[v5.15] KASAN: use-after-free Read in __nft_trace_packet

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3a5928702e71 Linux 5.15.167
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10e10407980000
kernel config: https://syzkaller.appspot.com/x/.config?x=4d3fd5cca89ae935
dashboard link: https://syzkaller.appspot.com/bug?extid=2a8850ea36efb12f5aed
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ef5025f3d708/disk-3a592870.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/776fbdad3aa8/vmlinux-3a592870.xz
kernel image: https://storage.googleapis.com/syzbot-assets/79541db5bd16/bzImage-3a592870.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2a8850...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __nft_trace_packet+0x137/0x150 net/netfilter/nf_tables_core.c:30
Read of size 2 at addr ffff88805a0c7300 by task ksoftirqd/0/14

CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.15.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
print_address_description+0x63/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
__nft_trace_packet+0x137/0x150 net/netfilter/nf_tables_core.c:30
nft_trace_verdict net/netfilter/nf_tables_core.c:110 [inline]
nft_do_chain+0x1453/0x16b0 net/netfilter/nf_tables_core.c:256
nft_do_chain_inet+0x3f8/0x680 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xae/0x1e0 net/netfilter/core.c:584
nf_hook include/linux/netfilter.h:257 [inline]
NF_HOOK+0x26b/0x410 include/linux/netfilter.h:300
NF_HOOK+0x364/0x410 include/linux/netfilter.h:302
__netif_receive_skb_one_core net/core/dev.c:5485 [inline]
__netif_receive_skb+0x1c6/0x530 net/core/dev.c:5599
process_backlog+0x363/0x7f0 net/core/dev.c:6476
__napi_poll+0xc7/0x440 net/core/dev.c:7035
napi_poll net/core/dev.c:7102 [inline]
net_rx_action+0x617/0xda0 net/core/dev.c:7192
handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
run_ksoftirqd+0xc6/0x120 kernel/softirq.c:925
smpboot_thread_fn+0x51b/0x9d0 kernel/smpboot.c:164
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>

Allocated by task 14:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x8e/0xc0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]
kmem_cache_alloc_node+0x121/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]
synproxy_send_client_synack+0x1b6/0xf20 net/netfilter/nf_synproxy_core.c:482
nft_synproxy_eval_v4+0x3c6/0x610 net/netfilter/nft_synproxy.c:59
nft_synproxy_do_eval+0x359/0xa60 net/netfilter/nft_synproxy.c:141
expr_call_ops_eval net/netfilter/nf_tables_core.c:198 [inline]
nft_do_chain+0x467/0x16b0 net/netfilter/nf_tables_core.c:238
nft_do_chain_inet+0x3f8/0x680 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xae/0x1e0 net/netfilter/core.c:584
nf_hook include/linux/netfilter.h:257 [inline]
NF_HOOK+0x26b/0x410 include/linux/netfilter.h:300
NF_HOOK+0x364/0x410 include/linux/netfilter.h:302
__netif_receive_skb_one_core net/core/dev.c:5485 [inline]
__netif_receive_skb+0x1c6/0x530 net/core/dev.c:5599
process_backlog+0x363/0x7f0 net/core/dev.c:6476
__napi_poll+0xc7/0x440 net/core/dev.c:7035
napi_poll net/core/dev.c:7102 [inline]
net_rx_action+0x617/0xda0 net/core/dev.c:7192
handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
run_ksoftirqd+0xc6/0x120 kernel/softirq.c:925
smpboot_thread_fn+0x51b/0x9d0 kernel/smpboot.c:164
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Freed by task 14:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0x91/0x1f0 mm/slub.c:3515
nft_synproxy_eval_v4+0x3ce/0x610 net/netfilter/nft_synproxy.c:60
nft_synproxy_do_eval+0x359/0xa60 net/netfilter/nft_synproxy.c:141
expr_call_ops_eval net/netfilter/nf_tables_core.c:198 [inline]
nft_do_chain+0x467/0x16b0 net/netfilter/nf_tables_core.c:238
nft_do_chain_inet+0x3f8/0x680 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xae/0x1e0 net/netfilter/core.c:584
nf_hook include/linux/netfilter.h:257 [inline]
NF_HOOK+0x26b/0x410 include/linux/netfilter.h:300
NF_HOOK+0x364/0x410 include/linux/netfilter.h:302
__netif_receive_skb_one_core net/core/dev.c:5485 [inline]
__netif_receive_skb+0x1c6/0x530 net/core/dev.c:5599
process_backlog+0x363/0x7f0 net/core/dev.c:6476
__napi_poll+0xc7/0x440 net/core/dev.c:7035
napi_poll net/core/dev.c:7102 [inline]
net_rx_action+0x617/0xda0 net/core/dev.c:7192
handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
run_ksoftirqd+0xc6/0x120 kernel/softirq.c:925
smpboot_thread_fn+0x51b/0x9d0 kernel/smpboot.c:164
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

