Skip to contentSkip to conversation

Patch "ipvs: skb_orphan in case of forwarding" has been added to the 4.1-stable tree

PATCH [email protected] 1 participant 1 message Oct 17, 2015

Subsystems (4)
Networking Stable branch netfilter IPVS
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ipvs: skb_orphan in case of forwarding

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipvs-skb_orphan-in-case-of-forwarding.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 71563f3414e917c62acd8e0fb0edf8ed6af63e4b Mon Sep 17 00:00:00 2001

From: Alex Gartrell <[email protected]>
Date: Sun, 5 Jul 2015 14:28:26 -0700
Subject: ipvs: skb_orphan in case of forwarding

From: Alex Gartrell <[email protected]>

commit 71563f3414e917c62acd8e0fb0edf8ed6af63e4b upstream.

It is possible that we bind against a local socket in early_demux when we are actually going to want to forward it. In this case, the socket serves no purpose and only serves to confuse things (particularly functions which implicitly expect sk_fullsock to be true, like ip_local_out). Additionally, skb_set_owner_w is totally broken for non full-socks.

Signed-off-by Alex Gartrell <[email protected]>
Fixes 41063e9dd119 ("ipv4: Early TCP socket demux.")
Acked-by Julian Anastasov <[email protected]>
Signed-off-by Simon Horman <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/netfilter/ipvs/ip_vs_xmit.c |   27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
net/netfilter/ipvs/ip_vs_xmit.c +27 -0
@@ -522,6 +522,21 @@ static inline int ip_vs_tunnel_xmit_prep
 	return ret;
 }
 
+/* In the event of a remote destination, it's possible that we would have
+ * matches against an old socket (particularly a TIME-WAIT socket). This
+ * causes havoc down the line (ip_local_out et. al. expect regular sockets
+ * and invalid memory accesses will happen) so simply drop the association
+ * in this case.
+*/
+static inline void ip_vs_drop_early_demux_sk(struct sk_buff *skb)
+{
+	/* If dev is set, the packet came from the LOCAL_IN callback and
+	 * not from a local TCP socket.
+	 */
+	if (skb->dev)
+		skb_orphan(skb);
+}
+
 /* return NF_STOLEN (sent) or NF_ACCEPT if local=1 (not sent) */
 static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
 					 struct ip_vs_conn *cp, int local)

@@ -533,12 +548,21 @@ static inline int ip_vs_nat_send_or_cont
 		ip_vs_notrack(skb);
 	else
 		ip_vs_update_conntrack(skb, cp, 1);
+
+	/* Remove the early_demux association unless it's bound for the
+	 * exact same port and address on this host after translation.
+	 */
+	if (!local || cp->vport != cp->dport ||
+	    !ip_vs_addr_equal(cp->af, &cp->vaddr, &cp->daddr))
+		ip_vs_drop_early_demux_sk(skb);
+
 	if (!local) {
 		skb_forward_csum(skb);
 		NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
 			NULL, skb_dst(skb)->dev, dst_output_sk);
 	} else
 		ret = NF_ACCEPT;
+
 	return ret;
 }
 

@@ -552,6 +576,7 @@ static inline int ip_vs_send_or_cont(int
 	if (likely(!(cp->flags & IP_VS_CONN_F_NFCT)))
 		ip_vs_notrack(skb);
 	if (!local) {
+		ip_vs_drop_early_demux_sk(skb);
 		skb_forward_csum(skb);
 		NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
 			NULL, skb_dst(skb)->dev, dst_output_sk);

@@ -840,6 +865,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buf
 	struct ipv6hdr *old_ipv6h = NULL;
 #endif
 
+	ip_vs_drop_early_demux_sk(skb);
+
 	if (skb_headroom(skb) < max_headroom || skb_cloned(skb)) {
 		new_skb = skb_realloc_headroom(skb, max_headroom);
 		if (!new_skb)

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/ipvs-skb_orphan-in-case-of-forwarding.patch