4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <f...@strlen.de>
commit 84379c9afe011020e797e3f50a662b08a6355dcf upstream.
Eric Dumazet reports:
Here is a reproducer of an annoying bug detected by syzkaller on our
production kernel
[..]
./b78305423 enable_conntrack
Then :
sleep 60
dmesg | tail -10
[ 171.599093] unregister_netdevice: waiting for lo to become free. Usage
count = 2
[ 181.631024] unregister_netdevice: waiting for lo to become free. Usage
count = 2
[ 191.687076] unregister_netdevice: waiting for lo to become free. Usage
count = 2
[ 201.703037] unregister_netdevice: waiting for lo to become free. Usage
count = 2
[ 211.711072] unregister_netdevice: waiting for lo to become free. Usage
count = 2
[ 221.959070] unregister_netdevice: waiting for lo to become free. Usage
count = 2
Reproducer sends ipv6 fragment that hits nfct defrag via LOCAL_OUT hook.
skb gets queued until frag timer expiry -- 1 minute.
Normally nf_conntrack_reasm gets called during prerouting, so skb has
no dst yet which might explain why this wasn't spotted earlier.
Reported-by: Eric Dumazet <eric.duma...@gmail.com>
Reported-by: John Sperbeck <jsperb...@google.com>
Signed-off-by: Florian Westphal <f...@strlen.de>
Tested-by: Eric Dumazet <eduma...@google.com>
Reported-by: syzbot <syzkal...@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -585,6 +585,8 @@ int nf_ct_frag6_gather(struct net *net,
fq->q.meat == fq->q.len &&
nf_ct_frag6_reasm(fq, skb, dev))
ret = 0;
+ else
+ skb_dst_drop(skb);
out_unlock:
spin_unlock_bh(&fq->q.lock);