The buggy address belongs to the object at ffff88805a0c7280
which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 128 bytes inside of
232-byte region [ffff88805a0c7280, ffff88805a0c7368)
The buggy address belongs to the page:
page:ffffea00016831c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5a0c7
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff88801bfe5140
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 14, ts 56126754586, free_ts 56117644853
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
__alloc_pages+0x272/0x700 mm/page_alloc.c:5423
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
kmem_cache_alloc_node+0x1ba/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]
synproxy_send_client_synack+0x1b6/0xf20 net/netfilter/nf_synproxy_core.c:482
nft_synproxy_eval_v4+0x3c6/0x610 net/netfilter/nft_synproxy.c:59
nft_synproxy_do_eval+0x359/0xa60 net/netfilter/nft_synproxy.c:141
expr_call_ops_eval net/netfilter/nf_tables_core.c:198 [inline]
nft_do_chain+0x467/0x16b0 net/netfilter/nf_tables_core.c:238
nft_do_chain_inet+0x3f8/0x680 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xae/0x1e0 net/netfilter/core.c:584
nf_hook include/linux/netfilter.h:257 [inline]
NF_HOOK+0x26b/0x410 include/linux/netfilter.h:300
NF_HOOK+0x364/0x410 include/linux/netfilter.h:302
__netif_receive_skb_one_core net/core/dev.c:5485 [inline]
__netif_receive_skb+0x1c6/0x530 net/core/dev.c:5599
process_backlog+0x363/0x7f0 net/core/dev.c:6476
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
free_unref_page_list+0x1f7/0x8e0 mm/page_alloc.c:3433
release_pages+0x1bb9/0x1f40 mm/swap.c:963
__pagevec_release+0x80/0xf0 mm/swap.c:983
pagevec_release include/linux/pagevec.h:81 [inline]
__invalidate_mapping_pages+0x68f/0x7c0 mm/truncate.c:509
btrfs_close_bdev fs/btrfs/volumes.c:1150 [inline]
btrfs_close_one_device fs/btrfs/volumes.c:1174 [inline]
close_fs_devices+0x41e/0x8e0 fs/btrfs/volumes.c:1217
btrfs_close_devices+0xc4/0x5c0 fs/btrfs/volumes.c:1232
close_ctree+0x731/0x890 fs/btrfs/disk-io.c:4518
generic_shutdown_super+0x136/0x2c0 fs/super.c:475
kill_anon_super+0x37/0x60 fs/super.c:1087
btrfs_kill_super+0x3d/0x50 fs/btrfs/super.c:2391
deactivate_locked_super+0xa0/0x110 fs/super.c:335
cleanup_mnt+0x44e/0x500 fs/namespace.c:1143
task_work_run+0x129/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214

Memory state around the buggy address:
ffff88805a0c7200: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff88805a0c7280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88805a0c7300: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
^
ffff88805a0c7380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff88805a0c7400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 3a5928702e71 Linux 5.15.167
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=12f48c80580000

kernel config: https://syzkaller.appspot.com/x/.config?x=4d3fd5cca89ae935
dashboard link: https://syzkaller.appspot.com/bug?extid=2a8850ea36efb12f5aed
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145bca27980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13e292a9980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ef5025f3d708/disk-3a592870.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/776fbdad3aa8/vmlinux-3a592870.xz
kernel image: https://storage.googleapis.com/syzbot-assets/79541db5bd16/bzImage-3a592870.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2a8850...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __nft_trace_packet+0x137/0x150 net/netfilter/nf_tables_core.c:30

