• Liping Zhang's avatar
    netfilter: conntrack: fix race between nf_conntrack proc read and hash resize · 64b87639
    Liping Zhang authored
    When we do "cat /proc/net/nf_conntrack", and meanwhile resize the conntrack
    hash table via /sys/module/nf_conntrack/parameters/hashsize, race will
    happen, because reader can observe a newly allocated hash but the old size
    (or vice versa). So oops will happen like follows:
    
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000017
      IP: [<ffffffffa0418e21>] seq_print_acct+0x11/0x50 [nf_conntrack]
      Call Trace:
      [<ffffffffa0412f4e>] ? ct_seq_show+0x14e/0x340 [nf_conntrack]
      [<ffffffff81261a1c>] seq_read+0x2cc/0x390
      [<ffffffff812a8d62>] proc_reg_read+0x42/0x70
      [<ffffffff8123bee7>] __vfs_read+0x37/0x130
      [<ffffffff81347980>] ? security_file_permission+0xa0/0xc0
      [<ffffffff8123cf75>] vfs_read+0x95/0x140
      [<ffffffff8123e475>] SyS_read+0x55/0xc0
      [<ffffffff817c2572>] entry_SYSCALL_64_fastpath+0x1a/0xa4
    
    It is very easy to reproduce this kernel crash.
    1. open one shell and input the following cmds:
      while : ; do
        echo $RANDOM > /sys/module/nf_conntrack/parameters/hashsize
      done
    2. open more shells and input the following cmds:
      while : ; do
        cat /proc/net/nf_conntrack
      done
    3. just wait a monent, oops will happen soon.
    
    The solution in this patch is based on Florian's Commit 5e3c61f9
    ("netfilter: conntrack: fix lookup race during hash resize"). And
    add a wrapper function nf_conntrack_get_ht to get hash and hsize
    suggested by Florian Westphal.
    Signed-off-by: default avatarLiping Zhang <liping.zhang@spreadtrum.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    64b87639
nf_conntrack_core.h 2.99 KB