Update on UAF in ip6_do_table on 4.19.X kernel

[stranche@xxxxxxxxxxxxxx]

Hi all,

Following up on the thread we submitted earlier here: 
https://lore.kernel.org/netfilter-devel/44a69247-87bd-905d-bd1c-e9dcb5027641@xxxxxxxxx/

In short, we've seen that on the 4.19.X kernels, there is a crash in the 
Xtables framework where the jumpstack can potentially be used after it 
is freed. We've narrowed down the cause of this crash to a single patch: 
f31e5f1a891f ("netfilter: unlock xt_table earlier in __do_replace"); if 
this patch is reverted, the crash is no longer seen.

It seems that the xt_table lock is needed for get_old_counters() to be 
synchronized properly with the rest of the framework.

Thanks,
Sean