Read of size 2 at addr ffff88807d8811c0 by task ksoftirqd/1/20

CPU: 1 PID: 20 Comm: ksoftirqd/1 Not tainted 5.15.167-syzkaller #0

Allocated by task 20:

Freed by task 20:

The buggy address belongs to the object at ffff88807d881140

which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 128 bytes inside of

232-byte region [ffff88807d881140, ffff88807d881228)

The buggy address belongs to the page:

page:ffffea0001f62040 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d881

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888144bf2140

raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3038, ts 21560678733, free_ts 21546722862

prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
__alloc_pages+0x272/0x700 mm/page_alloc.c:5423
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
kmem_cache_alloc_node+0x1ba/0x2c0 mm/slub.c:3256
__alloc_skb+0xdd/0x590 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1167 [inline]

alloc_skb_with_frags+0xa3/0x780 net/core/skbuff.c:6170
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2530
unix_dgram_sendmsg+0x6fd/0x2090 net/unix/af_unix.c:1798
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
sock_write_iter+0x39b/0x530 net/socket.c:1079
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0xacd/0xe50 fs/read_write.c:594
ksys_write+0x1a2/0x2c0 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317

free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
do_slab_free mm/slub.c:3487 [inline]
___cache_free+0xe3/0x100 mm/slub.c:3506
qlist_free_all+0x36/0x90 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x162/0x180 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444

kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3220 [inline]

slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc+0xf3/0x280 mm/slub.c:3233
kmem_cache_zalloc include/linux/slab.h:711 [inline]
lsm_inode_alloc security/security.c:595 [inline]
security_inode_alloc+0x24/0x110 security/security.c:1033
inode_init_always+0x939/0xc70 fs/inode.c:207
alloc_inode fs/inode.c:243 [inline]
iget_locked+0x212/0x7f0 fs/inode.c:1279
kernfs_get_inode+0x4c/0x6b0 fs/kernfs/inode.c:250
kernfs_iop_lookup+0x1d7/0x2f0 fs/kernfs/dir.c:1143
__lookup_slow+0x275/0x3d0 fs/namei.c:1663
lookup_slow+0x53/0x70 fs/namei.c:1680
walk_component+0x48c/0x610 fs/namei.c:1976

Memory state around the buggy address:

ffff88807d881080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff88807d881100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88807d881180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807d881200: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff88807d881280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue could be fixed by backporting the following commit:

commit e34b9ed96ce3b06c79bf884009b16961ca478f87
git tree: upstream
Author: Florian Westphal <f...@strlen.de>
Date: Wed Jun 22 14:43:57 2022 +0000

netfilter: nf_tables: avoid skb access on nf_stolen

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16cdfccc580000

kernel config: https://syzkaller.appspot.com/x/.config?x=4d3fd5cca89ae935
dashboard link: https://syzkaller.appspot.com/bug?extid=2a8850ea36efb12f5aed

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145bca27980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13e292a9980000

Please keep in mind that other backports might be required as well.

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkaller...@googlegroups.com.

***

Subject: [PATCH 5.15.y] KASAN: use-after-free Read in __nft_trace_packet
Author: dri...@qq.com

Hi,

Please test this patch on stable 5.15.y.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 3330a8d33e086f76608bb4e80a3dc569d04a8814

Thanks,
Changjian Liu

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkaller...@googlegroups.com.

***

Subject: [PATCH] netfilter: nf_tables: avoid skb access on nf_stolen
Author: subasr...@gmail.com

From: Florian Westphal <f...@strlen.de>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git c86c4726e7f044ab73b493c6f00527aafef640cd

From: Florian Westphal <f...@strlen.de>

[ Upstream commit e34b9ed96ce3b06c79bf884009b16961ca478f87 ]

When verdict is NF_STOLEN, the skb might have been freed.

