diff options
author | Florian Westphal <fw@strlen.de> | 2022-03-01 00:46:19 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2022-03-01 11:51:15 +0100 |
commit | 3b836da4081fa585cf6c392f62557496f2cb0efe (patch) | |
tree | f2dcb351b8b08fd020d00958cb10ac9c50c91804 /net/netfilter/nf_flow_table_offload.c | |
parent | c3873070247d9e3c7a6b0cf9bf9b45e8018427b1 (diff) | |
download | linux-3b836da4081fa585cf6c392f62557496f2cb0efe.tar.bz2 |
netfilter: nf_queue: handle socket prefetch
In case someone combines bpf socket assign and nf_queue, then we will
queue an skb who references a struct sock that did not have its
reference count incremented.
As we leave rcu protection, there is no guarantee that skb->sk is still
valid.
For refcount-less skb->sk case, try to increment the reference count
and then override the destructor.
In case of failure we have two choices: orphan the skb and 'delete'
preselect or let nf_queue() drop the packet.
Do the latter, it should not happen during normal operation.
Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Acked-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter/nf_flow_table_offload.c')
0 files changed, 0 insertions, 0 deletions