Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Madhu Koriginja <madhu.koriginja@nxp.com>
To:     davem@davemloft.net, kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org,
        edumazet@google.com, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Cc:     vani.namala@nxp.com, Madhu Koriginja <madhu.koriginja@nxp.com>
Subject: [PATCH 4.19] net: netfilter: Keep conntrack reference until IPsecv6 policy checks are done
Date:   Tue, 25 Apr 2023 18:46:05 +0530
Message-Id: <20230425131605.2576011-1-madhu.koriginja@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?5263tvSAFpygdA028+Npciqsuj8K9m6skes+KH3Mba9jD4Yf9tx5kcfoLjxc?=
 =?us-ascii?Q?WzW2llqMJB7X4QQ6WNA93lNaoYg9aEioB0G4uXheZSocaLzG2zzuNDE63K6n?=
 =?us-ascii?Q?jY5QDqy3fc3p8uMYfH+VL1AslG0fAmZcf1kk6d/sgK1vSv8fYaTjXJCdXkLu?=
 =?us-ascii?Q?VlZIwGn/SiLy8CQg1TklBhTNdP84KGd31cGHXJegcDB5nAeJ8WUhJR76Ergd?=
 =?us-ascii?Q?Xy6sVTrx5ADu/9fqbtqt+l2sxmf7EkhSnB7QMzDP03AesagIWAttgEVn67mE?=
 =?us-ascii?Q?Z+SnxiPx2WqEzxN4eKTINYFdY0THJ4FU4H0VYRpVZYoTLMzRWFK5KPUYMUpk?=
 =?us-ascii?Q?BVeQGP4WuMcQkreCvrA8Da5xx50NUwfUjMggTKUHZ0ovz6qk+7Vc6vFnUtcu?=
 =?us-ascii?Q?wWZCKrc+JST8R2XEOq+vHkJsSYhYVRrMF6hJa17TnruiMaBTAIEbFk1hfggo?=
 =?us-ascii?Q?SsWqZggeRnZMZCUGTwlECVVAEjoDni/N+/oibTOF1o0zY2RTaeXoYJ4irqde?=
 =?us-ascii?Q?6nFiRqDyMvj4Cp2MTy0qMqajboeL1uwyVQe2uo9ZSbo9Djr04K9AOj6Y6W4l?=
 =?us-ascii?Q?Q6iRwKNMlzUj8gO2j9L4CrD/zeu4y86opnyNbXU1DT92EWa4wziTnS+EIrWa?=
 =?us-ascii?Q?EgbyNLBUBc7A9Dx9C4GhgCzCRY9GAVlINGbTO/5VtzGmVskhcgd/uGXDYOi7?=
 =?us-ascii?Q?3KqeGPwCKvi0L2otSUSi7uJ/FhkPqZPTGxWFbcu4RsdOBNmmy3eGRgA6XjZf?=
 =?us-ascii?Q?XZpVTBgAH9QselN10+o/HqUbb6PuK93sDZPgg/6ja1Bdr1SDA2IFB8VLNzua?=
 =?us-ascii?Q?W2sBtqv5r+vI16JdxStZa25R+Stm76U0KqP2ZqUpe1ZaovshDiG8ktP+Xx41?=
 =?us-ascii?Q?5K7/ma2Wc+1mmJbhPim/e8BJzf7NQjUz0nwm+CaWQOUK57/HWUDlBwt0AUU5?=
 =?us-ascii?Q?n3knO8rRSnLgamCHWAuRZsge0AsmZmFDC838+cm8sjHijagP7CyesmH/jbzX?=
 =?us-ascii?Q?LE/wVC9EXxODQnECzRi/yp4tEmDDXljri3lLMGhmL40xzY6J66+UlEjWdsIp?=
 =?us-ascii?Q?ZT4i8pOWt3+MOzVeOR8IhsWtRhOgSG0pBUnHvARbe58tDBCT0TFBLGc3jPQY?=
 =?us-ascii?Q?M7yQxxIp+Kc1tbuDfb0XH92GvcRO6+4L0yBe5RJS5vv+LW6u+6cgSDF83YPK?=
 =?us-ascii?Q?2SkFMZDV0nVgPtSaQbNFCfpe1I1h+07KmgTSD4WMPTrbW7KMGdkGjE4vVfxK?=
 =?us-ascii?Q?236/Gc/Q5ZatfZllcLkBGrERJauItidUMc+s+tepTwbl/XZcOrltpWE18+gp?=
 =?us-ascii?Q?xtdLREr5RUAzxwx5rVuL5KYUvYh1clb0rUS7GjzESfGLwhvSx1XGA3cXGIfp?=
 =?us-ascii?Q?LJHbh8A2zahVjsYe04iAijLb/cXXG28qikG5Yv/Xg1NKU8UdhlYIUsNZ6Uzz?=
 =?us-ascii?Q?f25AbOJ8O6Qf2zXJkJqlZ4aXt6/lh6PnL2HleXsVDg76V2K7bKaUzl7XsAsr?=
 =?us-ascii?Q?7GGVSJSaDIbo6NJZb7x9BQj7yWDEkBHlJM5NqTxCEbGWVjRGrqpFe/gtDTVu?=
 =?us-ascii?Q?SICsmOUVzZp36RGKL50mAfDWGn3pNIcR6heCVig6L7TJX9BSZO2hJl7aApxW?=
 =?us-ascii?Q?lA=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fa90b2a5-1236-488a-a4d9-08db458f4999
X-MS-Exchange-CrossTenant-AuthSource: DB9PR04MB9648.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Apr 2023 13:16:32.1914
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: yna3RGUff0Zno2WcNOIwIM+VdkUaY//6kuNiLu0OAxKy7wruac61L83uIdwBzJfexa7Y0SRTapytF95+212mFA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR04MB6901
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Keep the conntrack reference until policy checks have been performed for
IPsec V6 NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Madhu Koriginja <madhu.koriginja@nxp.com>
---
 net/dccp/ipv6.c      |  1 +
 net/ipv6/ip6_input.c | 14 +++++++-------
 net/ipv6/raw.c       |  2 +-
 net/ipv6/tcp_ipv6.c  |  2 ++
 net/ipv6/udp.c       |  2 ++
 5 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index b2a26e41f932..f953b5b5613d 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -773,6 +773,7 @@ static int dccp_v6_rcv(struct sk_buff *skb)
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
+	nf_reset(skb);
 