When tracing is enabled, this can result in a use-after-free:
1. access to skb->nf_trace
2. access to skb->mark
3. computation of trace id
4. dump of packet payload

To avoid 1, keep a cached copy of skb->nf_trace in the
trace state struct.
Refresh this copy whenever verdict is != STOLEN.

Avoid 2 by skipping skb->mark access if verdict is STOLEN.

3 is avoided by precomputing the trace id.

Only dump the packet when verdict is not "STOLEN".

Reported-by: Pablo Neira Ayuso <pa...@netfilter.org>
Reported-by: syzbot+2a8850...@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <f...@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Subasri S <subasr...@gmail.com>
---
include/net/netfilter/nf_tables.h | 16 ++++++-----
net/netfilter/nf_tables_core.c | 24 ++++++++++++++---
net/netfilter/nf_tables_trace.c | 44 +++++++++++++++++--------------
3 files changed, 55 insertions(+), 29 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 2b977d5d6f30..744a6703c039 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1373,24 +1373,28 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
/**
* struct nft_traceinfo - nft tracing information and state
*
+ * @trace: other struct members are initialised
+ * @nf_trace: copy of skb->nf_trace before rule evaluation
+ * @type: event type (enum nft_trace_types)
+ * @skbid: hash of skb to be used as trace id
+ * @packet_dumped: packet headers sent in a previous traceinfo message
* @pkt: pktinfo currently processed
* @basechain: base chain currently processed
* @chain: chain currently processed
* @rule: rule that was evaluated
* @verdict: verdict given by rule
- * @type: event type (enum nft_trace_types)
- * @packet_dumped: packet headers sent in a previous traceinfo message
- * @trace: other struct members are initialised
*/
struct nft_traceinfo {
+ bool trace;
+ bool nf_trace;
+ bool packet_dumped;
+ enum nft_trace_types type:8;
+ u32 skbid;
const struct nft_pktinfo *pkt;
const struct nft_base_chain *basechain;
const struct nft_chain *chain;
const struct nft_rule *rule;
const struct nft_verdict *verdict;
- enum nft_trace_types type;
- bool packet_dumped;
- bool trace;
};

void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 2ab4216d2a90..4ee62c0da1b3 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -25,9 +25,7 @@ static noinline void __nft_trace_packet(struct nft_traceinfo *info,
const struct nft_chain *chain,
enum nft_trace_types type)
{
- const struct nft_pktinfo *pkt = info->pkt;
-
- if (!info->trace || !pkt->skb->nf_trace)
+ if (!info->trace || !info->nf_trace)
return;

info->chain = chain;
@@ -42,11 +40,24 @@ static inline void nft_trace_packet(struct nft_traceinfo *info,
enum nft_trace_types type)
{
if (static_branch_unlikely(&nft_trace_enabled)) {
+ const struct nft_pktinfo *pkt = info->pkt;
+
+ info->nf_trace = pkt->skb->nf_trace;
info->rule = rule;
__nft_trace_packet(info, chain, type);
}
}

+static inline void nft_trace_copy_nftrace(struct nft_traceinfo *info)
+{
+ if (static_branch_unlikely(&nft_trace_enabled)) {
+ const struct nft_pktinfo *pkt = info->pkt;
+
+ if (info->trace)
+ info->nf_trace = pkt->skb->nf_trace;
+ }
+}
+
static void nft_bitwise_fast_eval(const struct nft_expr *expr,
struct nft_regs *regs)
{
@@ -85,6 +96,7 @@ static noinline void __nft_trace_verdict(struct nft_traceinfo *info,
const struct nft_chain *chain,
const struct nft_regs *regs)
{
+ const struct nft_pktinfo *pkt = info->pkt;
enum nft_trace_types type;

switch (regs->verdict.code) {
@@ -92,8 +104,13 @@ static noinline void __nft_trace_verdict(struct nft_traceinfo *info,
case NFT_RETURN:
type = NFT_TRACETYPE_RETURN;
break;
+ case NF_STOLEN:
+ type = NFT_TRACETYPE_RULE;
+ /* can't access skb->nf_trace; use copy */
+ break;
default:
type = NFT_TRACETYPE_RULE;
+ info->nf_trace = pkt->skb->nf_trace;
break;
}

