)]}'
{
  "commit": "5da773a3e81e6093c4346ee8cd356fc214d7c76c",
  "tree": "abe10a96daae1bd4a58e045771a9ebb74714c0f1",
  "parents": [
    "e2a750070aeec7af3818065b39d61cb38627ce64"
  ],
  "author": {
    "name": "Florian Westphal",
    "email": "fw@strlen.de",
    "time": "Wed Jul 26 00:02:34 2017 +0200"
  },
  "committer": {
    "name": "Pablo Neira Ayuso",
    "email": "pablo@netfilter.org",
    "time": "Mon Jul 31 19:09:39 2017 +0200"
  },
  "message": "netfilter: nfnetlink_queue: don\u0027t queue dying conntracks to userspace\n\nWhen skb is queued to userspace it leaves softirq/rcu protection.\nskb-\u003enfct (via conntrack extensions such as helper) could then reference\nmodules that no longer exist if the conntrack was not yet confirmed.\n\nnf_ct_iterate_destroy() will set the DYING bit for unconfirmed\nconntracks, we therefore solve this race as follows:\n\n1. take the queue spinlock.\n2. check if the conntrack is unconfirmed and has dying bit set.\n   In this case, we must discard skb while we\u0027re still inside\n   rcu read-side section.\n3. If nf_ct_iterate_destroy() is called right after the packet is queued\n   to userspace, it will be removed from the queue via\n   nf_ct_iterate_destroy -\u003e nf_queue_nf_hook_drop.\n\nWhen userspace sends the verdict (nfnetlink takes rcu read lock), there\nare two cases to consider:\n\n1. nf_ct_iterate_destroy() was called while packet was out.\n   In this case, skb will have been removed from the queue already\n   and no reinject takes place as we won\u0027t find a matching entry for the\n   packet id.\n\n2. nf_ct_iterate_destroy() gets called right after verdict callback\n   found and removed the skb from queue list.\n\n   In this case, skb-\u003enfct is marked as dying but it is still valid.\n   The skb will be dropped either in nf_conntrack_confirm (we don\u0027t\n   insert DYING conntracks into hash table) or when we try to queue\n   the skb again, but either events don\u0027t occur before the rcu read lock\n   is dropped.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7c543bfbf624f6e9b97bf6fe5b17ab0a9bb776b8",
      "old_mode": 33188,
      "old_path": "net/netfilter/nfnetlink_queue.c",
      "new_id": "c9796629858f795629f0de0c60e0cd41acc85a80",
      "new_mode": 33188,
      "new_path": "net/netfilter/nfnetlink_queue.c"
    }
  ]
}