net: make skb_dst_force return true when dst is refcounted

BugLink: https://bugs.launchpad.net/bugs/1839036
[ Upstream commit b60a77386b1d4868f72f6353d35dabe5fbe981f2 ]

netfilter did not expect that skb_dst_force() can cause skb to lose its
dst entry.

I got a bug report with a skb->dst NULL dereference in netfilter
output path.  The backtrace contains nf_reinject(), so the dst might have
been cleared when skb got queued to userspace.

Other users were fixed via
if (skb_dst(skb)) {
	skb_dst_force(skb);
	if (!skb_dst(skb))
		goto handle_err;
}

But I think its preferable to make the 'dst might be cleared' part
of the function explicit.

In netfilter case, skb with a null dst is expected when queueing in
prerouting hook, so drop skb for the other hooks.

v2:
 v1 of this patch returned true in case skb had no dst entry.
 Eric said:
   Say if we have two skb_dst_force() calls for some reason
   on the same skb, only the first one will return false.

 This now returns false even when skb had no dst, as per Erics
 suggestion, so callers might need to check skb_dst() first before
 skb_dst_force().

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/include/net/dst.h b/include/net/dst.h
index d49d607dd2b3c564afa640929e46bcfcdb7431f0..9b8ecfa63b6206f29ed8223efee2aac46cfe51dd 100644 (file)
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -330,8 +330,9 @@ static inline bool dst_hold_safe(struct dst_entry *dst)
  * @skb: buffer
  *
  * If dst is not yet refcounted and not destroyed, grab a ref on it.
+ * Returns true if dst is refcounted.
  */
-static inline void skb_dst_force(struct sk_buff *skb)
+static inline bool skb_dst_force(struct sk_buff *skb)
 {
        if (skb_dst_is_noref(skb)) {
                struct dst_entry *dst = skb_dst(skb);
@@ -342,6 +343,8 @@ static inline void skb_dst_force(struct sk_buff *skb)
 
                skb->_skb_refdst = (unsigned long)dst;
        }
+
+       return skb->_skb_refdst != 0UL;
 }
 
 

diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 8260b1e73bbd17eaa7c90e167e93d6f89695e4ea..37efcc1c888777fe7af409525665735308142001 100644 (file)
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -138,6 +138,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
                goto err;
        }
 
+       if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
+               status = -ENETDOWN;
+               goto err;
+       }
+
        *entry = (struct nf_queue_entry) {
                .skb    = skb,
                .state  = *state,
@@ -146,7 +151,6 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
        };
 
        nf_queue_entry_get_refs(entry);
-       skb_dst_force(skb);
        afinfo->saveroute(skb, entry);
        status = qh->outfn(entry, queuenum);