@@ -244,6 +261,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)
switch (regs.verdict.code) {
case NFT_BREAK:
regs.verdict.code = NFT_CONTINUE;
+ nft_trace_copy_nftrace(&info);
continue;
case NFT_CONTINUE:
nft_trace_packet(&info, chain, rule,
diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
index 84a7dea46efa..ed4b067bfb6a 100644
--- a/net/netfilter/nf_tables_trace.c
+++ b/net/netfilter/nf_tables_trace.c
@@ -7,7 +7,7 @@
#include <linux/module.h>
#include <linux/static_key.h>
#include <linux/hash.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
#include <linux/if_vlan.h>
#include <linux/init.h>
#include <linux/skbuff.h>
@@ -25,22 +25,6 @@
DEFINE_STATIC_KEY_FALSE(nft_trace_enabled);
EXPORT_SYMBOL_GPL(nft_trace_enabled);

-static int trace_fill_id(struct sk_buff *nlskb, struct sk_buff *skb)
-{
- __be32 id;
-
- /* using skb address as ID results in a limited number of
- * values (and quick reuse).
- *
- * So we attempt to use as many skb members that will not
- * change while skb is with netfilter.
- */
- id = (__be32)jhash_2words(hash32_ptr(skb), skb_get_hash(skb),
- skb->skb_iif);
-
- return nla_put_be32(nlskb, NFTA_TRACE_ID, id);
-}
-
static int trace_fill_header(struct sk_buff *nlskb, u16 type,
const struct sk_buff *skb,
int off, unsigned int len)
@@ -186,6 +170,7 @@ void nft_trace_notify(struct nft_traceinfo *info)
struct nlmsghdr *nlh;
struct sk_buff *skb;
unsigned int size;
+ u32 mark = 0;
u16 event;

if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE))
@@ -229,7 +214,7 @@ void nft_trace_notify(struct nft_traceinfo *info)
if (nla_put_be32(skb, NFTA_TRACE_TYPE, htonl(info->type)))
goto nla_put_failure;

- if (trace_fill_id(skb, pkt->skb))
+ if (nla_put_u32(skb, NFTA_TRACE_ID, info->skbid))
goto nla_put_failure;

if (nla_put_string(skb, NFTA_TRACE_CHAIN, info->chain->name))
@@ -249,16 +234,24 @@ void nft_trace_notify(struct nft_traceinfo *info)
case NFT_TRACETYPE_RULE:
if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, info->verdict))
goto nla_put_failure;
+
+ /* pkt->skb undefined iff NF_STOLEN, disable dump */
+ if (info->verdict->code == NF_STOLEN)
+ info->packet_dumped = true;
+ else
+ mark = pkt->skb->mark;
+
break;
case NFT_TRACETYPE_POLICY:
+ mark = pkt->skb->mark;
+
if (nla_put_be32(skb, NFTA_TRACE_POLICY,
htonl(info->basechain->policy)))
goto nla_put_failure;
break;
}

- if (pkt->skb->mark &&
- nla_put_be32(skb, NFTA_TRACE_MARK, htonl(pkt->skb->mark)))
+ if (mark && nla_put_be32(skb, NFTA_TRACE_MARK, htonl(mark)))
goto nla_put_failure;

if (!info->packet_dumped) {
@@ -283,9 +276,20 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
const struct nft_verdict *verdict,
const struct nft_chain *chain)
{
+ static siphash_key_t trace_key __read_mostly;
+ struct sk_buff *skb = pkt->skb;
+
info->basechain = nft_base_chain(chain);
info->trace = true;
+ info->nf_trace = pkt->skb->nf_trace;
info->packet_dumped = false;
info->pkt = pkt;
info->verdict = verdict;
+
+ net_get_random_once(&trace_key, sizeof(trace_key));
+
+ info->skbid = (u32)siphash_3u32(hash32_ptr(skb),
+ skb_get_hash(skb),
+ skb->skb_iif,
+ &trace_key);
}
--
2.43.0