 	return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,
 				refcounted) ? -1 : 0;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 2bdb03a45baf..6a9a1e637506 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -371,10 +371,6 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk
 			/* Only do this once for first final protocol */
 			have_final = true;
 
-			/* Free reference early: we don't need it any more,
-			   and it may hold ip_conntrack module loaded
-			   indefinitely. */
-			nf_reset(skb);
 
 			skb_postpull_rcsum(skb, skb_network_header(skb),
 					   skb_network_header_len(skb));
@@ -385,9 +381,13 @@ static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *sk
 			    !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb)))
 				goto discard;
 		}
-		if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
-		    !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
-			goto discard;
+
+		if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) {
+			if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+				goto discard;
+
+			nf_reset(skb);
+		}
 
 		ret = ipprot->handler(skb);
 		if (ret > 0) {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 44e9a240d607..e7180cd8ac70 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -220,7 +220,6 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 
 			/* Not releasing hash table! */
 			if (clone) {
-				nf_reset(clone);
 				rawv6_rcv(sk, clone);
 			}
 		}
@@ -428,6 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
+	nf_reset(skb);
 
 	if (!rp->checksum)
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f69c1b83403b..2b5b6e208947 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1568,6 +1568,8 @@ static int tcp_v6_rcv(struct sk_buff *skb)
 	if (tcp_v6_inbound_md5_hash(sk, skb))
 		goto discard_and_relse;
 
+	nf_reset(skb);
+
 	if (tcp_filter(sk, skb))
 		goto discard_and_relse;
 	th = (const struct tcphdr *)skb->data;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 16c98a2a5c36..59c5ee9d9d32 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -570,6 +570,7 @@ static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto drop;
+	nf_reset(skb);
 
 	if (static_branch_unlikely(&udpv6_encap_needed_key) && up->encap_type) {
 		int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
@@ -861,6 +862,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
 		goto discard;
+	nf_reset(skb);
 
 	if (udp_lib_checksum_complete(skb))
 		goto csum_error;
-- 
2.25.1