: helper: Remove unused function declarations	2023-08-08 13:01:59 +02:00
nf_conntrack_l4proto.h	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_labels.h	netfilter: conntrack: switch connlabels to atomic_t	2023-10-24 13:16:30 +02:00
nf_conntrack_seqadj.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_synproxy.h	netfilter: conntrack: wrap two inline functions in config checks.	2019-09-13 12:47:10 +02:00
nf_conntrack_timeout.h	netfilter: nf_conntrack: add missing __rcu annotations	2022-07-11 16:25:15 +02:00
nf_conntrack_timestamp.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_tuple.h	netfilter: conntrack: don't fold port numbers into addresses before hashing	2023-07-05 14:42:16 +02:00
nf_conntrack_zones.h	netfilter: conntrack: remove CONFIG_NF_CONNTRACK checks from nf_conntrack_zones.h.	2019-09-13 12:47:41 +02:00
nf_conntrack.h	netfilter: conntrack: simplify nf_conntrack_alter_reply	2023-10-10 16:34:28 +02:00
nf_dup_netdev.h	netfilter: nft_{fwd,dup}_netdev: add offload support	2019-09-10 22:44:29 +02:00
nf_flow_table.h	netfilter: Add bpf_xdp_flow_lookup kfunc	2024-07-01 17:03:01 +02:00
nf_hooks_lwtunnel.h	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
nf_log.h	netfilter: nf_log_common: merge with nf_log_syslog	2021-03-31 22:34:10 +02:00
nf_nat_helper.h	netfilter: nat: move repetitive nat port reserve loop to a helper	2022-09-07 16:46:04 +02:00
nf_nat_masquerade.h	netfilter: update include directives.	2019-09-13 12:33:06 +02:00
nf_nat_redirect.h	netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs	2023-03-22 21:48:59 +01:00
nf_nat.h	net: move the nat function to nf_nat_ovs for ovs and tc	2022-12-12 10:14:03 +00:00
nf_queue.h	netfilter: move nf_reinject into nfnetlink_queue modules	2024-02-21 12:03:22 +01:00
nf_reject.h	netfilter: conntrack: skip verification of zero UDP checksum	2022-05-13 18:56:28 +02:00
nf_socket.h	netfilter: Decrease code duplication regarding transparent socket option	2018-06-03 00:02:01 +02:00
nf_synproxy.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_tables_core.h	netfilter: nft_inner: incorrect percpu area handling under softirq	2024-12-03 22:10:58 +01:00
nf_tables_ipv4.h	netfilter: nf_tables: restore IP sanity checks for netdev/egress	2024-08-26 13:05:28 +02:00
nf_tables_ipv6.h	netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation	2024-08-27 18:11:56 +02:00
nf_tables_offload.h	netfilter: nf_tables: bail out early if hardware offload is not supported	2022-06-06 19:19:15 +02:00
nf_tables.h	netfilter: nf_tables: allocate element update information dynamically	2024-11-14 13:05:49 +01:00
nf_tproxy.h	netfilter: nf_tables: Add missing Kernel doc	2024-09-03 10:47:17 +02:00
nft_fib.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_meta.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_reject.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
xt_rateest.h	net: sched: Merge Qdisc::bstats and Qdisc::cpu_bstats data types	2021-10-18 12:54:41 +01:00